Privacy Policy
Version 22 September 2026. In force from that date.
This Privacy Policy explains what personal data 5wire Networks Ltd, trading as Ottom ("Ottom", "we") collects, why, who else sees it, how long we keep it and what you can ask us to do with it. Ottom sends automated shopping agents to online stores and reports where they stall. That work needs very little about people, and we hold no shopper personal data.
In plain words: what a scan keeps, and for how long.
1. Who is responsible for your data
5wire Networks Ltd is the controller of the personal data described here. We are a company registered in England and Wales with company number 09105675, at 86-90 Paul Street, London EC2A 4NE, United Kingdom. Write to us about anything in this policy at [email protected].
When a business uses Ottom to handle personal data for its own purposes, such as the colleagues it invites or the people it sends reports to, that business is the controller and we act for it under our Data Processing Agreement. Questions about that data are best sent to the business, though we will pass them on.
2. We hold no shopper personal data
Ottom never touches a store's customer records. Our agents browse a store as themselves, identified as "OttomAgent/1.0 (+https://ottom.io/agent)". They reach the checkout, stop there, type nothing into it and never submit a payment. If you run a store we have scanned, there is no shopper of yours in our database.
If you install our Shopify app, Shopify may send us its standard privacy requests about your customers. We record only the reference numbers in them, never the customer's name, email or phone, and answer that we hold no data about them.
3. What we collect
When you use Ottom
- Your email address, when you start a scan, sign in or are invited. Your name, if you give it.
- Sign-in details: a scrambled (hashed) password if you set one, your two-factor and passkey settings, and, if you sign in with Google or Shopify, the email and account number they give us.
- The stores you ask us to scan and everything the scans produce: scores, findings, screenshots and page recordings. These are about storefronts, not people.
- Your workspaces: who is in them and with what role, invitations you send, and the addresses you share reports with or send alerts to.
- Billing: your plan, invoices and payment status. Stripe or Shopify holds your card; card numbers never reach our servers.
- Support: the emails you send us and our replies.
- Security records: the IP address and browser used for each sign-in, and failed sign-in attempts.
- Emails we send you: what we sent, when, and whether it was delivered, opened or clicked.
- How you use the product: events such as a scan started or a plan chosen, recorded against an internal account number.
When you visit the website
- Server logs: your IP address, the page requested and your browser, kept to run and protect the site.
- Cookies, listed below. Google Analytics runs only if you allow it.
If you are a partner
- Your payout email, the payment details you give us for payouts, your invoices, and the referrals and commission on your statement.
If you sign an enterprise Order Form
- The name, job title and email you sign with, your role in the workspace, the time, your IP address and browser, and a fingerprint (SHA-256) of the document you reviewed. This is the evidence that the contract was agreed, so it is kept even if your account is later erased.
If you run a store we scan
Our agents read the public pages of a store as a shopper would: products, prices, stock, delivery and returns policies. We keep screenshots and recordings of those pages. If a page shows personal data, such as a reviewer's name, it can appear in them; we do not look for it or use it. If you write to us to stop our agents, we keep your request and the address it came from.
4. Why we use it, and on what legal basis
UK data protection law requires a legal basis for each use. Ours are these:
| What we do | Legal basis |
|---|---|
| Run your account, scans, reports, alerts and plans, and send the emails that go with them | Contract: we need it to provide what you asked for |
| Take payment and keep financial records | Contract, and our legal obligations |
| Keep accounts and the service secure, and prevent abuse and fraud | Our legitimate interest in a safe, working service |
| Send product and follow-up emails about your scan and Ottom | Our legitimate interest in telling customers about what they started, with the soft opt-in rule for email. Unsubscribe from any of them in one click |
| Count how the product is used, without cookies | Our legitimate interest in improving Ottom |
| Google Analytics on the website | Your consent, which you can withdraw |
| Scan public storefronts, including stores that have not signed up, and publish anonymised benchmarks | Our legitimate interest in measuring how AI agents treat online stores |
| Run the referral program and pay partners | Contract |
| Keep a record of who signed an enterprise Order Form | Our legitimate interest in being able to show a contract was agreed |
| Answer support requests and privacy requests | Contract, legal obligation, and our legitimate interests |
Where we rely on legitimate interests, you can object at any time and we will stop unless we have a compelling reason not to. We never sell personal data, run no advertising and make no decisions about people by automated means: our scores are about stores.
5. Email
Emails about your account, your payments, your reports and your alerts are part of the service. Other emails, such as follow-ups after a scan, tips and a weekly digest, each carry a one-click unsubscribe link, and you can choose what you get from your account settings. We record when our emails are opened and which links are clicked, to know which ones are useful.
7. Analytics
We use Google Analytics to see which pages bring people to Ottom. It is off until you press Allow on the notice at the bottom of the page. Press No thanks and nothing is sent. The site works the same either way.
The analytics tag is served from ottom.io rather than Google’s domain, so loading it does not announce your visit to a third party before you have answered. No page address we send to Google contains a real identifier: a report link is reported as /report/[runId], and query strings are removed. Report, approval and unsubscribe links are credentials, and we share them with nobody.
Separately, our servers record product events, such as a scan started, with PostHog in the European Union. These carry an internal account number, never an email address, and set no cookies.
8. Who else sees it
These services handle personal data for us, under contracts that limit them to doing so on our instructions. The current list, with changes, is on our subprocessors page.
| Service | What for | Where |
|---|---|---|
| Anthropic | Runs the AI models our agents use to read and judge a storefront. | United States |
| Stripe | Takes card payments, sends invoices and calculates tax. | United States and European Union |
| Resend | Sends our email and receives email sent to our support address. | United States |
| Cloudflare | Sits in front of the website: domain names, caching, protection from attacks, and sign-in for our own staff tools. | Global network, United States company |
| Sentry | Tells us when the software fails, so we can fix it. | United States |
| PostHog | Counts how the product is used, such as scans started and plans chosen. | European Union |
| Google Analytics, only if you allow it on the cookie notice, and Sign in with Google if you choose it. | United States | |
| Slack | Tells our team when a customer starts a scan, a trial or a plan, or cancels one. | United States |
Shopify, if you use our Shopify app, receives and holds data under its own terms with you. We may also share data with professional advisers, with a buyer of our business, or where the law requires it.
9. Where your data is kept
Our servers are in the United Kingdom. Some of the services above are in the United States or elsewhere. When personal data goes outside the UK, it is protected by the UK government's adequacy regulations, by the UK Extension to the EU US Data Privacy Framework where the provider is certified, or by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses. Ask us for a copy of the safeguard that applies.
10. How long we keep it
| Data | How long |
|---|---|
| Your account, stores, scans, reports and support conversations | As long as your account exists. When you delete your account or ask us to erase your data, we do it within 30 days |
| Page recordings from a scan (the page code and network log) | 60 days, or 365 days for a store under an enterprise contract |
| Screenshots attached to a finding | As long as the report they belong to |
| Sign-in sessions and sign-in links | 30 days after they expire or are used |
| The IP address and browser recorded with a sign-in | 12 months |
| Records of failed sign-in attempts | Up to 90 days |
| Our record of emails we sent you, and whether they were opened or clicked | 24 months |
| Referral link clicks that did not lead to a referral | 12 months |
| Server logs, including IP addresses | 30 days |
| Backups of our database | 30 days |
| Invoices and payment records | At least six years, as UK tax law requires |
| Records of what our staff did in the admin tools | Six years, to deal with legal claims |
| Signatures on an enterprise Order Form: name, job title, email, IP address and browser | The life of the contract plus six years, to show who agreed to it |
| A request to stop our agents visiting a store | Kept for as long as the opt-out lasts, so we keep honouring it |
When we erase your data we remove or anonymise it: your email address is replaced, your sign-in details, invitations and sharing addresses are deleted, and your support conversations and mailing list entry are removed. A blank account record remains so that invoices and partner ledgers still add up. Backups age out on the schedule above.
11. How we protect it
- Passwords are hashed with scrypt; sign-in links, sessions and API tokens are stored only as hashes.
- Shopify access tokens and storefront passwords are encrypted with AES-256-GCM.
- You can protect your account with an authenticator app or a passkey.
- Our servers accept web traffic only through Cloudflare, and our staff tools sit behind a separate sign-in.
- Every action our staff take in the admin tools, including viewing an account as its owner sees it to answer a support request, is logged.
If a breach puts your personal data at risk, we will tell you and the Information Commissioner's Office as the law requires.
12. Your rights
You can ask us to give you a copy of your personal data, correct it, erase it, restrict how we use it, send it to you in a portable form, or stop using it where we rely on legitimate interests. Where we rely on consent, you can withdraw it at any time.
- Download your data and delete your account from your account settings. Deletion can be undone for seven days, then it is final.
- For anything else, write to [email protected]. We answer within 30 days and may ask you to confirm who you are.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
13. If you run a store we scan
Anyone can ask Ottom for a one-off scan of a public store, and we scan some stores ourselves to build anonymised benchmarks that never name a store. Our agents identify themselves, follow robots.txt when finding pages, keep to a daily limit per store and never buy anything. The full details are on our agent page.
To stop our agents visiting your store, write to [email protected] from an address on the store's domain. We stop every scan of that domain, whoever asked for it, and keep your request so we keep stopping.
14. Children
Ottom is for businesses and not for anyone under 18.
15. Changes to this policy
We publish every version of this policy with its date and what changed on our legal page, and email account owners before a change that affects how we use their data.
Version history
- 22 September 2026 (in force): Rewritten in full: names the company, every service that handles personal data, where data is kept, how long, the legal basis for each use, and how to delete your account yourself.
- 16 September 2026: The privacy page as it stood before the full policy: what Ottom stores, the cookies it sets, and who else sees data.