Welcome to Otomorph (“we,” “our,” or “us”). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the Otomorph mobile application and our automotive software products (the “App”).
We operate in accordance with the General Data Protection Regulation (GDPR) and other applicable European privacy laws.
02.
Who is the Data Controller?
The App is operated by a registered corporate entity. For the purposes of the GDPR, the Data Controller is:
Company Name: Otomorph SAS
Address: 62 Boulevard de Bezons, B02, Sartrouville 78500, France
Contact Email: contact@otomorph.com
Data Protection Officer (DPO): We are not required to appoint a DPO as our core activities do not involve large-scale systematic monitoring of individuals. For all privacy inquiries, please contact the email above.
A. Data You Provide to Us
We collect different types of data depending on how you interact with our App.
A. Data You Provide to Us
Identity Data: First name and Last name (used for creating your profile).
A. Data You Provide to Us
Contact Data: Email address (used for authentication and communication).
Car Data: We collect your license plate number to extract the Vehicle Identification Number (VIN), which acts as your car's unique identifier in our database. You can optionally scan car documents and maintenance records to power our predictive maintenance feature; skipping this is fully optional but will result in a degraded predictive maintenance experience.
Blockchain & Wallet Data: The public addresses of the Web3 wallet created during onboarding, your vehicle's Decentralized Identifier (DID), and basic data regarding the car NFT.
AI Interaction Data: The text prompts, questions, and contextual car data you submit to our in-app AI assistant.
B. App Diagnostics (Not Continuously Tracked)
We do not continuously track you in the background. To ensure the App functions properly, our infrastructure (Google Firebase) only logs basic diagnostic data when you actively use the App:
Technical Data: Device model and operating system version (strictly used for app stability, we do NOT collect your IP address or advertising device IDs).
Usage Data: App launch times and basic interaction logs (essential for debugging).
Crash Logs (Opt-in): We use Firebase Crashlytics to collect anonymous crash reports to fix bugs. This feature is disabled by default; we only collect this data if you explicitly activate it in your profile menu.
C. Permissions (On-Device Access)
Camera: To scan car maintenance documents or QR codes.
Location (GPS): To find nearby parking, EV charging stations, or navigation. Note: We do not store your location history on our servers. However, when you use the map features, your location data is processed through the Google Maps API to provide you with routing and nearby services.
Storage (Photos/Files): To allow you to upload existing car documents and to save the encrypted backup file of your crypto wallet keys. We only access the specific files you select or create.
04.
Blockchain Technology and Data Security
Otomorph uses the IOTA network (Distributed Ledger Technology) to create a secure, verifiable history of your vehicle.
Required Setup vs. Optional Features: During onboarding, the App requires the creation of a Web3 wallet, a Decentralized Identifier (DID) for your vehicle, and a basic vehicle NFT to establish its digital twin. However, all subsequent blockchain operations—such as anchoring encrypted maintenance records or notarizing documents—are completely optional. You can use the core features of the App without continuously writing data to the ledger.
Privacy by Design: We never store your Personally Identifiable Information (PII), such as your name, email, or contact details, on the blockchain. Any data anchored to the ledger is strictly technical and heavily encrypted. While the underlying network is decentralized, your actual data is mathematically obfuscated and entirely unreadable to the public.
Full Data Control & Erasure: Unlike traditional legacy blockchains, our advanced infrastructure (utilizing IOTA Rebased) ensures you retain absolute control over your digital assets. You can request to delete your data from the ledger at any time—such as burning vehicle-related NFTs or removing notarized documents—fully guaranteeing your "Right to be Forgotten" under the GDPR.
Cryptographic Proofs: We use advanced hashing techniques to secure your information. This means your sensitive vehicle data remains strictly private to you, yet you can use the network to mathematically prove the authenticity of your vehicle's maintenance history to third parties.
05.
Why We Process Your Data (Legal Basis)
A. To Provide Our Services (Performance of a Contract): We need to process your data to make the App work for you. This includes:
Creating your user account and logging you in.
Managing your car's digital twin and maintenance records.
Using your Web3 Wallet strictly to store your vehicle's NFTs and to perform notarization transactions on the blockchain.
Processing your premium subscriptions. Note: Subscriptions are handled entirely by the Google Play Store; we never see, collect, or store your credit card or payment data.
Sending you helpful notifications, like maintenance reminders.
B. To Improve the App (Legitimate Interests): We use some basic technical data to make our business better, as long as it doesn't interfere with your privacy. For example, we analyze general App usage data (like launch times) to ensure stability and improve the user experience.
C. With Your Permission (Consent): We will ask for your explicit permission before sending you marketing emails (you can opt out anytime), accessing your device's Camera to scan documents (you control this in your phone settings), or collecting anonymous crash logs via Firebase Crashlytics to help us debug (you can toggle this on or off at any time in your profile menu).
06.
Services We Use to Run the App
We absolutely do not sell your data, and we do not share it with advertising companies or outside partners. Your data stays within the App. However, to make the App functional, we use certain technical infrastructure APIs (which act as our legal "Processors"):
Google Cloud Platform & Firebase: To securely host the App's database, manage your login, and process optional crash reports (Firebase Crashlytics) to help us debug.
Google Maps API: To display maps and nearby EV stations. (Your location is processed to show the map, but it is not saved by us).
Google Gemini API: To power our in-app AI chat. As a reminder, we use the enterprise version, meaning Google does NOT use your prompts or car data to train their public AI models.
Google Play Store: To process your in-app subscriptions securely.
IOTA Blockchain Nodes: To anchor your vehicle's history if you choose to use the optional Web3 features. Data sent here is mathematically obfuscated, as explained in Section 4.
07.
Data Storage and Localization
All your personal data is stored securely in the European Economic Area (EEA). Specifically, our primary databases and backend infrastructure (Google Cloud Platform) are hosted in the Paris (France) and Europe regions. While our infrastructure provider (Google) is a US-based company, your data remains localized in Europe. Any incidental technical processing complies with the strict EU-US Data Privacy Framework (DPF).
Account Data: We keep your personal data as long as your account is active. If you request account deletion, we delete your personal data within 30 days.
Inactive Accounts: To comply with data minimization principles, we will automatically delete your personal data if your account remains inactive for a continuous period of 3 years.
Blockchain Data: Because we use the advanced IOTA Rebased network, your anchored data does not have to remain on the ledger indefinitely. You can request to delete (burn) your vehicle's NFTs or notarized documents at any time.
Under the GDPR, you have the following rights:
Right to Access: Request a copy of the data we hold about you.
Right to Rectification: Correct inaccurate data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your data from our servers. For blockchain data, because your Web3 wallet is non-custodial (Self-Custody), you hold the private keys directly on your device; we do not possess them. Therefore, you have the absolute power to initiate the deletion (burning) of your blockchain assets, which our App will technically facilitate for you.
Right to Portability: Get your data in a structured, machine-readable format.
Right to Object: Opt-out of marketing emails at any time.
To exercise these rights, please contact us at: contact@otomorph.com
Otomorph is intended for adults who own or manage vehicles. We do not knowingly collect data from children under the age of 16. If we become aware that a child has provided us with personal data, we will take steps to delete such information.