Otter

Users clearly retain ownership rights to their uploaded content and audio recordings. The privacy policy and terms explicitly state that users retain copyright and proprietary rights to their User Content.

While users retain ownership of their input content, the terms grant Otter broad licensing rights to process, modify, and distribute user content. The generated transcriptions and AI outputs fall under these broad licensing terms, creating some ambiguity around output ownership.

Otter uses user data for training in two ways: automatic training on de-identified audio recordings, and training on transcripts (which may contain personal information) with user consent. While some safeguards exist, the automatic use of transcripts for training presents moderate privacy risk.

Users have good control over data deletion with clear retention schedules. Deleted conversations move to trash and are automatically purged after 30 days, or can be manually deleted immediately. The policy provides specific timeframes and user control mechanisms.

Otter shares data with numerous third parties including cloud providers, AI service providers, data labeling services, analytics providers, and advertising partners. While disclosed, the extensive sharing network creates moderate risk for data exposure beyond the primary service purpose.

Limited opt-out options are provided. Users can opt out of marketing communications and some analytics tracking, but cannot opt out of core data processing including AI training on transcripts or sharing with essential service providers.

Strong compliance framework with multiple certifications explicitly mentioned: SOC 2 Type 2, GDPR, CCPA, HIPAA, EU-US Data Privacy Framework, and ISO 27001/2 alignment. Independent auditing is confirmed for SOC 2.

No information provided about model transparency, explainability features, or enterprise auditing capabilities. This is a significant gap for organizations requiring algorithmic accountability.

Comprehensive security measures documented including AES-256 encryption, AWS infrastructure, two-factor authentication, employee background checks, MDM for devices, and SOC 2 Type 2 certification. No breach incidents disclosed.

The policy indicates different handling for enterprise customers vs. individual users, with enterprise customers having more control. However, the specific differences in data protection measures between free and paid tiers are not clearly detailed.

Otter reserves rights for human review under specific circumstances with explicit user consent for manual audio review, and customer support access for troubleshooting. While consent-based, this creates potential privacy exposure.

Clear policies for government data requests requiring legal process, with user notification commitments. Strong stance against voluntary cooperation with surveillance and foreign government requests.

Otter collects standard PII (name, email, IP address, device identifiers) and potentially sensitive audio recordings containing personal conversations. Payment data is handled by Stripe. The broad audio recording capability creates potential for extensive SPI collection depending on conversation content.