Privacy Policy

1. Introduction

Otter Quotes ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website and associated services. This policy applies to all users of Otter Quotes, including homeowners, contractors, and other users of our services.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Information You Directly Provide

• Account Registration: Name, email address, phone number, profile information, address, and property details. You can create an account either by signing in with Google (which provides us your email, name, and Google account ID) or by requesting a magic link sent to your email address.
• Insurance Documents: Insurance policies, claim information, coverage details, and related documents you upload
• Property Information: Property address, property type, size, condition, and photos
• Communication Data: Messages, emails, support requests, and correspondence with us or other users
• Contractor Information: Contractor details, quotes, estimates, and work descriptions
• No-Account Measurement Report Orders: If you request a roof measurement report through our website without creating an account, we collect the name, email address, and phone number you provide, your property address, your order and payment details, any loss sheet or insurance document you upload, and the record of your consent to our Terms of Service and Privacy Policy. We use this information to fulfil your order — including sharing your property address and contact information with our measurement-report provider (see Section 4.2) — and to email the finished report to the address you provided.

2.2 Information Automatically Collected

• Device Information: Device type, operating system, browser type, and unique device identifiers
• Usage Data: Pages visited, features used, actions taken, time spent on pages, and interaction patterns
• IP Address and Location: IP address, approximate geographic location, and referral source
• Cookies and Tracking: Cookies, web beacons, and similar tracking technologies
• Referral Information: How you accessed our platform (search engines, links, referral sources), including which partner's referral link you used and the time of that visit.
• First Visit Page and Referring Site: For a first visit, the page path you landed on, the host name of the site that referred you, and the time of that visit. We first keep this in a cookie (up to 90 days) and in local storage on your browser, and attach it to your account if you sign up. If the link you used carries no campaign tag (utm_ parameters, fbclid or gclid), we do not record it when your browser sends a Global Privacy Control signal or when you have used the opt-out button in Section 12 on that browser. A first visit through a link that does carry such a tag is recorded regardless of those settings, and for such a visit we also keep the campaign tag values the link carries (utm_source, utm_medium, utm_campaign, utm_content and utm_term) and any ad click ID it carries (fbclid or gclid). An opt-out made later, by any method or on any device, does not remove a first visit already stored.

2.3 Information from Third Parties

• Google Analytics: Usage analytics and aggregated user behavior data
• Stripe: Payment processing information (we do not store full credit card numbers)
• Netlify: Server logs and performance data
• Supabase: Database and authentication service data
• Google (OAuth Sign-In): When you choose to sign in with Google, Google provides us with your email address, name, and Google account ID. We do not receive your Google password.
• Advertising Lead Forms (Meta and LinkedIn): If you submit a lead form in one of our ads on Facebook, Instagram, or LinkedIn, Meta Platforms, Inc. or LinkedIn Corporation collects the information you enter (such as your name, phone number, email address, property address and your answers to the form's questions) and provides it to us. This includes lead forms used to sign up as a referral partner. We use it to respond to your request, including by email and by phone call, and by text message or automated call only if you checked the consent box on that form. Meta's and LinkedIn's handling of information on their own platforms is governed by their own privacy policies.

3. How We Use Your Information

3.1 Primary Uses

• Platform Operations: Maintaining and operating our platform, services, and features
• Service Delivery: Providing the services you requested, including claim matching and contractor recommendations
• Communication: Sending transactional emails, support responses, and service updates
• Payment Processing: Processing payments and managing billing transactions
• Analytics and Improvement: Analyzing usage patterns to improve our services and user experience
• Fraud Prevention: Detecting, preventing, and addressing fraud and security issues
• Legal Compliance: Complying with legal obligations and responding to lawful requests

3.2 Marketing and Promotional Communications

We may send you marketing emails and promotional materials about new features, services, and offers. You can opt out of marketing communications at any time by clicking the unsubscribe link in our emails or updating your preferences in your account settings.

3.3 Automated Decision-Making

We do not use your information for automated decision-making or profiling that would have a legal or similarly significant effect on you.

4. How We Share Your Information

4.1 Sharing with Contractors

If you request contractor recommendations or matching services, we will share relevant information (property details, project scope, insurance information) with contractors you connect with on our platform. We share your name and contact information with the contractor you select, so they can prepare and perform your contract.

4.2 Sharing with Service Providers

We share information with third-party service providers who assist us in operating our platform and providing services:

• Supabase: Database hosting and authentication services
• Netlify: Website hosting and CDN services
• Google Analytics (GA4): Usage analytics and performance monitoring
• Stripe: Payment processing and billing services, including processing of the Measurement Fee and any associated rebate (see Section 8.5 of our Terms of Service). When you purchase a measurement report through the Platform, Stripe receives the payment data (card number, billing details) directly under its own privacy policy; we receive only a payment reference, the charge amount, and the charge status.
• Twilio: SMS delivery (sending the text messages you agreed to receive)
• HubSpot: Customer relationship management (contact records and communications)
• Measurement Report Provider: Aerial and photo-based measurement report generation. When you order a measurement report, we share your property address and contact information with our third-party measurement-report provider so they can generate and deliver the report. That provider's handling of your information is governed by its own privacy policy.
• Sentry: Error monitoring and session replay service for debugging technical issues; all form inputs are masked and no personally identifiable form data is captured or transmitted (see Section 5.4)
• Microsoft Clarity: Behavioral analytics and session-replay service used to understand how visitors navigate and interact with our platform (clicks, scrolling, page-to-page movement) so we can improve the user experience. Microsoft's handling of this data is governed by Microsoft's own privacy policy.
• Meta (Facebook and Instagram): Advertising measurement (the Meta Pixel in your browser and, when you purchase a measurement report, a purchase event sent from our servers that includes a hashed copy of your email address), and hosting the lead forms that appear in our ads (see Section 2.3)
• LinkedIn: Advertising measurement (the LinkedIn Insight Tag, which collects information about your visit to our site to help us measure ad performance), and hosting the lead forms that appear in our ads (see Section 2.3)
• Reddit Pixel: Advertising measurement

4.3 Legal Requests and Obligations

We may disclose your information if required by law or if we believe in good faith that such disclosure is necessary to comply with legal obligations, court orders, or governmental requests.

4.4 Business Transfers

If Otter Quotes is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice if this occurs.

4.5 No Sale of Personal Data

We do not sell your personal information to third parties for money. For information about sharing that may qualify as a 'sale' or 'share' under the CCPA and CPRA, and how to opt out, see Section 12.

We do not sell, rent, or share mobile phone numbers or text-message opt-in and consent information with third parties or affiliates for their marketing or promotional purposes. We share them only with service providers that help us deliver messages and run the platform (such as our SMS provider, Twilio), and, for contractors, we show the customer contact number you choose to homeowners you are matched with; for homeowners, we share your contact number with the contractor you select (see Section 4.1). Message frequency varies; message and data rates may apply.

4.6 Sharing with Your Consent

We may share your information with third parties when you consent to such sharing, such as through your account settings or explicit requests.

4.7 Sharing With the Person Who Referred You

If a real estate agent, insurance agent, home inspector, insurance adjuster, or other individual referred you to Otter Quotes — including a friend or family member who shared their referral link — we share limited progress information about your project with them as it moves forward: for example, that your claim has been submitted, that bids have come in, that you've selected a contractor, that your agreement has been signed, or that the job is complete. These updates identify you by first name and last initial only and never include your claim amount, your contractor's name, or details about your damage or scope of work. You can decline these updates by checking the opt-out option when you sign up, or at any time by contacting us at support@otterquote.com.

5. Cookies and Analytics

5.1 Cookies

We use cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small files stored on your device that help us remember your preferences, track your activity, and improve our services. Types of cookies we use include:

• Essential Cookies: Required for platform functionality and security
• Performance Cookies: Track usage and performance metrics
• Preference Cookies: Remember your settings and preferences
• Marketing Cookies: Track interactions for marketing purposes

5.2 Partner Referral Cookie

If you reach Otter Quotes through a partner's referral link, we set first-party cookies named oq_pc and oq-ref that record which partner's link you used, the time of that visit, and an internal reference number for that visit. We use them only to credit the partner who referred you and to provide the updates described in Section 4.7. They do not contain your name or contact details and are not used for advertising. They expire no later than 90 days after that visit, are replaced if you later follow a different partner's link, and are deleted once we have used them to credit that partner on your project. You can delete them at any time through your browser settings (see Section 5.6).

5.3 Google Analytics (GA4)

We use Google Analytics to understand how visitors use our platform. GA4 collects data such as page views, session duration, user demographics, and device information. This data helps us improve our services and understand user behavior patterns. GA4 may set cookies on your device and may combine data from multiple sources. For more information about how Google uses data, please visit the Google Analytics Support Center.

5.4 Error Monitoring and Session Replay (Sentry)

We use Sentry, provided by Functional Software, Inc. ("Sentry"), for error monitoring and debugging. When a technical error occurs during your session, Sentry may capture a replay of the page interactions that preceded that error to help our engineering team diagnose and resolve the issue. Session replays are triggered only when an error is detected — Sentry does not record normal browsing sessions. All form input fields (text boxes, password fields, and other data-entry elements) are masked before transmission and are never visible in the replay. No personally identifiable information entered into any form is captured or sent to Sentry. Error data, including any associated session replay, is retained for up to 90 days. For more information, see Sentry's Privacy Policy at https://sentry.io/privacy/.

5.5 Behavioral Analytics (Microsoft Clarity)

We use Microsoft Clarity to understand how visitors interact with our platform, including page navigation, scrolling behavior, and click patterns. Clarity may set cookies on your device and may record a replay of your on-page interactions to help us identify usability issues and improve the platform. This includes pages you view while signed in to your account, such as your dashboard and your bids. On those pages we set Clarity to mask the page content and everything you type, so the text on the page and anything you enter are not visible in any replay. Clarity does record the address of each page you visit; on some pages that address contains an internal reference number for your project, which does not by itself show your name or contact details. For more information, see Microsoft's Privacy Statement at https://privacy.microsoft.com/privacystatement.

5.6 Disabling Cookies

You can control cookie settings through your browser. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Disabling cookies may affect your ability to use certain features of our platform.

5.7 Do Not Track

Some browsers include a "Do Not Track" feature. Currently, there is no industry standard for recognizing DNT signals. If you enable DNT in your browser, our platform may not respond to these signals, but you can still manage cookies through your browser settings.

6. Data Security

6.1 Security Measures

We implement comprehensive security measures to protect your information:

• HTTPS Encryption: All data transmitted between your device and our servers is encrypted using HTTPS
• Encryption at Rest: Sensitive data is encrypted when stored in our databases
• Authentication: Multi-factor authentication and secure password policies
• Access Controls: Role-based access controls and least-privilege principles
• Regular Backups: Automated backups to ensure data availability and recovery
• Security Monitoring: Continuous monitoring for unauthorized access and suspicious activities
• Audit Logs: Detailed logging of all system access and data modifications

6.2 No Absolute Guarantee

While we strive to protect your information using industry-standard security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data. You acknowledge that you use our services at your own risk.

6.3 Breach Notification

If we discover a data breach that compromises your personal information, we will notify you as required by applicable law. Notifications will be sent via email or posted on our website, along with information about the breach and steps we are taking to address it.

7. Data Retention

7.1 Retention Policy

We retain your information for as long as necessary to provide services and fulfill the purposes outlined in this Privacy Policy. The following table outlines our retention periods for different types of information:

7.2 Deletion Upon Request

You may request deletion of your personal information at any time. Upon deletion, your data will be removed from our active systems within the timeframes specified above. Some data may be retained for legal, tax, or operational purposes.

7.3 Users Outside Our Current Service Area

If you create an account in a location where Otter Quotes is not yet available, your contact information and project details are retained to enable future service delivery and, if you opt in, to notify you when service becomes available in your area. This data is held under the same security and retention standards as all other user data. You may request deletion of your data at any time by emailing support@otterquote.com.

7.4 Data Residency

Your data is primarily stored in the United States. If you are located outside the United States, you acknowledge that your information will be transferred to and processed in the United States.

8. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will take steps to delete such information and terminate the child's account. If you believe we have collected information from a child under 18, please contact us immediately.

9. Your Privacy Rights

9.1 Right to Access

You have the right to request access to the personal information we hold about you. You can request a copy of your data by submitting a request through your account settings or by contacting us.

9.2 Right to Deletion

You have the right to request deletion of your personal information, subject to certain legal exceptions. We will delete your data within the timeframes specified by applicable law.

9.3 Right to Correction

You have the right to request correction or amendment of inaccurate information. You can update your information directly in your account settings or by contacting us.

9.4 Right to Opt-Out

You have the right to opt out of marketing communications, profiling, and certain types of data processing. You can manage these preferences in your account settings or by contacting us.

9.5 Right to Non-Discrimination

We will not discriminate against you for exercising your privacy rights. You will not face any adverse treatment or denial of services for exercising your rights.

9.6 Right to Appeal

If we deny your privacy request, you have the right to appeal our decision. Please contact us to initiate an appeal process.

9.7 CCPA/CPRA Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of your personal information.

10. Third-Party Services

10.1 Links to Third-Party Websites

Our platform may contain links to third-party websites and services. We are not responsible for the privacy practices of third-party websites. Please review the privacy policies of any third-party websites before providing your information.

10.2 Our Service Providers

We use the following third-party service providers:

Supabase (Database & Authentication)

• Hosts our database and provides authentication services
• Processes user credentials and account information
• Privacy Policy: https://supabase.com/privacy

Netlify (Web Hosting)

• Hosts our website and application
• Processes server logs and performance data
• Privacy Policy: https://www.netlify.com/privacy/

Google Analytics (GA4) (Analytics)

• Collects usage data and user behavior analytics
• Tracks page views, sessions, and user interactions
• Privacy Policy: https://policies.google.com/privacy

Stripe (Payment Processing)

• Processes payments and manages billing
• We do not store full credit card numbers
• Privacy Policy: https://stripe.com/privacy

Twilio (SMS Delivery)

• Delivers the text messages you agreed to receive
• Processes mobile phone numbers and message content in order to deliver messages
• Privacy Policy: https://www.twilio.com/en-us/legal/privacy

HubSpot (Customer Relationship Management)

• Stores contact records and communications so we can manage and respond to customer and contractor relationships
• Privacy Policy: https://legal.hubspot.com/privacy-policy

Google Identity Services (OAuth Sign-In)

• Provides Sign-in-with-Google authentication for users who select this option
• Provides us with your email, name, and Google account ID; we do not receive your Google password
• Privacy Policy: https://policies.google.com/privacy

Sentry (Error Monitoring & Session Replay)

• Captures a replay of page interactions when a technical error occurs, to help diagnose and fix the issue
• All form inputs are masked; no personally identifiable information entered in forms is captured or transmitted
• Session replays are triggered by errors only — normal browsing sessions are not recorded
• Privacy Policy: https://sentry.io/privacy/

Microsoft Clarity (Behavioral Analytics)

• Collects session-replay and interaction data (clicks, scrolling, page-to-page navigation) to help us understand and improve the user experience
• Privacy Policy: https://privacy.microsoft.com/privacystatement

10.3 Data Processing Agreements

We have Data Processing Agreements (DPAs) in place with our service providers to ensure they process your information in compliance with applicable privacy laws.

11. International Data Transfers

Otter Quotes is based in the United States (Indiana). Your personal information is processed and stored in the United States. If you are located outside the United States, your information will be transferred to the United States and processed according to this Privacy Policy and applicable U.S. laws. By using our services, you consent to the transfer and processing of your information in the United States.

For users in the European Union, we acknowledge that the transfer of personal information from the EU to the United States may be subject to GDPR requirements. We implement appropriate safeguards to protect your information during international transfers.

12. California Privacy Rights (CPRA/CCPA)

If you are a California resident, you have additional privacy rights under the California Consumer Privacy Rights Act (CPRA) and the California Consumer Privacy Act (CCPA):

• Right to Know: You can request what personal information we collect, use, and share
• Right to Delete: You can request deletion of personal information we have collected from you
• Right to Correct: You can request correction of inaccurate personal information
• Right to Opt-Out: You can opt out of the sale or sharing of your personal information. To exercise your right to Do Not Sell or Share My Personal Information, contact us at support@otterquote.com.
• Right to Limit Use: You can limit our use of sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights
• Authorized Agent: You can designate an authorized agent to make requests on your behalf

To submit a CCPA/CPRA request, please contact us at support@otterquote.com. We will verify your identity and respond to your request within 45 days.

We treat a Global Privacy Control (GPC) signal sent by your browser as a request to opt out of the sale or sharing of your personal information for advertising purposes.

Opt out of sale/sharing

13. Indiana-Specific Privacy Rights

Otter Quotes is based in Indiana. If you are an Indiana resident, you may have rights under the Indiana Consumer Data Protection Act or other applicable Indiana privacy laws. We are committed to complying with all applicable Indiana privacy regulations and will notify you of any additional rights afforded to Indiana residents.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by posting the updated policy on our website and updating the "Effective Date" at the top of this policy. Your continued use of our services after changes have been posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

15. Contact Us

If you have questions about this Privacy Policy, requests regarding your personal information, or concerns about our privacy practices, please contact us:

For California residents submitting CCPA requests, we will respond within 45 days as required by law. For other privacy requests, we aim to respond within 30 business days.

16. Summary of Privacy Practices

What We Collect

We collect information you provide directly (name, email, property details, insurance documents), information collected automatically (usage data, device information, IP address), and information from third-party service providers.

Who We Share With

We share information with contractors (when you request matching), the person who referred you to us if applicable (limited progress updates only — see Section 4.7), service providers, including advertising and analytics partners (see Section 4.2), and as required by law. We do not sell your personal information to third parties. See Section 12 for your right to opt out of the sharing of your information for advertising purposes.

Your Rights

You have the right to access, correct, or delete your personal information. Indiana residents have additional rights under state law, including the right to know what data we hold about you. Contact us at support@otterquote.com to exercise these rights.

How We Protect Your Data

We use industry-standard encryption (TLS in transit, AES-256 at rest), role-based access controls, row-level security in our database, and regular security audits. We store only the minimum data necessary to provide our services.

Your Choices

You can update or delete your account at any time by contacting us. You can opt out of non-essential communications at any time. We will always send service-related notifications (such as magic link authentication emails) regardless of communication preferences.