Privacy Policy

1. Who we are

This website and the services offered on it are operated by OTRO INNOVATIONS LLC, a limited liability company organised in the United States, with delivery teams working from Bangladesh and China. In this policy, “we”, “us” and “OTRO Digital” refer to that entity. For privacy questions, write to grow@otro.bd.

We act as the controller of data collected through this website and as a processor or business partner for data we handle inside a client's advertising accounts. Where we act as a processor, the client's own privacy notice governs their customers and we follow their written instructions.

2. Scope

This policy applies to this website, our contact and enquiry forms, managed service engagements, and the self-serve panel. It does not apply to third-party platforms such as Meta, Google, TikTok, YouTube, X, Telegram or Spotify, which publish their own privacy terms and act as independent controllers of the data they collect.

3. Information we collect

Provided directly by you

• Contact details: name, email address, phone or messaging handle, company name.
• Enquiry content: the service you are interested in, your message, and any brief or files you attach.
• Commercial information: billing name, billing country, tax identifiers where required, and payment references.
• Engagement records: scopes, approvals, reports and correspondence relating to your account.

Panel order data

• The public URL or username you submit for an order, and the quantity and service selected.
• Order history, remaining balance and support tickets.
• We do not collect account passwords, two-factor codes, session cookies or private profile data. Panel ordering never requires access to the account being boosted.

Collected automatically

• Technical data such as IP address, browser and device type, operating system and referring page.
• Usage data such as pages viewed, time on page and the links you click.
• Cookie and analytics identifiers described in section 6.

4. Why we use it

• To answer enquiries and prepare quotes, scopes and audits.
• To deliver managed services: build campaigns, produce creative, verify tracking and report results.
• To process panel orders, credit balances, handle refill requests and resolve disputes.
• To invoice, collect payment, keep accounting records and meet tax obligations.
• To maintain security: detect fraud, card testing, abusive automation and unauthorised access.
• To improve the site and our services through aggregated usage analysis.
• To send service messages (delivery notices, policy changes) and, where you have opted in, occasional updates.

We do not sell personal data, and we do not share client contact lists with third parties for their own marketing.

5. Legal bases

Where data-protection law requires a legal basis, we rely on: performance of a contract (delivering the service you ordered), legitimate interests (running and securing our business, improving our services), consent (optional marketing and non-essential cookies, which you may withdraw at any time), and legal obligation (accounting, tax and lawful requests from authorities).

6. Cookies and analytics

This site uses a small number of cookies and similar storage technologies. Essential cookies keep forms and sessions working. Analytics cookies, where enabled, help us understand which pages are useful; they record aggregated behaviour rather than content of submissions.

• We do not use cookies to build advertising profiles of visitors to this website.
• Advertising and measurement inside client accounts is governed by the client's own cookie notice, because those cookies are set on the client's domain.
• You can block or delete cookies in your browser settings. Blocking essential cookies may stop forms from submitting correctly.
• Where required, non-essential cookies are only set after you consent, and consent can be withdrawn by clearing site data.

7. Third-party platforms

Managed services operate through Meta (Facebook and Instagram), Google, TikTok and, where relevant, other advertising or analytics platforms. Those platforms process data under their own terms. When you engage us, you authorise us to access your advertising accounts through partner or manager accounts for the duration of the engagement, and you can revoke that access at any time.

Panel orders involve no platform account access. We submit the public URL you provide to the service provider fulfilling the order. Do not submit links to content you do not have the right to promote.

8. Sharing and processors

We share data only where necessary to deliver the service, and only with parties bound to confidentiality. Categories of recipients include:

• Hosting and infrastructure providers that serve this website.
• Payment processors (card and wallet providers) that handle billing; we do not store full card numbers.
• Email and support tooling used to answer enquiries and send reports.
• Analytics providers, configured to limit personal data where possible.
• Panel fulfilment providers, who receive only the public link and order quantity.
• Professional advisers, auditors or authorities where legally required.

If our business is reorganised, merged or sold, data may transfer to a successor entity under the same commitments described here.

9. International transfers

We operate between the United States, Bangladesh and China, and use service providers in other countries. Your data may therefore be processed outside your country of residence. Where transfers require safeguards, we rely on contractual protections with processors and limit transfers to what the service needs.

10. Retention

• Enquiries that do not become engagements: up to 24 months, then deleted or anonymised.
• Client contracts, invoices and financial records: as long as required by accounting and tax law.
• Panel order records and support tickets: up to 24 months, kept for refill verification and dispute resolution.
• Analytics data: retained in aggregated form; identifiable identifiers are kept no longer than necessary.

11. Security

Access to client data is limited to team members who need it to deliver the engagement. We use authenticated access, least-privilege account permissions and encrypted transport. No system is perfectly secure; if a breach affects your data, we will notify you and any relevant authority as required by applicable law.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or restrict the use of your personal data, to object to certain processing, to withdraw consent, and to receive a portable copy of data you provided. Bangladeshi law and, where applicable, the GDPR and UK GDPR provide comparable protections. To exercise a right, email grow@otro.bd. We respond within 30 days and may ask for verification before acting.

You also have the right to complain to your local data-protection authority. We would appreciate the chance to resolve the issue first.

13. Children

Our services are intended for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted data, contact us and we will remove it.

14. Changes

We may update this policy as our services or the law change. The revision date at the top always reflects the current version. Material changes affecting active clients are communicated by email.

15. Contact

Privacy questions and requests: grow@otro.bd. Postal and registered-office details are available on request and appear on invoices issued by OTRO INNOVATIONS LLC.