Privacy Policy

Otanes, Inc. (“Otanes”, “we”, “us”, or “our”) operates a multi-tenant education infrastructure platform that enables organizations to build, manage, and scale branded academies. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services.

1. Information We Collect

Account Information

When you create an account as an academy owner or learner, we collect your name, email address, and organization details. Authentication is handled through magic links (passwordless email authentication) or Single Sign-On (SSO) via your organization's identity provider.

Academy Owner Data

If you create or manage an academy, we collect your organization name, custom domain configuration, branding assets, course content, and billing information. This data is necessary to provision and operate your academy infrastructure.

Learner Data

When learners enroll in courses through an academy, we collect enrollment data, course progress, completion status, and assessment results. This data is processed on behalf of the academy owner and is accessible to them through the Otanes dashboard.

Payment Information

We process payments through Stripe (for global transactions) and Zarinpal (for regional transactions). We do not store full payment card details on our servers. Payment processors handle card information in accordance with PCI DSS standards. We retain transaction records, billing history, and subscription status.

Usage and Analytics Data

We collect platform usage data including page views, feature interactions, API calls, learner engagement metrics, completion rates, and performance data. This information helps us improve the platform and enables academy owners to understand learner behavior.

Technical Data

We automatically collect device information, browser type, IP address, operating system, and general location data. We use cookies and similar technologies for session management, authentication, and analytics.

2. How We Use Your Information

We use collected information to:

• Provision and operate academy infrastructure
• Authenticate users via magic links or SSO
• Process payments and manage subscriptions
• Track learner progress and generate completion certificates
• Provide analytics dashboards to academy owners
• Send transactional communications (enrollment confirmations, progress notifications)
• Improve platform reliability, performance, and features
• Enforce our Terms of Service and prevent abuse
• Comply with legal obligations

3. Data in a Multi-Tenant Environment

Otanes operates a multi-tenant platform where each academy is logically isolated. Academy owners can only access data related to their own academy and learners. Learner data collected within one academy is not shared with other academy owners. We maintain strict data isolation between tenants at the application and database level.

4. Data Processing Roles

When academy owners use Otanes to collect and process learner data, Otanes acts as a data processor on behalf of the academy owner (the data controller). Academy owners are responsible for ensuring they have appropriate legal bases for collecting learner data. When you interact directly with otanes.ai (our marketing website), Otanes acts as the data controller.

5. Data Sharing and Disclosure

We share data only in the following circumstances:

• With academy owners: Learner data within their academy is accessible to the academy owner
• Payment processors: Stripe and Zarinpal process payment information on our behalf
• Infrastructure providers: We use third-party hosting and cloud services to operate the platform
• Analytics services: We use privacy-respecting analytics tools to understand platform usage
• Legal requirements: When required by law, regulation, or valid legal process
• Business transfers: In connection with a merger, acquisition, or sale of assets

We do not sell personal information to third parties. We do not use learner data for advertising purposes.

6. Security

We implement industry-standard security measures including encryption in transit (TLS 1.3), encryption at rest for stored data, regular security audits, access controls based on the principle of least privilege, and secure authentication mechanisms. SSO integrations support SAML and signed token authentication with JIT user provisioning. While no system is completely secure, we take reasonable measures to protect your data against unauthorized access, alteration, or destruction.

7. Data Retention

We retain account and academy data for the duration of your subscription plus 30 days after account closure. Learner progress data is retained for the duration of the academy's active subscription. Payment records are retained as required by applicable financial regulations. You may request deletion of your data at any time by contacting us at privacy@otanes.ai.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent where processing is based on consent

If you are a learner and wish to exercise these rights regarding data held within an academy, please contact the academy owner directly. If you need assistance, contact us at privacy@otanes.ai.

9. Cookies and Tracking

We use essential cookies for authentication and session management. We use analytics cookies to understand how the platform is used and to improve performance. We do not use advertising or cross-site tracking cookies. Academy owners may configure their own analytics within their academies, subject to their own privacy policies.

10. International Data Transfers

Otanes operates globally. Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where required.

11. Children's Privacy

Otanes is not directed to children under 16. We do not knowingly collect personal information from children under 16. If an academy owner uses Otanes to provide education to minors, the academy owner is responsible for obtaining appropriate parental consent and complying with applicable laws.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. Your continued use of Otanes after changes take effect constitutes acceptance of the revised policy.

13. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at: