Privacy policy.

Last updated: 22 October 2026

The short version

The rest of this page is the full policy. If the summary and the full text ever disagree, the full text applies.

Who we are

Qotler is an AI marketing team for founders: expert agents for SEO, AI visibility, LinkedIn, Reddit and X that learn your company, suggest work with evidence, and prepare it for your approval.

Qotler is operated by its founders ("Qotler", "we", "us"). Company registration is in progress; this policy will name the registered company once it exists. For the personal data described in this policy, we are the data controller (under the GDPR and UK GDPR) and the data fiduciary (under India's Digital Personal Data Protection Act, 2023).

Questions about this policy or your data go to privacy@qotler.com. That inbox also serves as our grievance contact for users in India.

What this policy covers

This policy applies to:

• Our website at qotler.com, including this marketing site.
• The launch list: the "Notify me" form that counts down to launch.
• The Qotler app: your account, workspace, Mind, experts, integrations and everything they produce.
• Support: emails and messages you send us.

It doesn't cover third-party sites or services you reach from Qotler, such as Google, GitHub or WordPress. Their own privacy policies apply to what they do with your data.

Data we collect

Account information

When you create an account, we collect your email address, your name if you give it, your company name and website, your time zone (so scheduled work runs at your local time), and your subscription status. Sign-in is handled by Supabase on our behalf; we never see or store your password in plain text.

Your website content

When you enter your website, Qotler reads its public pages: text, headings, links, metadata, structured data and page performance. It never reads pages behind a login or paywall. We also fetch your site's icon through Google's favicon service to show your logo in the app. When a suggestion changes a page, we save a before-snapshot of that page so results can be measured fairly.

Mind documents and uploads

Mind is your company's living set of documents: product information, marketing strategy, competitor analysis, brand and design guide, content strategy and calendar, plus any custom documents you add. We store every document and its revisions so you can restore an earlier version. Files you upload are stored in a private storage bucket. Please don't upload personal data about other people unless you need to and are allowed to share it.

Google Search Console and Google Analytics 4

If you connect Google, we request read-only access to Search Console and Google Analytics 4. For the property you select, we read performance data such as clicks, impressions, queries, pages, indexing status, sessions and conversions. We store the OAuth refresh token encrypted at the column level and the numbers we need to compare results before and after a change. See Google user data for the rules we follow.

Other connected services

If you connect GitHub or WordPress, we store the connection details and the minimum information needed to prepare changes for your approval, such as repository and branch names, pull request links and post drafts. Coding can open pull requests; it can't merge them.

Your work in Qotler

We store the suggestions experts make, the evidence behind them, your decisions (approve, edit, dismiss), the drafts and pull requests that result, and the measured results. This history is what lets each round build on the last.

Usage data and cookies

Like most web services, we log technical data: IP address, browser and device type, pages viewed, actions taken, timestamps and error reports. We use Google Analytics on our website and app to understand how they're used. See Cookies.

Launch-list emails

If you join the launch list, we store your email address, the page you signed up from and the time you signed up. That's all.

Support and contact messages

If you email us or use the contact form, we keep your message, your contact details and our reply, so we can help you and follow up.

How we use it

• To provide Qotler: build and update your Mind, run the experts you switch on, prepare drafts and pull requests, and check whether approved work went live and what it changed.
• To run schedules: run each expert's weekly work and daily result checks at your local time, once you turn them on.
• To keep Qotler safe: verify sign-ins, prevent abuse, enforce rate limits and the daily AI spend cap, and investigate security incidents.
• To support you: answer questions and fix problems you report.
• To improve the product: understand which features are used and where things break, using usage data and aggregated, de-identified statistics.
• To communicate: send service emails (security notices, billing, important changes) and, for the launch list, one email when Qotler goes live.
• To meet legal duties: keep records we're required to keep and respond to lawful requests.

We don't sell personal data, we don't share it for cross-context advertising, and we don't use your workspace content or Google data to target ads.

AI processing

Qotler's experts run on large language models from Anthropic, OpenAI and xAI. Which model handles which task is configurable. To do a task, we send the provider the context that task needs: for example, the relevant parts of your Mind, the text of a page being reviewed, or a summary of your Search Console numbers.

• No training by Qotler. We don't train our own models on your data.
• Business API terms. We use providers' business APIs. Their terms say API inputs and outputs aren't used to train their models by default. Providers may keep API data for a limited time for abuse and safety monitoring, under their own terms.
• No automated decisions about you. AI output in Qotler is a suggestion or a draft. Nothing is published, merged or posted without your approval, and nothing Qotler does produces legal or similarly significant effects for you.

Legal bases

Where the GDPR or UK GDPR applies, we rely on these legal bases:

Under India's DPDP Act, we process your personal data on the basis of your consent, given when you sign up, connect a service or join the launch list, and for the legitimate uses the Act allows. You can withdraw consent at any time; doing so may mean we can't provide parts of the service.

Sharing and sub-processors

We share personal data only with service providers that help us run Qotler, under contracts that limit what they can do with it; with your connected services when you ask us to; and with authorities when the law requires it. If Qotler is ever part of a merger or acquisition, we'll tell you before your data moves under a different privacy policy.

We also use Redis internally for job queues and rate limiting; it holds short-lived job information. We'll update this list before adding a new sub-processor that handles personal data. For changes that affect you, we'll notify account owners by email.

International transfers

Our application runs in India (AWS, Mumbai), and some providers above process data in the United States and other countries. When personal data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data processing terms. Transfers out of India follow the DPDP Act and any restrictions the Indian government sets under it.

Retention

We keep personal data only as long as we need it for the purposes above.

Security

We protect your data with TLS everywhere (with HSTS), column-level encryption for Google tokens, row-level security on customer tables, workspace checks in the API, a sign-in token verified on every request, and a website reader that refuses private network addresses. No system is perfectly secure, so we also plan for incidents: if a breach affects your personal data, we'll tell you and the relevant authorities as the law requires. The full detail is on our Security & data page.

Your rights

Depending on where you live, you can ask us to:

• Access the personal data we hold about you, and how we use it.
• Correct data that's wrong or incomplete. You can edit most of it, including everything in Mind, directly in the app.
• Delete your data, or your whole account.
• Export your data in a portable format.
• Object to, or ask us to restrict, processing based on legitimate interest.
• Withdraw consent where we rely on it, such as the launch list or a Google connection.

How to ask: email privacy@qotler.com from the address on your account. We may need to confirm it's you before acting. We'll respond within one month, or sooner where your local law requires.

EU, EEA and UK: you have the rights above under the GDPR and UK GDPR, and you can complain to your local data protection authority. We'd appreciate the chance to fix it first.

India: under the DPDP Act, you can access a summary of your data and how it's processed, ask for correction, completion or erasure, nominate someone to exercise your rights if you die or become incapacitated, and raise a grievance with us at privacy@qotler.com. If we don't resolve it, you can approach the Data Protection Board of India.

United States and elsewhere: depending on your state or country, you may have similar rights to know, access, correct and delete your data, and to not be discriminated against for using them. We don't sell personal data or share it for cross-context behavioural advertising. Email us and we'll honour the rights your law gives you.

Google API Services user data

Qotler's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• What we access: read-only Search Console and Google Analytics 4 data for the properties you choose. We can't change your Google settings, users or verification.
• What we use it for: only to provide and improve the user-facing features you see in Qotler: finding opportunities, writing evidence into suggestions, and measuring results before and after a change.
• No transfers to others except as needed to provide those features (for example, sending a summary of your numbers to an AI provider to draft a suggestion for you), to comply with law, or as part of a merger or acquisition with notice to you.
• No advertising. We don't use Google user data for ads, retargeting or personalised advertising, and we don't sell it.
• No human reading of your Google data unless you give us permission (for example, in a support request), it's needed for security or to comply with law, or the data is aggregated and anonymised for internal operations.
• No model training. We don't use Google user data to develop, improve or train generalised AI or machine-learning models.

You can revoke access at any time, from Qotler or from your Google Account's third-party connections page. When you disconnect, we delete the stored token and the Google data we hold for that connection.

Cookies

We use a small number of cookies and similar browser storage:

• Essential: keep you signed in to the app and protect forms from abuse. The app doesn't work without them.
• Preferences: remember small choices on your device, such as having joined the launch list, so we don't ask again.
• Analytics: Google Analytics cookies on our website and app, which tell us how pages are used.

We don't use advertising cookies. Where the law requires consent for analytics cookies, we'll ask before setting them. You can also block or delete cookies in your browser settings.

Children

Qotler is a business tool for founders and teams. It isn't meant for anyone under 18, and we don't knowingly collect personal data from children. If you think a child has given us personal data, email privacy@qotler.com and we'll delete it.

Changes to this policy

We'll update this policy when our product or the law changes. We'll change the "Last updated" date at the top, and for material changes we'll email account owners and show a notice in the app before the change takes effect.

Contact

Privacy questions and requests: privacy@qotler.com
Security reports: security@qotler.com
Everything else: hello@qotler.com

Qotler

See also our Terms of service and Security & data page.