What we hold.

Ottoin is a record of what cars cost to own, built from bills owners send us. We keep the figures. We do not keep the things that identify your car to a stranger — no registration number, no chassis number, no phone number, no address, and never a precise location.

Your bill images are private. They are never shown to another user. We may read one automatically so you do not have to type the figures — that reading is a draft only you see, and nothing becomes public until you confirm it and a person here has reviewed it.

To sign you in

• ·Your email address, so we can send a sign-in link and reach you about your own data.
• ·If you sign in with Google, the tokens Google gives us for that purpose.
• ·A session token in a cookie, so you stay signed in.

When you add a car

• ·The car: make, model, variant, year, and the odometer reading you give us.
• ·Its city — the city only, never a street, pin code or precise location.
• ·An optional nickname and description, which you write and which are public.
• ·How the car is used (daily, weekend, commercial), if you tell us.

When you log a service

• ·The date, the odometer reading, what you paid, and whether it was an authorised or independent workshop.
• ·The workshop's city, if you give it.
• ·The line items from the bill, where you enter them.
• ·The bill image itself, if you attach one — see below.

When you check a quote

• ·The car, the interval, the city and the amount you were quoted, so we can answer and so we know which cars to go and find owners for.
• ·You do not need an account to do this.

How we measure the site

• ·A random identifier stored in your browser, the page you came from, and any campaign tags in the link you followed.
• ·Which pages you opened and which actions you took — not what you typed.

• ·Registration (number plate) numbers.
• ·Chassis or VIN numbers.
• ·Phone numbers.
• ·Postal addresses or pin codes.
• ·Precise location. City is the most specific thing we hold about where you or your car are.

If a bill you send us shows any of these, we do not enter them. They may remain visible inside the image itself, which is why the image stays private.

A bill image goes to a private store. It is reachable only through a link that works for two minutes, and only for the account that owns the car or an administrator reviewing it. It is never rendered to another user and never included in anything public.

We may read it automatically. When you upload a bill we use automated document reading to pull out the figures, so you do not have to type them. That reading is a draft: it is shown only to you, you correct anything it got wrong, and it is what you confirm — not what the machine produced — that is ever recorded as yours.

Nothing read from your bill reaches Ottoin’s public figures until two things have happened: you have confirmed the record, and a person here has reviewed it. A machine never publishes a number on this site.

Doing that reading means sending the document to a specialist service we use for the purpose. It receives the invoice as it is, because there is no way to read a bill without reading it. It is used for nothing else, and the registration number and VIN are discarded from the result before anything is stored.

If automated reading is unavailable or cannot make sense of your invoice, you enter the four figures yourself and get exactly the same comparison. Nothing is invented to fill a gap.

How long we keep it. If you have an account and save the bill to your car, the image stays in the private store and you can delete it at any time — it is then gone. If you send a bill with no account, we keep the document only as long as it takes to read it and for a person to review it, and then destroy it: there is no account for you to delete it from, so we do not hold it. The figures survive; the document does not.

We keep a fingerprint of every document — a one-way hash, not the file — after the file itself is gone. It is how we notice the same invoice arriving twice, and it cannot be turned back into your bill.

Photos you add to your car page are public — that is their purpose. A phone writes the location where a photo was taken into the file itself, so we strip that out on our servers before storing it. A photo taken on your driveway does not publish where your driveway is.

We do not detect or read number plates — not to blur them, and not for anything else. Before a photo is uploaded you are shown it and can drag a box over the plate; that part of the picture is scrambled on your own device, so what reaches us has never contained it. Using the tool is up to you: if a plate is visible in a photo you publish, it is visible because you left it there. You can delete a photo at any time.

Car pages are public and indexable: the car, its city, its odometer, and the service costs logged against it. Your bills contribute to medians shown to other owners, which is the point of the site.

You are named on your car page by the display name you choose. If you have not chosen one, the page says the city instead — it never invents a name from your email address.

Figures on Ottoin are owner-reported. We do not check them against a workshop and we never describe them as verified.

• ·Our database and file storage provider, which hosts the data on our behalf.
• ·Our email provider, which sends your sign-in link.
• ·Our product analytics provider, if analytics is enabled — it receives the events described above, never your bill images and never your bill figures.
• ·Google, only if you choose to sign in with Google.

We do not sell your data. We do not give a workshop, dealer or manufacturer access to who you are or what you individually paid. Anything we ever share with them is an aggregate across many owners.

Bills stay on your car page for as long as your account exists. Only bills from the last three years enter the medians other people see, because service prices move — older ones remain visible as dated entries. We do not store bills from before 1 July 2017.

Most of the bills on Ottoin so far were typed in by us, from invoices owners sent us directly while we were building the record. For those cars we hold the car, its city, the odometer and the figures on the bill — and no name, no email, no phone number and no way to contact the owner. There is no account, because nobody created one.

If one of those bills is yours and you would like it removed, write to privacy@ottoin.com and tell us which car and which service. We will take it out, and the medians it fed will drop by its share.

Under India’s Digital Personal Data Protection Act you can ask us what we hold about you, ask us to correct it, ask us to delete it, and complain if we get it wrong.

You can delete individual bill images, photos, and entries yourself from your car page. To delete your whole account, go to your account. It asks you to type DELETE, and then it happens immediately — there is no queue and no one to email.

That removes your account, your name, your handle, every photo, and every bill image — the image files themselves, not just our record of them. A car you added with no bills on it goes too. None of that is recoverable, by you or by us.

The service figures you reported stay, and stop being yours. A car carrying bills keeps its page and keeps counting toward the medians, with the owner removed — no name, no handle, no nickname, no description, no photographs, and a web address rebuilt from the make and model so nothing you wrote survives in it. It reads as Anonymous, the same as every bill somebody sent us without an account.

We are telling you this plainly because it is a real limit on deletion: what you can remove is the link between you and those figures, not the figures. They were only ever useful as part of a count — forty owners’ bills, not yours — and a median that shrank every time somebody closed an account would be a worse answer for every owner who stayed. If you would rather a particular bill were gone entirely, delete it from your car page before you delete your account, or write to privacy@ottoin.com.

Two other things survive, and neither can be traced back to you. We keep anonymous counts of page views and quote checks with every identifier removed, because deleting them would falsify our own historical numbers — a visit that happened, happened. And if another owner followed one of your cars, our record of their action is theirs, not yours.

For anything else the Act gives you — asking what we hold, or asking us to correct it — write to privacy@ottoin.com.

If we change what we collect we will change this page and date it. If the change is significant we will tell account holders by email rather than quietly editing.

See also our terms.