How Otter handles your information.

Who is responsible

RAT SYSTEMS operates Otter and is responsible for the personal information described here. Otter is independent of water companies, regulators and emergency services.

Privacy questions and rights requests: otter@ratsystems.uk

Postcode lookups

A full postcode is sent to postcodes.io to obtain a coordinate. In areas where an official restriction varies by address, the postcode may also be sent to the relevant water company's public postcode checker. Otter uses the result to return a supply area, current official status and any local forecast available there.

Ordinary postcode lookups are not added to Otter's subscriber database. Hosting and upstream providers may process IP addresses, browser details and request timestamps in security and operational logs. We use those logs only to operate, protect and diagnose the service.

Accounts and sign-in

Supabase provides account authentication using a password or a secure one-time email link. It processes the account email, password verifier, a stable account identifier, sign-in and recovery events, and strictly necessary session cookies. Otter never receives or stores the readable password. Otter uses the verified account identifier—not an email value supplied by a browser—to decide who may view or change saved locations and billing.

Subscriptions and service emails

When subscriptions are enabled, Otter stores the account email, saved postcode or location, requested cadence, verification and unsubscribe records, delivery status, and the minimum alert history needed to prevent duplicate messages. Unverified requests are erased after 30 days. Suppression records may be retained so that a person who opted out is not contacted again accidentally.

Service emails are sent through the operator's iCloud Mail custom domain using Apple's authenticated mail service. Apple therefore processes the sender and recipient addresses and message delivery data. Forecast and restriction emails are requested service messages; any optional marketing choice is kept separate.

Payments

Stripe handles Checkout, recurring payments, invoices and the customer billing portal. Otter stores Stripe customer and subscription references, plan and payment status, and billing-event history needed to provide paid access. Card details are submitted directly to Stripe and are not stored by Otter.

Why information is used

Postcode, account and delivery data is processed to provide the lookup or subscription requested, perform the customer contract, keep the service secure, diagnose failures and preserve a record of which official restriction information was shown. Payment and tax records may also be kept to meet legal obligations. Consent for optional marketing is not treated as a condition of the service.

Retention, sharing and rights

Operational logs are kept only for the hosting and security periods needed to run the service. Accepted restriction and model audit records contain source facts rather than household information. Personal information is shared only with the hosting, Supabase authentication, Apple email, Stripe payment and lookup providers needed to perform the service, or where legally required. Otter does not sell personal information.

You may ask for access, correction, deletion, restriction or a copy of personal information held about you, and may object to or withdraw consent for applicable processing. You may also complain to the UK Information Commissioner's Office.

Cookies and analytics

Otter offers optional, anonymous product analytics through PostHog's EU service. If you choose “Allow analytics”, Otter records page views and a small number of feature actions, such as starting a postcode check or requesting a sign-in link. It does not send the postcode, email address, typed form contents or session recordings to PostHog, and it does not create an identified PostHog profile.

PostHog analytics remain off unless you consent. Your choice is kept in browser storage and can be changed using “Analytics preferences” in the footer. Declining analytics does not affect the service. Otter does not use advertising trackers. Supabase and the hosting service may still use strictly necessary security and session cookies.