Privacy Policy — Credit Intelligent Platform

Effective date: July 21, 2026
Publisher: Otic Group
Product ID: 604962fb-479d-4dd0-aabb-3c6c9e5d7f1b

Overview

Credit Intelligent Platform (“CIP”, “the service”) is published by Otic Group and offered through the Microsoft Marketplace. This Privacy Policy explains what data we collect, how we use it, how we protect it, and what rights customers and end users have.

Data we process

Customer data

Customer data is information that users upload, enter, or generate while using CIP. This may include:

Borrower and guarantor business information
Loan application details and supporting documents
Financial statements and transaction records
Credit memo content and reviewer comments
Audit logs and decision records

Customer data belongs to the subscribing organization. Otic Group processes customer data only to provide and support the service.

Account and billing data

When a customer subscribes through the Microsoft Marketplace, Microsoft shares the following with Otic Group:

Marketplace subscription identifier
Tenant identifier and administrator contact
Plan and quantity information
Billing events required for metered add-ons

Service-generated diagnostic data

CIP collects diagnostic and telemetry data needed to operate the service, including:

Error logs and performance metrics
Feature usage statistics at an aggregated level
Authentication events (who signed in, when, and from which tenant)

Personal identifiers are redacted from telemetry wherever possible. See our Security Architecture documentation for details on redaction and sanitization.

How we use data

To deliver the CIP service and maintain its availability, security, and performance.
To authenticate users and enforce role-based access controls.
To process marketplace subscriptions, plan changes, and usage-based billing.
To provide customer support and respond to security incidents.
To improve the service through aggregated analytics.

We do not sell customer data or use it to train third-party AI models.

Data storage and location

Customer data is stored in the customer’s chosen Azure region or, for managed deployments, in the region selected during onboarding. Backups are encrypted and retained according to the subscription plan.

Data sharing

Otic Group shares data only:

With Microsoft as required to operate the Marketplace SaaS offer (subscription IDs, tenant IDs, billing events).
With authorized subprocessors bound by confidentiality and security obligations (e.g., cloud hosting providers).
When required by applicable law or a valid legal request.

Security

CIP uses industry-standard controls including encryption in transit and at rest, Microsoft Entra ID authentication, role-based access control, audit logging, webhook signature validation, and exception sanitization. For more detail, see the CIP Security Architecture documentation.

Customer responsibilities

Customers are responsible for:

Controlling user access and promptly removing users who no longer need access.
Complying with applicable laws when uploading borrower and financial data.
Obtaining any required consents from data subjects.
Classifying and managing their own data within CIP.

User rights

End users may contact their organization’s CIP administrator to:

Access or correct their personal information
Request deletion of their account data
Export their data where supported by the feature set

Administrators may contact cip-privacy@oticgroup.com for data-subject requests that require publisher assistance.

Retention and deletion

Customer data is retained for the duration of the active subscription plus a configurable grace period (default 90 days) to support restoration. After the grace period, data is securely deleted. Diagnostic logs may be retained longer in aggregated or pseudonymized form.

Changes to this policy

Otic Group will update this policy as needed. Material changes will be communicated to customers at least 30 days before taking effect.

Contact

For privacy questions, contact cip-privacy@oticgroup.com.