Privacy Policy
Effective date: October 12, 2026
Last updated: October 12, 2026
Narona LLC, doing business as Autonomous Studios ("Autonomous Studios," "we," "us," or "our"), provides OTTO, an autonomous studio system that combines studio hardware, software, artificial-intelligence (AI) vision, and cloud and remote-control tools to record and produce video with a small or remote crew. This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights available to you.
This Policy covers personal information processed through our website at www.autonomous-studios.com, our sales and support channels, and — as described in Section 2 — the OTTO platform. It does not cover the independent privacy practices of our enterprise customers, who control most recordings made with OTTO in their own studios.
1. Who we are and how to contact us
The data controller for personal information described in this Policy is Narona LLC, located at 412 E Santa Clara Street, Hebbronville, Texas 78361. References to "Autonomous Studios" in this Policy are to Narona LLC, doing business as Autonomous Studios, and, where applicable, its affiliates that provide the services in your region.
You can reach our privacy team by email at info@naronafilms.com, through the contact form at www.autonomous-studios.com, or by post at Narona LLC, Attn: Privacy Team, 412 E Santa Clara Street, Hebbronville, Texas 78361. Please mark privacy correspondence "Attn: Privacy Team" and, for email, include "Privacy" in the subject line.
2. Scope: when we act as controller and when we act as processor
We act as a controller (or "business" under U.S. state privacy laws) for information about website visitors, prospective and current customer personnel, event contacts, and support users — for example, account, contact, billing, and website usage information.
We act as a processor (or "service provider" / "contractor") for Customer Content processed on behalf of an enterprise customer. "Customer Content" means video, audio, images, transcripts, and related production data that a customer and its authorized users, guests, and participants create or upload through OTTO. For Customer Content, the customer is the controller, determines why and how the content is processed, and is responsible for its own privacy notices and consents. We process Customer Content only on the customer's documented instructions, as described in our agreement and Data Processing Addendum (DPA) with that customer.
3. Information we collect
We collect the categories of information listed below, from you directly, from your organization, automatically through the services, and from service providers and business partners.
Account & contact: Name, work email, phone, job title, company, account credentials, role and permissions. Source: You; your organization.
Customer Content: Video, audio, images, voice, likeness, transcripts, titles, production metadata. Source: Customer, users, guests.
Commercial & billing: Orders, plan, invoices, tax ID, payment status; card data handled by payment processor. Source: You; payment processor.
Usage & device: IP address, device/browser type, pages and features used, timestamps, logs, crash data. Source: Automatically.
Studio & system data: Studio ID, camera/system status, configuration, performance and diagnostic telemetry. Source: OTTO hardware/software.
Support & sales: Messages, call/meeting notes, survey and event responses, marketing preferences. Source: You; events; partners.
You are not required to provide personal information to browse the public website. If you decline to provide information needed for an account, order, or support request, we may not be able to provide that service.
4. How we use personal information
Provide the services: create and manage accounts, configure and operate studios, record, store, and deliver Customer Content, provide remote operation and support, and fulfill orders.
Improve and develop: monitor performance, fix errors, analyze usage in aggregated form, and develop new features, including improving OTTO's camera-framing and switching models as described in Section 8.
Communicate: send service, security, and administrative messages, respond to inquiries, and — with your consent or as otherwise permitted by law — send marketing about our services. You may opt out of marketing at any time.
Secure and protect: detect and prevent fraud, abuse, unauthorized access, and violations of our Terms of Service, and protect the rights, safety, and property of our customers, users, and others.
Comply with law: meet legal, accounting, tax, and regulatory obligations, and respond to lawful requests from public authorities.
Business operations: billing, procurement, insurance, auditing, and corporate transactions as described in Section 6.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the CPRA. We do not use Customer Content to advertise to a customer's guests or participants.
5. Legal bases for processing (EEA, UK, and Switzerland)
Where the General Data Protection Regulation (GDPR), UK GDPR, or Swiss data protection law applies, we rely on the following legal bases: (a) performance of a contract, to provide services you or your organization requested; (b) our legitimate interests in operating, securing, and improving our business and services, balanced against your rights; (c) compliance with a legal obligation; and (d) consent, where we ask for it — for example, for certain marketing or optional cookies — which you may withdraw at any time without affecting processing carried out before withdrawal.
6. How we share personal information
Service providers and subprocessors: cloud hosting, storage, communications, payment processing, analytics, customer support, and security providers that process information only on our instructions and under contract. Our current subprocessors for the OTTO platform are made available to enterprise customers under our DPA, and we give notice of material subprocessor changes as that DPA requires.
Your organization: if your account is provided by an enterprise customer, that customer's administrators may access account information and Customer Content associated with the workspace, in accordance with the customer's policies.
Professional advisers and authorities: lawyers, auditors, insurers, and public authorities where necessary and lawful.
Business transfers: in connection with a merger, financing, acquisition, or sale of all or part of our business, subject to appropriate confidentiality and notice as required by law.
With your direction or consent: for example, when you ask us to share a recording or integrate a third-party service you have enabled.
We do not disclose Customer Content to other customers. We may share aggregated or de-identified information that cannot reasonably be used to identify a person.
7. Third-party services and integrations
At a customer's direction, OTTO may connect to third-party cloud storage, scheduling, communications, or distribution services. Information shared with those services is governed by the third party's own terms and privacy policy, not by this Policy. We encourage you to review the policies of any service you enable.
8. Recordings, AI vision, voice, and likeness
OTTO uses computer vision to frame shots and switch camera angles automatically, based on the position and movement of people and objects in the studio and on rules set by producers. That processing is designed to operate the cameras; it is not designed to identify a person by name. We do not create or sell facial-recognition templates or biometric identifiers from Customer Content unless a customer expressly enables a feature that requires it, in which case the customer is responsible for providing any required notices and obtaining any required consents, and the feature is governed by our DPA with that customer.
Recordings made in an OTTO studio may capture a person's image, voice, and name as spoken or displayed. The customer operating the studio — not Autonomous Studios — decides who is recorded, for what purpose, and how recordings are used and distributed, and is responsible for obtaining all necessary consents from guests, employees, and other participants and for complying with recording, wiretapping, employment, and biometric-privacy laws that apply to its productions.
Where we improve our AI models, we do so first with our own test material and aggregated or de-identified telemetry. We will not use an enterprise customer's identifiable Customer Content to train models for other customers unless our agreement with that customer expressly permits it.
9. Cookies and similar technologies
We use cookies and similar technologies that are (a) strictly necessary to operate and secure the website and platform; (b) functional, to remember preferences; and (c) where permitted, analytics, to understand how visitors use the website. Where consent is required, we will ask for it through our cookie banner or settings and honor your choice. You can also control cookies through your browser settings; disabling some cookies may affect site functionality. We do not respond to browser "Do Not Track" signals in a uniform way, because no common standard for doing so has been adopted, but we honor legally required opt-out preference signals, including Global Privacy Control, where they apply to a sale or sharing of personal information.
10. Data retention
We keep personal information for as long as reasonably necessary for the purposes in this Policy: account and contact information for the life of the account plus a reasonable period thereafter; billing records as required for tax and accounting; support records for a limited period after resolution; and website logs for a short security and analytics period. Customer Content is retained and deleted in accordance with the customer's instructions and our agreement with the customer, including the return-or-deletion period in the applicable DPA. We may retain information longer where required by law, to resolve disputes, or to enforce our agreements, and we delete or de-identify it when it is no longer needed.
11. Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, and alteration, including access controls based on least privilege, encryption in transit, logging and monitoring, and personnel training. Access to Customer Content is limited to personnel and subprocessors with a need to know to provide the services. No system is completely secure, however, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected customers and regulators as required by law and our agreements.
12. International transfers
We are based in the United States, and we and our service providers may process information in the United States and other countries, which may have data protection laws different from your own. Where required, we use appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our DPA.
13. Your privacy rights
Depending on where you live, you may have the right to: access and obtain a copy of your personal information; correct inaccurate information; delete information; restrict or object to certain processing; receive information in a portable format; withdraw consent; and not be discriminated against for exercising your rights. You also have the right to lodge a complaint with your local data protection authority. We will not retaliate against anyone for exercising a privacy right.
To exercise a right, contact us as described in Section 1. We will verify your identity (and, if an authorized agent acts for you, their authority) and respond within the period required by applicable law. If your information was provided to us by an enterprise customer — for example, if you appeared in that customer's recording — please contact that customer first, as it controls the content; we will support the customer in responding, as our DPA requires.
14. U.S. state privacy rights
Residents of California and other states with comprehensive privacy laws may exercise the rights in Section 13, including the right to know the categories of personal information collected, the categories of sources and recipients, and the purposes described in this Policy, and the right to appeal a refusal to act on a request by contacting us as described in Section 1. Because we do not sell personal information or share it for cross-context behavioral advertising, no opt-out for those activities is offered; if that practice changes, we will update this Policy and provide the required opt-out method first. We do not knowingly process sensitive personal information beyond what is necessary to provide a service a customer has requested — principally, voice and likeness contained in Customer Content processed on the customer's instructions.
15. Children's privacy
Our website and services are intended for businesses and adults. We do not knowingly collect personal information from children under 16 through our website or marketing. Educational and other customers that record minors in their own studios are responsible for obtaining any parental, guardian, or school consent required by law. If you believe a child has provided us personal information directly, contact us and we will delete it as required by law.
16. Links to other websites
Our website may link to third-party sites and embed third-party content. This Policy does not apply to those sites, and we are not responsible for their content or privacy practices.
17. Changes to this Policy and contact
We may update this Policy from time to time. If we make a material change, we will post the updated Policy on this page, revise the "Last updated" date, and provide additional notice as required by law — for example, by email to account administrators or by notice in the platform. Changes take effect on the date stated in the updated Policy.
Questions, requests, and complaints: Privacy Team, Narona LLC, 412 E Santa Clara Street, Hebbronville, Texas 78361; email info@naronafilms.com; or through the contact form at www.autonomous-studios.com. Enterprise customers may also contact their account representative, who will route the request to the privacy team.