Privacy Notice
Last updated: 2026-08-02
This Privacy Notice explains how OdoMate ("we," "us," "our") collects, uses, and protects your personal data when you visit https://odomate.pro, sign up for our waitlist, download a resource from our blog, or use the OdoMate platform once invited.
We take privacy seriously. We collect only what we need, we tell you exactly what we do with it, and you can ask us to delete it at any time.
1. Who we are
OdoMate is operated by Maryana Zelinska & Andriy Zelinskyy (operating as OdoMate), the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
Contact for privacy matters: privacy@odomate.pro
OdoMate is currently in a private validation phase. Access to the platform is invite-only via our waitlist.
2. What data we collect
2.1 When you visit https://odomate.pro
- Analytics data about your visit — pages viewed, clicks, time on page, traffic source, device type, and approximate location derived from IP. We do not record session replays. We do not store your IP address itself.
- Blog view counts — when you open a blog article we increase an aggregate view counter for that article and language. To count each reader at most once per day we derive an anonymous identifier from a salted hash of your IP address and browser; the salt changes daily so the identifier cannot be linked across days, the raw IP address is never stored, and the hashed identifier is deleted within 48 hours. This works without cookies and without consent because no personal data is retained.
- Cookies — only after you opt in via the cookie banner. See Section 8.
2.2 When you sign up for the waitlist
- Email address (required)
- Role (Odoo Partner / Freelancer / In-house BA / In-house Developer / End-client decision-maker / Other)
- Odoo edition you primarily work with (Community / Enterprise / Both / Not sure)
- What's the most painful part of building a custom Odoo module today (optional free text)
- Whether you would pay for a tool that generates OCA-compliant modules from a spec
- Locale preference (English / Ukrainian)
- Browser user-agent and referring URL (collected automatically)
- Timestamp of submission
2.3 When you use the OdoMate platform (post-invitation)
- Account identity from Google OAuth (your name, email, and profile picture as provided by Google)
- Business need / specification text you enter
- Refinement conversations with our AI assistant
- Optional UI mockup images you upload
- Metadata about modules you generate (counts, timestamps, errors)
- Truncated previews of AI conversation steps for debugging (up to 1,000 characters per message)
We do not store the full code of generated modules in our database — only the ZIP archive in object storage.
2.4 When you download a resource from our blog
Some blog articles offer downloadable resources (checklists, templates) in exchange for your contact details. If you request one, we collect:
- Email address (required — we deliver the download link to it)
- Your role (same options as the waitlist)
- Company name (optional)
- Locale preference, browser user-agent and referring URL (collected automatically)
- Timestamp of your submission and of your consent, and how many times you used the download link
3. Why we use your data, and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Operate the landing page and waitlist | Analytics, waitlist form fields | Consent (Art. 6(1)(a)) for cookies and analytics; Consent for waitlist storage and communications |
| Send you waitlist updates and the launch invitation | Consent (Art. 6(1)(a)) | |
| Deliver blog resources you request | Lead-magnet form fields (Section 2.4) | Consent (Art. 6(1)(a)) |
| Provide the OdoMate platform to invited users | Account, specs, generated modules, conversations | Performance of a contract (Art. 6(1)(b)) |
| Detect abuse and ensure security | Account, IP-derived signals (transient), logs | Legitimate interest (Art. 6(1)(f)) — operating a secure service |
| Comply with legal obligations (tax, accounting) | Billing data if applicable | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decision-making or profiling.
4. Who has access to your data
We share data only with the third-party service providers below ("sub-processors") who help us operate OdoMate. Each is bound by a data processing agreement.
| Service provider | What they process | Location |
|---|---|---|
| Vercel | Landing page and platform frontend hosting | Frankfurt (EU) |
| Railway | Backend API, Odoo demo container, internal database | Amsterdam (EU) |
| Supabase | Account, specs, generation metadata, file storage | Frankfurt (EU). Some authentication emails egress via AWS SES (US) under standard contractual clauses (SCCs). |
| Anthropic (Claude) | Your business-need text and refinement messages, when generating modules | US — under SCCs. Inputs retained ≤30 days for safety review; not used to train models. |
| OpenAI | Embedding queries on the Odoo knowledge base (no user data is embedded) | US — under SCCs. Inputs retained ≤30 days; not used to train models. |
| OAuth sign-in (your name, email, profile picture) | US — under SCCs | |
| Upstash | Odoo documentation lookup during module generation | Varies — under SCCs |
| PostHog | Landing-page and platform analytics (EU Cloud) | EU — no international transfer |
| Notion | Internal mirror of waitlist signups and blog-resource leads for team review | US — under SCCs |
We do not sell your data, share it with advertising networks, or use it for marketing outside OdoMate.
5. International data transfers
Where data is transferred outside the EU/EEA, we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission, as referenced in each sub-processor's data processing agreement. We minimise such transfers where alternatives exist (e.g., PostHog is on EU Cloud, Supabase databases are EU-hosted).
6. How long we keep your data
- Waitlist signups: until product launch + 12 months, OR until you unsubscribe, whichever is sooner. After that, deletion.
- Blog-resource leads: until product launch + 12 months, OR until you ask us to delete them (privacy@odomate.pro), whichever is sooner. After that, deletion.
- Active platform accounts: for the duration of your active account.
- Inactive platform accounts: automatically deleted after 24 months of no login.
- Generated module ZIPs: signed download URLs expire in 24 hours. Underlying objects: please contact us to confirm current retention policy.
- Demo Odoo databases: automatically dropped after 24 hours of inactivity.
- Billing records (where applicable): 7 years, as required by tax law.
- LLM provider retention (Anthropic, OpenAI): ≤30 days for safety review, by their respective contractual terms. Not used for model training.
If you ask us to delete your data, we will do so within 30 days, except where law requires retention.
7. Your rights
Under GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure ("right to be forgotten") — ask us to delete your data.
- Restriction — ask us to limit how we process your data.
- Portability — receive your data in a machine-readable format.
- Object — to processing based on legitimate interest.
- Withdraw consent — at any time, for any processing based on consent.
- Lodge a complaint — with the supervisory authority in your country. Find your authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
To exercise any of these rights, email privacy@odomate.pro. We respond within 30 days. If we need to verify your identity, we will reply asking for confirmation from the email address on file.
8. Cookies and analytics
We use the following cookies and tracking technologies. We do not load any of them until you opt in via our cookie banner.
| Category | Purpose | Provider | Required? |
|---|---|---|---|
| Strictly necessary | Keep the site functional | OdoMate (first-party) | Always on — no consent needed |
| Analytics | Understand how visitors use the site | PostHog (EU Cloud) | Optional — opt-in via banner |
| Functional | Embed scheduling and form widgets | Calendly, etc. | Loaded only when you interact with the relevant feature |
You can change your cookie preferences at any time by clicking the "Cookie settings" link in the page footer.
9. Children
OdoMate is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have, please contact us at privacy@odomate.pro and we will delete it.
10. Security
We use TLS (HTTPS) for all data transmission, role-based access control on our backend, and Row-Level Security on our database. Our sub-processors maintain their own security commitments under their contracts with us. No system is perfectly secure; if we ever experience a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and you without undue delay.
11. Changes to this notice
If we change this notice in a way that materially affects your rights, we will notify you by email (for waitlist subscribers and account holders) and update the "Last updated" date at the top. The previous version will remain available on request.
12. Contact us
Privacy questions or data subject requests: privacy@odomate.pro
Legal matters: legal@odomate.pro
Security or vulnerability reports: security@odomate.pro
General inquiries: info@odomate.pro