oddy
Sign in

Privacy policy

Effective {{policy_effective_date}}

Controller

{{company_name}} runs Oddy and is the controller of the personal data on this page.

Company
{{company_name}}, {{company_legal_form}}
Address
{{registered_address}}
KvK
{{chamber_of_commerce_number}}
VAT
{{vat_number}}
Privacy contact
support@oddy.dev

Personal data

Purpose Data Legal basis Retention
Account and sign-in Name, email address and picture from your login, how you sign in, your second factors and sessions
Held in Zitadel, the identity system Oddy runs itself.
 Contract, Art. 6(1)(b) Until your account is deleted. Sessions: 7 days.
Organizations and applications Organizations, members and their roles, invitations by email address, applications, connected agents and settings Contract, Art. 6(1)(b) Until deleted. Invitations: until accepted or withdrawn.
Billing and invoices Billing details (name, address, country, VAT or tax ID, invoice and billing contact email), VAT ID checks, usage, invoices, credit notes and payments Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) 7 years, 10 years for sales declared through the EU One Stop Shop (Dutch tax law, AWR article 52), also after an account or organization is deleted
Billing emails Email address and the text of budget warnings, spending stops, credit notices and invoice links Contract, Art. 6(1)(b) 90 days after sending
Audit log What you do in the web UI and through agents, the API and the CLI, and your sign-ins, with your name, email address, IP address and browser
Owners of an organization see its events.
 Legitimate interest, Art. 6(1)(f): security, and showing organization owners who did what 1 year
Security logs Requests to Oddy and to the applications on it: IP address, time, host, path and status. Sign-ins, and changes made in Oddy's identity system, Grafana, Argo CD and Kubernetes, with the user and, where recorded, the IP address. Legitimate interest, Art. 6(1)(f): security Requests: 7 days. Sign-ins and changes: 1 year.
Cookie choice A random ID, date and time, site, policy revision, your choice and whether your browser sends Global Privacy Control. No IP address and no account. Legal obligation to show consent, Art. 6(1)(c) and Art. 7(1) 2 years
Analytics, only with your consent Page names without IDs, time on page, steps such as creating an app, browser, operating system, screen size, language, the site you came from without its path, and country, region and city looked up from your IP address. Visits are counted with an ID derived from your IP address with a salt that changes every month. The IP address is not stored.
Details: Cookie policy.
 Consent, Art. 6(1)(a) 13 months
Telemetry of your applications Logs, metrics, traces and profiles of your organization's applications Processor for your organization, Art. 28 Set by the organization's owners. Default: logs and traces 7 days, metrics and profiles 30 days. At most 1 year.
Support Your name, email address and what you write to support@oddy.dev or sales@oddy.dev, in the contact form on oddy.dev, in Oddy or through an agent. In Oddy and through an agent also your account and the organization you name. No IP address. Contract, Art. 6(1)(b), for customers. Legitimate interest, Art. 6(1)(f), to answer others. 2 years after the request is closed. Emails about it: 90 days after sending.

Hosting

Oddy runs on servers of Hetzner Online GmbH in Germany. Identity, databases, analytics, logs and telemetry run on these servers, operated by Oddy itself.

Recipients

Recipient Country Data When
Hetzner Online GmbH Germany Everything on Oddy's servers Always, as hosting provider
mailbox.org, Heinlein Germany Emails to oddy.dev addresses, and the emails Oddy sends When you email Oddy or send a support request
European Commission, VIES EU A business customer's EU VAT ID When billing details are saved, and for each invoice
Google US That you sign in to Oddy. Oddy receives your name, email address and picture. When you choose to sign in with Google
Your organization's identity provider Your organization's choice Your sign-in When your organization connects its own sign-in
Code hosts and telemetry destinations The organization's choice Committer names and email addresses in webhooks, the organization's telemetry When an owner connects them
Mollie B.V. Netherlands, hosted on Google Cloud in the EU Name, email address, IBAN or card reference and amounts Decided, not used yet. Until then invoices are paid by bank transfer.
Belastingdienst, the Dutch tax authority Netherlands Billing records When it audits the books

Transfers outside the EU

None by default. Data only leaves the EU through a service you or your organization choose: signing in with Google (US), a code host such as GitHub or GitLab.com (US), or a telemetry destination outside the EU. That service's own privacy policy applies to what it receives.

Data of your applications

For what an organization runs on Oddy, the organization is the controller and Oddy is its processor (Art. 28 GDPR): source code and images, volumes, environment variables and secrets, the telemetry of its services, and the personal data of its own users. Users of those applications: contact the organization that runs the application.

Data processing agreement: {{dpa_link}}

Automated decisions

Oddy does not profile anyone. It applies these rules to organizations automatically:

  • At a spending limit an owner sets, changes that add cost are refused. With a hard stop, the organization's applications are paused or its telemetry is no longer collected.
  • Without a payment method, the free-tier limits apply.
  • From 7 days after an invoice's due date, new reservations are refused. From 21 days, the organization's applications are paused until the invoice is paid.

The Billing page shows the reason. Contest a decision at support@oddy.dev.

Your rights

  • Access and portability: Account, Your data, Download my data, or export_my_data over MCP or oddy account export. It holds your profile, organizations, agents, sessions, your audit events, and the billing records of organizations you own or manage billing for.
  • Correction: your name, email address and picture come from your login and update when you sign in. For anything else, email support@oddy.dev.
  • Erasure, restriction and objection: email support@oddy.dev. Billing records stay for the period tax law requires.
  • Withdrawing consent: Cookie settings, also in the account menu of apps.oddy.dev. Withdrawing does not affect processing before it.
  • Oddy answers within one month.
  • Complaints: Autoriteit Persoonsgegevens, or the supervisory authority in your EU country.

Changes

Changes are published on this page with a new effective date.