Short, because there is not much to say.

This website

This site sets no cookies and runs no analytics or tracking scripts. It loads no fonts, scripts or images from third parties. The web server keeps standard access logs (IP address, page requested, time, browser) for thirty days for security and troubleshooting, then deletes them.

If you use the contact form or email us, we keep what you send in order to reply and, if you become a customer, as part of your customer record. If you do not become a customer, we delete it within twelve months. We do not add you to a mailing list and we do not sell or share your details.

Customer databases

When we host or support your Odoo, your database contains your business's data and, within it, personal data about your employees, customers and suppliers. For that data, your company is the controller and Allodi is a processor acting on your instructions. We sign a data processing agreement (DPA) with every customer that says so, and for customers in the EU and UK the DPA includes the standard contractual clauses (SCCs) and UK addendum for transfers outside those areas.

In practice:

• Your database lives on a server in a cloud account your company owns, in the region you choose (United States, Germany or Finland with Hetzner Cloud). Backups go to a storage bucket your company owns, encrypted.
• We access your system to do the work you have asked for and nothing else. Access is by named individual accounts with multi-factor authentication and SSH keys. Access is logged.
• The AI agent we use reads your system in place to triage tickets and draft changes. It runs on infrastructure we control. Database dumps are not uploaded to any AI provider. Relevant excerpts (a record, an error message, a code file) are sent to the model provider as part of doing the work; the provider does not train on them, under our agreement with them. {{AI_PROVIDER_TERMS_LINK}}
• Sub-processors: the cloud host and backup storage provider (yours, not ours), the AI model provider, and our own ticketing and email. The current list is available on request and customers are notified before it changes.
• We tell you without undue delay, and in any case within 72 hours of becoming aware, if we learn of a breach affecting your data, and we help you meet your own notification duties.
• When you leave, we return or delete what we hold within thirty days, at your choice, and confirm in writing. Since you own the server and backups, most of it never left your hands.

Your rights

If you are in the EU, UK or another jurisdiction with data protection law, you have rights to access, correct, delete and port your personal data and to object to certain processing. For data in a customer's Odoo, contact that customer; we will help them respond. For data we hold about you directly, write to us at the address below.

Who we are

{{LEGAL_ENTITY}}
{{LEGAL_ADDRESS}}
Email: hello@allodi.us

This page is a plain-language summary and is not the contract. Where it differs from a signed agreement, the agreement applies.