Short, because there is not much to say.

This website

This site sets no cookies. It loads no fonts, scripts or images from third parties. The web server keeps no access log; its error log, used for troubleshooting, can include the IP address of a request that failed.

If you take an estimate from the pricing page to the contact form, your browser keeps the counts (companies, users, projects ticked) in this tab's session storage until you send the form, remove the estimate or close the tab. They are not in the page address and reach us only when you press Send.

To see which pages are read and how people find us, we count visits with Umami, open-source analytics software that runs on our own server, not a third-party service. It sets no cookies and stores nothing in your browser. For each page view it records the time, the page address (including campaign tags such as utm_source and advertising click identifiers), the page title, the site that linked to it, your browser, operating system, device type, screen size and language, and your country, looked up from your IP address. On the pages our ads link to (the Odoo 19 upgrade page and the free scan page) it also records how long the page has been open on your screen (marks at 5, 15, 30, 60, 120 and 300 seconds), how far down you scroll (a quarter, half, three quarters, the end) and which of the page's links and buttons you tap, with the same visit details. Our analytics do not store your IP address: together with your browser details it only makes a coded visitor ID that changes every day, so visits can be counted without keeping the address. Visits from known bots are filtered out. We keep these records for 13 months, then delete them automatically. We share none of this with anyone. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded. Country lookups use IP geolocation by DB-IP, licensed under CC BY 4.0.

If you send us a form on this website (contact, quote, free scan, or an "Email me" box) from a page whose address carries campaign tags such as utm_source, for example because you came from one of our ads, we keep those tags with your inquiry, for as long as we keep the inquiry, to see which of our ads or links brought it. The tags pass from page to page only in the page address, so, like any web address, they can appear in your browser history; nothing else is stored in your browser.

If you use the contact form or email us, we keep what you send in order to reply and, if you become a customer, as part of your customer record. If you do not become a customer, we delete it within twelve months. We do not add you to a mailing list and we do not sell or share your details.

We use what you send through our website forms to run our free-service drawing (see our drawing rules) and to contact winners. Entries are deleted on the same schedule as other inquiries.

If you use an "Email me" box on one of our pages, your email address, which page you asked for and that page's campaign tags, if any, are kept in our customer records, as for the contact form. We email you the links from notifications@allodi.us and may write to you once to follow up; we do not add you to a mailing list.

Text messages

If you opt in to Allodi text alerts (see on-call alerts and the SMS terms), we use your mobile number only to send those alerts and to answer your HELP and STOP replies. Text messaging opt-in data and consent are not shared with any third parties. Mobile information is not sold or shared with third parties or affiliates for marketing or promotional purposes. Our messaging platform (Telnyx) and the phone carriers process your number only to deliver these messages. If you reply STOP, we stop sending and keep only the record that you opted out.

The free scan

The free scan reads Odoo's settings tables (installed modules, custom fields, views, actions, scheduled jobs, reports, access rules) and counts companies and users. It does not read customers, invoices, orders, messages, attachments or passwords, and it changes nothing.

• If you run the scan file yourself, we receive only the result file you send: counts and names of modules and customizations. Whether you email it or send it with the form on the free scan page, it is kept with your name, company and email in our own customer records (Odoo, on our server), and the report made from it is kept with it.
• If you ask for an upload link on the free scan page, your name, company, work email and country are kept in our customer records, as for the contact form, and the link is emailed to that address from notifications@allodi.us. The emailed link itself is not kept once the email has gone out.
• If you upload a backup, we receive the database part of it, which holds your business records and the personal data in them, as well as user password hashes and stored settings. For that data your company is the controller and Allodi processes it only to run your scan. It is stored in a private Backblaze B2 bucket and loaded on a temporary Hetzner Cloud server, both in the United States, and the uploaded database is not sent to any AI provider. Once the scan succeeds, the server and the upload are deleted; if it fails, the upload is kept so it can be run again. A rule on the bucket deletes every upload within 7 days of its arrival in any case. Your attachments and files stay on your computer.
• We keep the scan results (the counts and names in your report) with your quote. If you do not become a customer, we delete them within twelve months, or sooner if you ask.
• No contract is needed for a scan. If your database holds personal data about people in the EU/EEA, the UK or Switzerland, run the scan file yourself, so that only the result file leaves your server.

The live demo

When you use the live demo chat, your questions and the agent's answers, with the queries it ran, are logged so we can check the answers and improve the demo. To answer, your question is sent to Anthropic's API (Claude models). We do not store your IP address: a one-way code derived from it is kept only to enforce the demo's usage limits. The log is rotated monthly, and the last twelve months are kept, then deleted. Please do not type personal or confidential information. Anything you add to the demo company is visible to other visitors until the nightly reset.

If you use "Email me this conversation" under the demo, we email your questions and the agent's answers to the address you enter from notifications@allodi.us. That conversation, which until then is not linked to you, is then kept with your address in our customer records, as for the contact form, and we may write to you once to follow up; we do not add you to a mailing list. Asking again for the same conversation within a day sends nothing new.

Customer databases

When we host or support your Odoo, your database contains your business's data and, within it, personal data about your employees, customers and suppliers. For that data, your company is the controller and Allodi is a processor acting on your instructions. Our data processing agreement (DPA, PDF) says so. For customers in the EU/EEA, the UK or Switzerland, or whose data includes people there, its Part C covers transfers to the United States with the EU standard contractual clauses (SCCs), the UK addendum, and the adaptations Swiss law requires.

In practice:

• Your database lives on a server in a cloud account your company owns, in the region you choose (United States, Germany or Finland with Hetzner Cloud). Backups go to a storage bucket your company owns, encrypted.
• We access your system to do the work you have asked for and nothing else. Access is by named individual accounts with multi-factor authentication and SSH keys. Access is logged.
• The AI agent we use reads your system in place to triage tickets and draft changes. It runs on infrastructure we control. Database dumps are not uploaded to any AI provider. Relevant excerpts (a record, an error message, a code file) are sent to the model provider as part of doing the work; the provider does not train on them, under our agreement with them. See Anthropic's commercial terms.
• Sub-processors are listed in Annex III of the DPA: Hetzner (your servers, in your own account, and our own servers for the support portal and outside monitoring), Backblaze (backups, in your own account), Anthropic (the AI model), Microsoft (our email, Microsoft 365, including the support portal's notification emails) and Telnyx (our phone lines and on-call alerts). The support portal where tickets are kept is our own, on our own server. We give 30 days' notice in the support portal and by email before adding or replacing a sub-processor.
• We tell you without undue delay, and in any case within 48 hours of becoming aware, if we learn of a breach affecting your data, and we help you meet your own notification duties.
• When you leave, we hand over a final backup, then delete the personal data we hold once you confirm you have it, or 30 days after the handover, whichever comes first; ticket history in the support portal is deleted 12 months after the contract ends unless you ask for it sooner. We confirm deletion in writing on request. Since you own the server and backups, most of it never left your hands.

Your rights

If you are in the EU/EEA, the UK, Switzerland or another jurisdiction with data protection law, you have rights to access, correct, delete and port your personal data and to object to certain processing. For data in a customer's Odoo, contact that customer; we will help them respond. For data we hold about you directly, write to us at privacy@allodi.us. Our full privacy notice (PDF) has the details.

Who we are

KEIGHT LLC, an Iowa limited liability company
Allodi is a product of KEIGHT LLC.
109 SE 4th Street
Des Moines, IA 50309, USA
Email: hello@allodi.us

This page is a plain-language summary and is not the contract. Where it differs from a signed agreement, the agreement applies.