Data Collection
When you register on our website to use or download one of our products or book one of our services, ot fill in one of our contact forms, you volutarily give us certian information. This typically includes your name, company name, email address and sometimes your phone number, postall address (when an invoice or delivery is required), your home address (for pet sitting and/or in person appointments) as well as a personal password.
We never record or store credit card information from our customers and always rely on trusted third party payment processors for credite card processing, including for recurring payment processing
Browser Data: When you visit our website and access our online services, we detect and store your browser language and geolocation in order to customize your experience according to your country and preferred language. Our servers also passively record a summary of the information sent by your browser for statistical, security and legal purposes: your IP address, the time and date of your visit and the page or resource you are accessing, your browser version and platform, and the web page that referred you to our website.
Your browser may also be used to store and retrieved your current session data, with the help of a session cookie (see also the Cookie section for more details).
Form protection: some forms on our website may be protected by Google reCAPTCHA. This technology relies on heuristics that are based on technical characteristics of your browser and device, and may also use specific Google cookies. See also Google Privacy Policy and Terms of Use in the Third Party Service Providers section below.
How we use this information
Account & Contact Data: We use your contact information in order to provide our services, to answer your requests, and for billing and account management reasons. We may also use this information for marketing and communication purposes (our marketing messages always come with a way for you to opt-out at any time). We also use this data in aggregated/anonymised form in order to analyze service trends.
Browser Data: This automatically recorded data is anonymously analyzed in order to maintain and improve our services. Google reCAPTCHA may also be used for security purposes, in order to prevent abuse of our services. In that case we only process the anonymous score that reCAPTCHA determines based on your browser and device.
We will only correlate this data with your personal data when required by law or for security purposes, if you have violated our Acceptable Use Policy.
Customer Database: We only collect and process this data on your behalf, in order to perform the services you have subscribed to.
Our system is supported by Odoo and their Helpdesk staff and engineers may access this information in a limited and reasonable manner in order to solve any issue with our services, or at your explicit request for support reasons, or as required by law, or to ensure the security of our services in case of violation of our Acceptable Use Policy in order to keep our services secure.
Accessing, Updating or Deleting Your Personal Information
Account & Contact Data: You have the right to access and update personal data you have previously provided to us. You can do so at any time by connecting to your personal account on this website. If you wish to permanently delete your account or personal information for a legitimate purpose, please contact our us to request so. We will take all reasonable steps to permanently delete your personal information, except when we are required to keep it for legal reasons (typically, for administration, billing and tax reporting reasons).
Safety Retention Period: we retain a copy of your data in our backups for safety reasons, even after they are destroyed from our live systems. See Data Retention for more details.
Security
We realize how important and sensitive your personal data is, and we take a great number of measures to ensure that this information is securely processed, stored and preserved from data loss and unauthorized access. Our technical, administrative and organizational security measures are described in details in our Security Policy.
Third Party Service Providers / Subprocessors
In order to support our operations we rely on several Service Providers. They help us with various services such as payment processing, web audience analysis, cloud hosting, marketing and communication, etc.
Whenever we share data with these Service Providers, we make sure that they use it in compliance with Data Protection legislation, and that the processing they carry out for us is limited to our specific purpose and covered by a specific data processing contract.
Below is a list of the Service Providers we are currently using, why we use them, and what kind of data we share with them.
In-App Purchase (IAP): The list of third-party service providers for each IAP service is available on the IAP Privacy Policy page.
A. Subprocessors
These third-party service providers are processing data for which Odoo is Controller or Processor, on behalf of Odoo.
| Subprocessors | Purpose | Shared Data |
|---|---|---|
| OVH S.A.S. Privacy & Security | Infrastructure and hosting of Odoo.com (production + backups), Odoo SaaS (production + backups), Odoo.SH (backups), DDOS Protection. | Currently hosted by OVHCloud: Production data from Odoo.com and its affiliate services, including Odoo Online (SaaS) Customer Databases, and the Odoo Database Upgrade services, including Customer databases currently being upgraded; Backup data for all Odoo cloud services. Data Center Certifications: ISO 27001, SOC 1 TYPE II, SOC 2 TYPE II, PCI-DSS, CISPE, SecNumCloud, CSA STAR. |
| Google Cloud EMEA Ltd Privacy & Security | Infrastructure and hosting of Odoo.com (production + backups), Odoo SaaS (production + backups), Odoo.SH (production + backups), DDOS Protection. | Currently hosted by Google: Production data from Odoo.com and its affiliate services, including Odoo Online (SaaS) and Odoo.SH (PaaS) Customer Databases and the Odoo Database Upgrade services, including Customer databases currently being upgraded; Backup data for all Odoo cloud services. Data Center Certifications: ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC3, PCI-DSS, HIPAA, CISPE, CSA STAR . |
| Amazon Web Services, Inc. Privacy & Security | Infrastructure and hosting (legacy) | Currently hosted by AWS: The Odoo Database Upgrade services for Customer Databases that are uploaded on the legacy web-based upgrade platform, or that were previously started on that legacy platform with custom scripts, or that are started from the end-of-life version OpenERP v6.1. Newer upgrades started with the command-line script or the new web-based form are not processed on AWS. Data Center Certifications: ISO 9001, ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC3, PCI-DSS, HIPAA, CISPE, CSA STAR |
| FullStory Security & Privacy GDPR Info Cookie Policy | Temporary free trial recordings for users who consent to the UX improvement program. | Shared with FullStory: video-like recording of your screen during the first 2h of your free trial session + FullStory cookie. |
B. Third-party Processors and Controllers
These third-party service providers are processing data for which Odoo is a Controller, as Processors, on behalf of Odoo, or they are receiving such data as Controllers, for the specific purpose of performing the services they have been contracted to provide.
| Service Provider | Purpose | Shared Data |
|---|---|---|
| Paypal PCI • Privacy & Security | Payment processing on Odoo.com. | Shared with Paypal: Order details (amount, description, reference), Customer name and email. Only stored by Paypal: credit card info. |
| Ingenico Payment Services PCI • Privacy | Payment processing on Odoo.com. | Shared with Ingenico:Order details (amount, description, reference), Customer name and email. Only stored by Ingenico: credit card info. |
| Stripe PCI • Privacy & Security | Payment processing on Odoo.com. | Shared with Stripe: Order details (amount, description, reference), Customer name and email. Only stored by Stripe: credit card info. |
| Adyen PCI • Privacy • T&C | Payment processing on Odoo.com. | Shared with Adyen: Order details (amount, description, reference), Customer name and email. Only stored by Adyen: credit card info. |
| OneSignal Privacy & Security | In-browser push notifications for Odoo.com visitors. | Shared with OneSignal: Non-personal browser data, geolocation info, language (no identifiable information). Only stored by OneSignal: browser/mobile device IDs. |
| Google Tag Manager Privacy & Terms • Types of cookies | Website audience analysis. Opt-out | Shared with Google: Ads Campaign Data, Browser data, visited pages. |
| Google reCAPTCHA Privacy & Security | Form protection. | Used by Google reCAPTCHA: Browser and device characteristics, Google cookies. |
| Acuity Scheduling Privacy & Security | Scheduling of demo/meeting on Odoo.com. | Shared with Acuity: Any personal info entered by the user in the scheduling form: name and contact info, reason for request, etc. |
| Clearbit Privacy & Security | Retrieval of business info for prospection reasons. | Retrieved from Clearbit for visitors coming from EU companies: name, sector, est. size, est. revenue, website, social media and general contact info. Retrieved from Clearbit for visitors coming from non-EU companies: same as for EU companies, plus contact info for company executives, if known. |
| CloudFlare Security & Privacy • Cookie Policy | Distributed caching of static resources and images of Odoo.com. | Used by CloudFlare: Browser and device characteristics, CloudFlare cookies. |
Data Retention
Account & Contact Data: we will only retain such data as long as necessary for the purpose for which it was collected, as laid out in this policy, including any legal retention period, or as long as necessary to carry out a legitimate and reasonable promotion of our products and services.
Browser Data: we may retain this data for a maximum of 12 months, unless we need to keep it in relation with a legitimate concern related to the security or performance of our services, or as required by law. Any server-side session information is discarded maximum 7 days after it stops being actively used.
Server Logs & Security Logs: we retain those logs for a maximum of 12 months, unless we need to keep them in relation with a legitimate concern related to the security or performance of our services, or as required by law.
Safety Retention Period: As part of our Security Policy, we always try to preserve your data from accidental or malicious deletion. As a result, after we delete any of your personal information (Account & Contact Data) from our database upon request from you, or after you delete any personal information from your database (Customer Database), or if you delete your entire database, it is not immediately deleted from our backup systems, which are secured and inalterable. The personal data could remain stored for up to 12 months in those backups, until they are automatically destroyed.
We commit not to use those backup copies of your deleted data for any purpose except for maintaining the integrity of our backups, unless you or the law require us to do so.
Physical Data Location / Data Transfers
Hosting Locations
Production & Backups
Customer databases are hosted in the Odoo Cloud Hosting Region closest to where they are situated, and can request a change of region (subject to availability).
In addition to the production copy, Odoo commits to maintaining at least three redundant backup copies of each customer database, stored in separate data centers that are geographically distant enough to ensure resilience against region-wide and country-wide incidents.
The table below lists the current countries hosting production environments and backups for each Odoo hosting region. These locations may evolve within the same region as needed to maintain service continuity, performance, and compliance with contractual and legal obligations.
It is not possible to choose or restrict the backup locations. The same locations are used for all customers within the same hosting region to ensure consistency and data integrity.
| Hosting Region | Production Location | Backup Locations |
|---|---|---|
| Americas | USA, Canada | Europe (FR, NL) + Canada |
| Europe | Europe (FR, BE) | Europe (FR, NL, SE) † |
| Asia & Pacific | Singapore, Taiwan | Europe (FR, NL) + Canada |
| Middle East & Southern Asia | India, Saudi Arabia | Europe (FR, NL) + Canada |
| Oceania | Australia | Europe (FR, NL) + Canada |
: countries with this sign are in the EU or currently subject to an adequacy decision from EU authorities.
†: EU-only backups currently apply for new customers using Odoo 19.0 or later. Other EU-hosted customers still have an additional Canada-based backup until the full transition completes (ETA: Q2 2026).
For more details regarding our hosting services, see our Cloud Hosting SLA.
Database Upgrades
Customer databases are upgraded within their current production hosting location (see above) or on a global upgrade server located in Europe
In-App Purchase (IAP) Transaction Data
You can find the detailed privacy policy for each service on the IAP Privacy Policy page.
Free Trial Session Recording
Free trial sesssions recording data is processed by FullStory (see our Service Providers) in Google Cloud data centers located in the United States. As a reminder, this data is only recorded if you opt-in and is only kept for a very limited time.
International Staff
In some cases, the personal data mentioned in this Privacy Policy may be accessed by staff members of Odoo SA subsidiaries in other countries. Such access will always be done for the same purposes and with the same privacy and security precautions as if it was done by our own local staff, so all the guarantees we provide still apply. Odoo uses EU Standard Contractual Clauses to bind subsidiaries in a way that offers sufficient safeguards on data protection for the limited and temporary data transfers that occur for such access.
Third Party Disclosure
Except as explicitly mentioned above, we do not sell, trade, or otherwise transfer your personal data to third parties. SMS/text messaging opt-in is excluded from any data transfer covered above. We may share or disclose aggregated or de-identified information, for research purposes, or to discuss trends or statistics with third-parties.
Cookies
Cookies are small bits of text sent by our servers to your computer or device when you access our services. They are stored in your browser and later sent back to our servers so that we can provide contextual content. Without cookies, using the web would be a much more frustrating experience. We use them to support your activities on our website, for example your session (so you don't have to login again) or your shopping cart.
Cookies are also used to help us understand your preferences based on previous or current activity on our website (the pages you have visited), your language and country, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.
We also use third-party services such as Google Analytics, who set and use their own cookies to identify visitors and provide their own contextual services. For more information regarding those third-party providers and their Cookie Policy, please see the relevant references in the Third-Party Service Providers section.
Here is an overview of the cookies that may be stored on your device when you visit our website:
| Category of Cookie | Purpose | Cookies |
|---|---|---|
| Session & Security | Authenticate users, protect user data and allow the website to deliver the services users expect, such as maintaining the content of their cart, or allowing file uploads. The website will not work properly if you reject or discard those cookies. | session_id (Odoo) td_id (Odoo) fileToken (Odoo) __cfduid (CloudFlare) |
| Preferences | Remember information about the preferred look or behavior of the website, such as your preferred language, region and timezone. Your experience may be degraded if you discard those cookies, but the website will still work. | frontend_lang (Odoo) cids (Odoo) odoo_no_push (Odoo) tz (Odoo) |
| Interaction History | Used to collect information about your interactions with the website, the pages you've seen, and any specific marketing campaign that brought you to the website. We may not be able to provide the best service to you if you reject those cookies, but the website will work. | im_livechat_history (Odoo) im_livechat_previous_operator_pid (Odoo) utm_campaign (Odoo) utm_source (Odoo) utm_medium (Odoo) fs_uid (FullStory) |
| Advertising & Marketing | Used to make advertising more engaging to users and more valuable to publishers and advertisers, such as providing more relevant ads when you visit other websites that display ads or to improve reporting on ad campaign performance. Note that some third-party services may install additional cookies on your browser in order identify you. You may opt out of a third-party's use of cookies by visiting the Network Advertising Initiative opt-out page. The website will still work if you reject or discard those cookies. | __gads (Google) __gac (Google) _fbp (Facebook) |
| Analytics | Understand how visitors engage with our website, via Google Analytics. Learn more about Analytics cookies and privacy information. The website will still work if you reject or discard those cookies. | _ga (Google) _gat (Google) _gid (Google) _gac_* (Google) |
You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. Each browser is a little different, so look at your browser's Help menu to learn the correct way to modify your cookies, or look at the links below.
- Chrome: https://support.google.com/chrome/answer/95647?hl=en
- Edge: https://support.microsoft.com/en-us/help/4468242/microsoft-edge-browsing-data-and-privacy
- Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
- Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac
- Opera: https://help.opera.com/en/latest/web-preferences/#cookies
We do not currently support Do Not Track signals, as there is no industry standard for compliance.
Policy Updates
We may update this Privacy Policy from time to time, in order to clarify it, to reflect any changes to our website, or to comply with legal obligations. The "Last Updated" mention at the top of the policy indicates the last revision, which is also the effective date of those changes. We give you access to archived versions of this policy, so you can review the changes.
Contacting Us
If you have are any question regarding this Privacy Policy, or any enquiry about your personal data,please reach out to the via the Contact form or contact us via email at or by post:
Innate Momentum
P.O Box 620
Black Rock
Victoria. 3191
ABN