This Privacy Policy explains how Odexy LLC (“we”, “us”) handles personal data in connection with Odexy: our website, our web and mobile applications, our APIs and integrations (together, the “Service”). It covers people who visit our website, people who sign up for or use the Service, and people whose data our customers put into it.
1. Two roles: when we decide, and when our customer decides
How we handle your data depends on why we have it.
Where our customer decides (we are a processor). An organization that uses Odexy — for example your employer, a company you applied to, a business you are a client of, or a company whose form you filled in — decides what data goes into its workspace and what it is used for. That data (“Customer Data”) belongs to our customer, who is the controller (or, under US state laws, the “business”). We process it only on their instructions, under our Data Processing Agreement. If your data is in someone else’s workspace, their privacy notice applies, and requests about that data should go to them. If you contact us, we will pass your request to them and help them answer it.
Where we decide (we are the controller). We decide how to handle the data we need to run our own business: accounts and sign-in, billing, security, support, our website, and communications with customers and prospects. This Privacy Policy is our notice for that data, and section 4 explains in general terms what Customer Data the Service processes.
2. Summary
- We collect what we need to provide the Service, keep it secure, bill for it and support you.
- We do not sell personal data, share it for cross-context behavioral advertising, or use Customer Data to train AI models.
- We use a small number of service providers, listed on our sub-processors page. Our main systems are hosted in the European Union.
- You can access, correct, export or delete your data, and object to some uses of it. Write to support@odexy.app.
3. Information we collect as controller
Account information. Your name, email address, password (stored only as a salted hash), profile photo if you add one, your role in a workspace, and preferences such as language, timezone and theme. If you sign in with Google, Microsoft, Apple, GitHub, LinkedIn, Facebook or Discord, we receive your name, email address and profile photo from that provider, as permitted by your settings with them. If your organization uses single sign-on (SAML, OIDC or LDAP), we receive the identity attributes your organization’s identity provider sends.
Security information. Two-factor authentication settings, passkeys (we store the public key, not your biometric data), trusted devices, and a record of your sign-in sessions, including IP address, browser and device type and approximate location derived from the IP address. We also compute a hash of browser characteristics to recognize devices you have used before.
Workspace and billing information. Your organization’s name, address, country, tax or VAT number, plan, seats, add-ons, invoices and payment history. Payment details are collected by our payment processors; we receive only the card brand, the last four digits and the expiry date, never the full card number or security code.
Activity records. The Service keeps an audit trail of actions taken in a workspace — who did what, when, and the details of the action — so that workspace administrators can review activity and we can investigate security events and errors. When you open something from the search box, we also keep a short list of what you opened with your account in that workspace, as a reference to the page, record or action and not a copy of it, so search can offer it again. That list is shown only to you. That you opened something from search is recorded in the workspace’s activity log like your other actions, which people in the workspace who can read that log may see, but the log does not say what you opened; the one exception is when an item you opened earlier can no longer be loaded, where the failed attempt to look it up is logged and identifies that item. We also record how features are used (for example, counts of actions and AI usage and its cost) to run, bill and improve the Service. And we record the steps a workspace takes towards a paid plan — opening the billing page, comparing and choosing plans, following a prompt to upgrade, starting a checkout and finishing or leaving it, and changing or cancelling a plan — with the person who took each step, so we can understand why customers do or do not buy and ask the workspace’s owners and administrators about it. If they answer, we keep the reason they chose and any note they add with the workspace’s record; they can change their answer from the same link for 60 days.
Support and communications. What you tell us when you contact support, reply to our emails or talk to our sales team, and your choices about receiving product updates.
Website visitors. Our web servers record the IP address, browser, pages requested and referring page, to deliver pages and protect against abuse.
Website and sign-up measurement. If you allow it in our cookie banner, we use Google Analytics on our website and sign-up pages to learn which pages are read and where sign-ups come from. Google then sets analytics cookies and receives your IP address, your browser and device type, the pages you view, the page you came from and the sign-up steps you complete — never your name, your email address or anything you type into a form. If you also allow advertising cookies, Google can tell us which of our ads led to a visit or a sign-up; it may not use this to show you ads. Until you choose, and if you decline, no analytics or advertising cookies are set: Google’s tag sends only cookieless signals that a page was viewed or a step completed, carrying a random number made for that visit and never stored on your device, which Google uses to estimate totals and cannot use to recognise you later. Google Analytics is never used inside the Service. Where we also measure traffic with Plausible Analytics, it sets no cookies, collects no personal identifiers and reports only aggregate statistics.
Referral partners. If you follow a partner’s referral link, we record which partner referred you. If you join our partner program, we collect your details, payout information and acceptance of the partner terms, including the IP address you accepted from.
Consent records. When you make a choice about cookies or other optional processing, we record the choice, when you made it and your browser type, so that we can respect it and show that we did. When you sign up for our newsletter, we record your email address, the page you signed up on, your browser type, and when you asked and when you confirmed from the email we send you.
4. Customer Data we process for our customers
What is in a workspace depends on the modules our customer uses and what they put in. It can include:
- People and work records: contacts, companies, deals, projects, tasks, documents, files, calendar events and comments.
- Communications: chat messages, email messages and attachments from mailboxes that users connect, voice and video call recordings and live captions where a user starts them, support tickets and support-bot conversations, and conversations with the AI assistant.
- Human resources and payroll: employee profiles, contact and emergency-contact details, dependents, job and compensation history, bank account and tax details, time and attendance records (which may include the location of a clock-in where the organization enables it), leave, performance reviews and documents.
- Recruitment: candidate profiles, CVs, application answers, interview notes and evaluations, offers and, where the organization asks for it, voluntary equal-opportunity self-identification.
- Contracts and e-signatures: documents and the evidence recorded with each signature — the time, IP address, approximate location and browser.
- Quotes and invoices: documents an organization sends its clients and, when a client opens one through its link, accepts or declines it, or reports a payment, the time, IP address and browser — and, for an acceptance, the name the client typed.
- Forms: answers submitted to an organization’s forms, with the submitter’s IP address and browser.
Some of this may be special category or sensitive data — for example health information, ethnicity, religion, disability, sexual orientation, government identifiers, precise location, or financial account numbers. Our customers decide whether to collect it and are responsible for having a lawful basis and giving notice. We process it only to provide the Service.
5. How we use personal data, and our lawful bases
Where the GDPR or the UK GDPR applies, we rely on the following lawful bases:
| Purpose | Data | Lawful basis |
|---|---|---|
| Creating and running your account and workspace, and providing the features you use | Account, workspace, activity | Performance of our contract with you or your organization; our legitimate interest in providing the Service to your organization’s users |
| Billing, taxes and fraud prevention | Workspace and billing | Performance of contract; legal obligation (tax and accounting records) |
| Keeping the Service and accounts secure, detecting abuse, and investigating incidents | Security, activity, website | Our legitimate interest in protecting our users, our customers and the Service |
| Providing support | Support, account, activity | Performance of contract; legitimate interest |
| Service announcements (security, billing, changes to terms) | Account | Performance of contract; legal obligation |
| Product updates and marketing to business contacts | Account, communications | Legitimate interest in telling customers about our products, or consent where the law requires it; you can opt out at any time |
| Our newsletter, for people who sign up on our website | Email address, consent records | Your consent, which you confirm from the email we send you and can withdraw at any time from any issue |
| Improving the Service, using usage statistics that do not reveal Customer Data | Activity, website | Legitimate interest in understanding and improving the Service |
| Measuring our website and sign-up pages with Google Analytics, and which of our ads lead to sign-ups | Website and sign-up measurement (section 3) | Your consent, given in the cookie banner and withdrawn at any time from Cookie settings at the bottom of every page. For the cookieless signals sent before you choose or after you decline, which store nothing on your device and cannot recognise you on a later visit, our legitimate interest in counting visits and sign-ups |
| Understanding purchase decisions, and asking workspace owners and administrators about them | Account, workspace and billing, activity | Legitimate interest in understanding why customers do or do not buy and in helping them to; you can object, and opt out of these emails, at any time |
| Attributing referrals and paying partners | Referral | Performance of the partner agreement; legitimate interest |
| Showing, on our offer pages, how many founding members have joined and that recent ones did — each only as a region or country and a time rounded to the hour, never who joined. A country is named only once at least five members are from it | Workspace (its country) and billing (when you paid or joined) | Legitimate interest in showing real demand for an offer truthfully; you can object (section 12) |
| Complying with law, responding to lawful requests, and establishing or defending legal claims | Any relevant data | Legal obligation; legitimate interest |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details and you can object (section 12). Providing your account details is necessary to use the Service; without them we cannot create an account.
6. AI features
Odexy includes AI features, such as an assistant that can answer questions and act within a workspace, summaries and drafts of emails, chats and proposals, translation, transcription, and help with recruitment and receipts.
- What is sent to AI providers. To answer a request, the Service sends the request, the context needed to answer it (such as the page you are on and recent related messages), and the records the assistant reads, to the model provider selected for that task. Providers are listed on our sub-processors page. Where an organization connects its own AI provider account, that provider processes the content under the organization’s own agreement with it.
- No training. We do not use Customer Data, prompts or outputs to train AI models, and we use model providers through their commercial APIs, whose terms do not allow the provider to train its models on that content. Providers may keep content for a limited period to detect abuse, as their terms describe.
- Permissions. The assistant can only see and do what the person using it is allowed to. It cannot perform actions we classify as dangerous or irreversible; a person must do those.
- Conversation history. Your conversations with the assistant are saved so you can reopen and continue them: what you asked, the answers, and the records shown with them. They are visible only to you; workspace administrators cannot open them. You can rename or delete any conversation at any time, and a deleted conversation is removed at once.
- Recruitment. Features that parse CVs or suggest how well a candidate fits a role are advisory. They are instructed to disregard protected characteristics, and they do not make decisions: people at the hiring organization do.
- Automated decisions. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects. Our customers must not use AI features to make such decisions without meaningful human review (Terms, section 6).
- Browser speech features. Dictation and live captions use your browser’s built-in speech recognition, which may send audio to your browser’s vendor (such as Google or Apple) under that vendor’s privacy policy.
7. Who receives personal data
We share personal data only as follows.
- Service providers (sub-processors) that host, secure and deliver the Service for us — hosting, payments, AI models, security checks and similar — under contracts that require them to protect it and use it only to serve us. The current list, with each provider’s purpose and location, is on our sub-processors page.
- Google, for website and sign-up measurement (section 3), on our website and sign-up pages only, and with cookies only if you allow them. Google receives no data from inside the Service.
- Services you or your organization choose to connect, such as a Google or Microsoft mailbox, a sign-in provider, a payment gateway, a storage bucket, a webhook or an automation. They receive what the connection requires, and their own privacy policies apply.
- Your organization. Workspace owners and administrators can see the activity and data within their workspace, including audit records of what users did.
- Our staff, where needed to provide support, keep the Service secure or comply with law. Support access to a workspace requires a stated reason, expires automatically, and is recorded in the audit trail.
- Professional advisers, such as lawyers, accountants and auditors, under a duty of confidentiality.
- Authorities, where we must by law, or where necessary to protect the rights, property or safety of our users, the public or ourselves. Where the law allows, we will tell the affected customer first.
- A buyer or successor if we are involved in a merger, acquisition or sale of assets, subject to this Privacy Policy.
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.
8. International transfers
Our production systems are hosted in the European Union. Odexy LLC is based in the United States, and some of our staff and sub-processors are in other countries, so personal data may be accessed from or transferred to countries whose data protection laws differ from yours.
Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on an appropriate safeguard: the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by an assessment of the transfer. You can ask for a copy of the relevant safeguard at support@odexy.app.
9. How long we keep personal data
We keep personal data only as long as we need it for the purposes above, and then delete it or make it anonymous.
| Data | How long |
|---|---|
| Account information | While your account exists. If you delete your account, sign-in data (sessions, passwords, passkeys, two-factor settings and linked sign-in accounts) is deleted 30 days after your request; during those 30 days you can cancel the deletion. |
| Sign-in session records | While your account exists, so that you and your administrators can review sign-in history. |
| Workspace data (Customer Data) | While the workspace exists — including after a subscription ends, when the workspace stays available read-only so it can be exported or reactivated. It is deleted within 30 days of a verified request from a workspace owner. We may also delete a workspace that has been inactive for an extended period, after warning its owners. |
| Audit records | At least for the audit history period of the workspace’s plan (from 90 days on the Free plan to 7 years on Enterprise), and until the workspace is deleted. If you delete your account, records of what you did in a workspace remain part of that workspace’s records without your account identifier, though they may still contain information you entered. |
| Items in the trash | Deleted files move to the trash and are permanently deleted after 30 days. Earlier versions of files are kept for 90 days. |
| Incomplete sign-ups | Deleted after 7 days. |
| Billing and tax records | As long as tax and accounting law requires, typically up to 7 years. |
| Support conversations | While the support relationship continues, then for as long as the workspace’s support settings require. |
| Conversations with the AI assistant | Until you delete them, or until your account or the workspace is deleted, whichever comes first. |
| Recently opened items in search | Up to 50 per person per workspace. Items not opened for 90 days are no longer shown, and are deleted the next time you open something new from search. All of them are deleted with your account or the workspace. |
| Web server and application logs | For a short period on a rolling basis, unless needed to investigate a security incident. |
| Backups | Backups are overwritten on a rolling basis and kept for up to 30 days. Deleted data leaves our backups when they expire. |
| Marketing contacts | Until you unsubscribe or object, and then only a suppression record so we do not contact you again. |
| Newsletter sign-ups that are never confirmed | Deleted 7 days after the confirmation email, when its link stops working. |
| Purchase-journey records, and answers about purchase decisions | While the workspace exists, and deleted with it. If you delete your account, they no longer identify you. |
| Website and sign-up measurement (Google Analytics) | Google keeps measurement tied to the analytics cookie for 14 months, then deletes it. The analytics cookies expire up to 2 years after your last visit; clearing them, or withdrawing consent, ends their use from then on. |
Within a workspace, administrators can set shorter retention for some content, such as chat channels and support tickets.
10. How we protect personal data
We encrypt data in transit with TLS, encrypt sensitive credentials (such as connected-account tokens and provider keys) at rest, restrict access by role, record access in the audit trail, and offer two-factor authentication, passkeys and single sign-on. Our Security page describes the measures in more detail. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires, and notify affected customers without undue delay.
11. Cookies and similar technologies
We use a small number of cookies and browser storage. Inside the Service, none are used for analytics or advertising. On our website and sign-up pages, Google Analytics and advertising cookies are set only if you allow them in our cookie banner, and nothing is ever used to show you personalized ads.
| Name | Type | Purpose | Duration |
|---|---|---|---|
helios.session_token and related sign-in cookies | Strictly necessary | Keeps you signed in and protects your session | 30 days, renewed while you use the Service (shorter where your organization requires) |
helios_email_oauth_state | Strictly necessary | Protects the connection of a mailbox against forged requests | For the connection only |
helios_surface | Strictly necessary | Routes public pages, such as forms and signing links, correctly | 1 day |
sidebar_state | Functional | Remembers whether your sidebar is open | 7 days |
helios_partner_ref | Functional | Records which partner referred you, so they can be credited | 90 days |
| Browser storage (local storage) | Functional | Remembers your theme, language, unsent message drafts, recent searches and your cookie choices on this device | Until you clear it |
_ga and _ga_… (website and sign-up pages) | Analytics — only if you allow it | Google Analytics: tells visits apart, so pages and sign-ups are counted once per visitor | Up to 2 years from your last visit |
_gcl_… (website and sign-up pages) | Advertising — only if you allow it, and only while we advertise with Google | Google Ads: connects a visit or sign-up to the ad that led to it | 90 days |
The application shows a cookie banner where you can accept or refuse non-essential categories, and change your choice at any time. On the website, we store your theme preference in your browser.
Our website and sign-up pages ask before setting any analytics or advertising cookie: Accept all, Reject all, or Choose each category; nothing is pre-selected, and refusing is as easy as accepting. Your answer is kept in your browser so you are not asked again, and recorded with a random identifier for this browser so that we can show we respected it. You can change it at any time from Cookie settings at the bottom of every page. Until you choose, and if you decline, Google’s tag stays on the page in a restricted mode (Google Consent Mode): it sets no cookie and sends only signals that a page was viewed or a step completed, with a random number made for that visit and never stored, together with your IP address and browser type, which every web request carries. Plausible Analytics, where used, sets no cookies (section 3).
The application loads fonts from Google Fonts, which means your browser sends your IP address to Google when a page loads. We do not send Google any other information about you.
12. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data;
- export data you provided in a portable format;
- restrict or object to processing, including processing based on legitimate interests and direct marketing;
- withdraw consent where we rely on it, without affecting processing before withdrawal;
- not be subject to a decision based solely on automated processing with legal or similarly significant effects;
- opt out of sale, sharing, targeted advertising or profiling (we do none of these);
- not be discriminated or retaliated against for exercising your rights;
- complain to a supervisory authority.
How to exercise them. You can update most account information in your settings, and delete your account from your security settings. For anything else, write to support@odexy.app. We will confirm your identity before acting — normally by asking you to write from the email address on your account — and respond within one month (45 days where US state law applies), extendable as the law permits; we will tell you if we need longer. You may use an authorized agent where the law allows; we will ask for proof of their authority.
If your data is in a customer’s workspace, that organization controls it. Please contact them; if you contact us, we will forward your request.
If we decline your request, we will explain why. Where US state law gives you a right to appeal, reply to our decision with “Appeal” in the subject and we will review it within the period the law sets. If you are not satisfied, you can complain to your data protection authority — in the European Union, your local supervisory authority; in the United Kingdom, the Information Commissioner’s Office; in India, the Data Protection Board; in Brazil, the ANPD; or your state Attorney General in the United States. We would appreciate the chance to resolve a complaint first: write to support@odexy.app and we will acknowledge it within 30 days.
13. Children
The Service is for business use by adults and is not directed to children. We do not knowingly collect personal data from anyone under 18 as a user. If you believe a child has created an account, contact support@odexy.app and we will delete it. Our customers’ workspaces may contain data about minors — for example an employee’s dependents or a young applicant — and our customers are responsible for the lawful basis and any parental consent the law requires.
14. Regional information
European Economic Area, United Kingdom and Switzerland
The controller of the data described in section 3 is Odexy LLC, New York, NY, United States.
We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR. You can reach us directly at support@odexy.app, and we respond to requests from those regions on the same terms.
We have not designated a Data Protection Officer. Privacy questions and requests are handled directly by our team at support@odexy.app.
United States: California and other states
In the past 12 months we have collected the following categories of personal information described in the California Consumer Privacy Act: identifiers (such as name, email and IP address); customer records (such as billing address); commercial information (plans and purchases); internet or network activity (sign-in sessions, activity records and website visits); approximate geolocation derived from IP addresses; professional information (your organization and role); and sensitive personal information limited to account sign-in credentials. We collect it from you, from your organization, from sign-in providers you choose, and automatically from your use of the Service, for the purposes in section 5. We disclose it for business purposes to the categories of recipients in section 7, keep it for the periods in section 9, and use sensitive personal information only to provide the Service and keep it secure. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
For Customer Data, we act as a service provider (or processor) to our customers, and requests should go to them.
India
Where the Digital Personal Data Protection Act applies, you can exercise your rights, withdraw consent (as easily as you gave it) and raise a grievance by writing to support@odexy.app, which is also our contact for data protection questions. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Brazil
Where the LGPD applies, you can exercise the rights in its Article 18 by writing to support@odexy.app, which is also how to reach the person responsible for data protection on our behalf. You can also complain to the ANPD.
15. Changes to this Privacy Policy
We will update this Privacy Policy when our practices change, and review it at least every 12 months. The date at the top shows when it last changed. If we make a material change — for example a new purpose or a new category of recipient — we will tell account holders by email or in the Service before the change takes effect. We will never begin using existing data in a materially different way, such as for AI training, without the notice and, where required, the consent the law requires.
16. Contact us
- Company: Odexy LLC
- Address: New York, NY, United States
- Privacy requests: support@odexy.app
- Legal notices: support@odexy.app
- Support: support@odexy.app