Privacy Notice

1. Identity and address of the controller

DM Software, with address at Calle Nayarit 2901, C.P. 36057, Ciudad de México, México, is the controller of the processing of your personal data, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, publicada el 20 de marzo de 2025) and any other applicable provisions.

The service is operated under the iNoddo brand, Federal Taxpayer Registry (RFC) XAXX010101000.

For any privacy matter, including the exercise of your rights, you may contact our Personal Data Department at [email protected].

2. Who this notice is addressed to

This notice addresses three groups of people, and it does not say the same thing to all of them:

• People who hold an account and people who take part in a workspace as members. As regards their data, we are the controller, and that is what clause 3 and clauses 6 onwards describe.
• People who visit the public site without holding an account. As regards browsing and measurement data, we are the controller: see clauses 10, 11 and 12.
• People who appear in a customer's Odoo instance, complete one of their portals or job forms, answer a Discovery, read a document a customer shares with them, by link or by inviting them by email, or watch the video of a demo that a customer shares by link. As regards that data, the controller is the customer using the Service and we are merely their processor: see clauses 4 and 5.

3. What personal data we process

As an account holder or a member of a workspace, we process:

• Identification and contact data: name, email address and, if you provide them, company, department and job title.
• Authentication data: password stored in encrypted, irreversible form, and data on your open sessions.
• Credentials for connecting to your Odoo instance: address, database, user and key or password, stored encrypted.
• If you connect GitHub to use the Developer: the account or organisation where you installed the iNoddo application, the GitHub user who authorised it, and the repositories you link with their branches. Access is granted by that application with short-lived permissions; we do not store any access token in our database.
• Usage data: technical logs, IP address, browser type, pages visited, actions within the application and Credit consumption.
• Campaign origin data, if you arrived from an advertisement and authorised measurement: the click identifier the search engine or social network appends to the address, and the campaign parameters. These serve to identify which advertisement worked, not to profile you.
• Billing data: that needed to issue receipts, including your tax address. Your card details are processed directly by the payment processor; we neither store nor see them.
• Content you enter: your questions, instructions and conversations within the Service, the files you attach and the documents you create or edit (their text, the images you upload and their versions, with who made each one), and the videos of the demos you decide to share, with their subtitles and chapters. If that content includes third parties' data, we process it as the customer's processor, in accordance with clause 4.
• Communications with us: support messages, bug reports and whatever you include in them.
• Your voice, only if you activate Conversation mode: see clause 8.

Sensitive personal data. We do not request sensitive data and it is not necessary to provide the Service to you, with one exception worth stating plainly: the voice captured in Conversation mode may be regarded as biometric data and therefore as sensitive. That processing is described separately in clause 8, and occurs only if you activate that mode.

Apart from that case, we ask that you not enter sensitive personal data — concerning health, ethnic origin, beliefs, trade union membership, sexual life and the like — whether your own or third parties', into conversations, into the files you attach, into the portals you publish or into the Discoveries you share.

We do not collect your data from sources other than yourself, except for the data provided by whoever invites you to a workspace so that the invitation can be sent to you.

4. Third-party data we process on a customer's behalf

When a customer uses the Service, we process personal data of third parties that is neither theirs nor ours: data about their customers, their suppliers, their employees or their candidates. This happens, in particular, in the following ways:

• data already residing in their Odoo instance, which the Service queries or modifies on their instruction, and the copies of it that remain in the operations record described in clause 5;
• data captured by outside persons in the portals and job sites the customer publishes. From portals we keep the text of each submission, without the files, and the email address of whoever requests access, even if it does not appear in their instance; from job sites, the name, email address and telephone number of the applicant and a hash of their IP address, which does not store the address as such but is still personal data. We keep them so that the customer can evidence what was received, and so that we can diagnose why a record could not be created and protect their portals against abusive submissions;
• data written by those who answer a Discovery: their name, their email address, their department, their job title and their answers about how they work, which the Service processes with an artificial intelligence model to suggest follow-up questions to them and to draft the work plan, where their answers may be quoted with their name, their job title or the part of their email address before the @ sign; data of those who read that plan: their name, their email address, their comments (which the Service also processes with artificial intelligence to correct it) and, if they validate it, their name and the date; and, for both, a log of accesses with a hash of their IP address;
• data of those who read a document the customer shares outside their workspace: of the people they invite by email, their email address and the access codes we send them, which we store transformed into a hash and which expire after a few minutes; and, of those who open it or try to, a log of accesses with a hash of their IP address. We use them to grant and withdraw access to the document, to protect it against abusive access attempts and to show the person who shared it and the Account Owner how many times and when each link was last opened, and when each invited person last opened the document;
• data that appears in the video of a demo the customer shares: what the screen of their Odoo instance showed (names, amounts and other data about their customers, employees or suppliers), with the narration and subtitles; and, from those who open it, our web server's technical logs: their IP address, their browser, the address they request (which includes the link) and the time, which we keep for security for the retention period of technical logs;
• data contained in the code of the repositories the customer links, which the Developer reads and modifies on their instruction, such as that in a module's data files;
• the email address (and the name, where we have it) of the people the customer writes to through the Service: the recipients of their reports, the contacts they write to from Panels, the people they invite to a Discovery and those to whom they send its PDF plan;
• data the customer and their members include in their requests, conversations and documents, in the files they attach or in what they dictate in Conversation mode, and data the Service takes from their instance to show it in replies, dashboards, alerts, the brief and reports.

As regards all that data, the data controller is the customer and we act as processor: we process it solely on their behalf, in accordance with their instructions — those described in clause 5 — and for the sole purpose of providing the Service to them. We do not use it for purposes of our own: we do not sell it, we do not train models on it and we do not build profiles or statistics from its content. We disclose it only to the customer themselves and their members (including former members, as regards what they produced while members, until the customer asks us to delete it); to the processors in clause 10; to the recipients the customer designates, namely their own Odoo instance, their GitHub repository, the people they write to through the Service, the people to whom they give access to their portals, who see the records of their instance that the portal shows them, and the people with whom they share a document (anyone who has the link, if they share it by public link) or a demo video (anyone who has the link), who see what they contain; to a competent authority that requires it on well-founded and reasoned grounds, informing the customer where the law allows; and, if we assign the contract in accordance with clause 27 of the terms and conditions, to whoever succeeds us in providing the Service, who will be bound by these same obligations.

As processor we undertake to: process that data only in accordance with the customer's instructions; not disclose it outside the cases in the previous paragraph; maintain confidentiality; apply the security measures described in this notice; and, on termination of the relationship, delete it unless a legal obligation requires its retention.

It is for the customer, as controller, to have a lawful basis and to make their own privacy notice available to those persons — including those who complete a portal, a job form or a Discovery — and to handle the rights they exercise before them. If any of those persons writes to us directly, we will direct them to the customer and, if what they tell us allows us to identify which customer it is, we will pass their request on to that customer without delay. We will not search our customers' instances for their data in order to find out. If the customer cannot correct or delete a specific person's data from the application, such as a Discovery participant's answers, they can ask us to do it and we will.

Portals and Discoveries are tools for capturing transactions and describing working processes. They are not intended for sensitive personal data, and we ask customers not to request it in the questions they add or allow it to be entered in the answers: if a portal or a Discovery touches on health, payroll or the performance of identified individuals, that decision and its consequences belong to the customer as controller.

One nuance of the law in force is worth noting: since 2025, the definition of controller also reaches those who process data without deciding on the processing, so that a processor may become subject to obligations of its own. That does not alter the allocation of roles agreed with the customer or the instructions under which we process their information.

5. What the Service does in your systems on your behalf

This clause is addressed to account holders. In short: the Service reads your Odoo to answer you and for the jobs you schedule; it writes to it when you run an action, when a plan is approved or when someone submits one of your public forms; it writes code only on its own branches of your GitHub repositories and never merges it by itself; it sends the emails you configure; and part of that work keeps running even if you close the application. We set this out in detail because many of those operations process third parties' personal data on your behalf (clause 4). If your data is in the Odoo of one of our customers, it is that customer who decides about it: contact them. Where this clause refers to you in relation to the instance's data, it means the customer (in a workspace, its Account Owner), who is the controller; members act on their behalf.

The Service acts on an instruction from you or from a member of your workspace, and also performs the ancillary operations those instructions require and which this clause describes: technical reads, retries, saving unfinished work and cleaning up what it created itself. The following count as instructions:

• what you configure: the instance you connect and the Odoo user you connect it with, the sections each member can access, the portals, job sites and Discoveries you publish or share, the alerts, the brief and the scheduled reports with their recipients, and the repositories you link;
• what you request: each action you run in the application and each request you write;
• what is approved: an Implementer plan; the master plan of a phased implementation, whose phases, objectives and Credit ceiling are the instruction for each step the Service plans and executes within them; and each request given to the Developer.

You set the scope. In your instance, the Service acts with the permissions of the Odoo user you choose: it can read and write the same as that user, and nothing more; if that user is an administrator, the scope is unrestricted. We recommend a dedicated user with the minimum permissions required by the features you use. Everything you and your members do through the Service appears in Odoo as done by that user.

On GitHub, the iNoddo application requests permission to read and write code and pull requests, and to read the results of builds and checks, in the repositories you choose when installing it; if you choose all the account's repositories, the permission covers all of them, including those you create later. The Service reads and writes code only in the repositories you link to a connection; of the others it only consults their name and branches, so that you can choose which one to link, and, if you install it in an organisation, it checks with your authorisation that you administer them. GitHub sends it notifications about all those repositories: the Service uses only those concerning the installation, the linked repositories and its own work, and of each notification it keeps only its identifier, its type and the installation, for thirty days.

In your Odoo instance, the Service:

• Reads. The Analyst, dashboards, Panels, the CRM, Support, Recruitment and Collections applications, the instance explorer, portals and scheduled jobs query your instance; the Analyst does nothing but query. In addition, the Service performs technical reads: when connecting it checks the version and the credentials (and, if you do not specify the database, it queries which databases exist on the server), and afterwards it queries the installed modules, the active languages, the companies and their currency, the time zone and the structure of the models and fields of your instance.
• Writes when you run an action. In the CRM, Support, Recruitment and Collections applications, each action takes effect immediately on the records you choose (currently, up to two hundred at a time in bulk actions), without a prior plan or restore point. Some cannot be undone in Odoo, such as merging opportunities, which deletes the ones absorbed, and others have knock-on effects: closing a vacancy archives its candidates, who do not return when it is reopened, and hiring creates an employee. The same applies when you publish a dashboard to Odoo and when you test a portal, which creates, modifies and deletes test records in the test instance you linked.
• In the site builder, it stores in your instance, as a public file, each image you upload or that its assistant takes from a stock image library; it creates a password-protected preview page; it publishes your pages only when you give the instruction to publish them; and, when you ask it to, it applies its palette to the theme or sets your website's logo, which immediately changes all its pages, including those the Service did not create.
• Writes after an approval. The Implementer executes the plans that you or a member approve. In a phased implementation, the master plan, with its phases and objectives, is approved only once; from then on, and within a Credit ceiling, the Service plans, executes and verifies each phase, with a limited number of correction rounds, without asking for approval step by step. Before executing each plan (the phase's plan and those of its corrections) it reviews it with automatic rules and stops to consult you if it finds steps on our list of sensitive steps (those that change groups, permissions or access rules, or a user's password, login email or companies; store code, automations, scheduled tasks or templates that Odoo executes; create or change fields, views, models or website pages; or directly change system parameters or your instance's email settings, or uninstall modules), steps which, according to the cases we have catalogued, cause Odoo to delete or regenerate existing configuration, or elements it could not check. It also stops when it needs an answer from you, when it cannot make progress and when it reaches its Credit ceiling. Those rules do not cover everything Odoo can do: the other steps (among them installing modules, changing the settings on Odoo's Settings screen or the company's details, and invoicing, registering payments, posting, validating or confirming documents, which depending on your configuration may generate tax receipts) are executed without further confirmation, and that is why approving the master plan authorises all of them.
• Keeps what it needs to attempt a reversal. Before creating or modifying records it notes what it creates and the values it replaces, except large files; if it cannot read those values, the step is executed anyway and cannot be reverted. For module installations and for actions equivalent to clicking a button or completing a wizard in Odoo, it keeps nothing that would allow them to be undone. Reverting deletes what was created (or archives it if Odoo does not allow it to be deleted) and restores the previous values even if someone has changed them since. The limits of reversal are described in clause 7 of the terms and conditions.
• Writes when a third party submits a form. Each submission to one of your portals or job sites creates records in your instance, with any files attached to it, and runs the actions the portal has configured (such as submitting an expense for approval), without any action on your part. If Odoo rejects a submission, it is not retried automatically. A portal's lookup screens read your instance and show each identified person the records that concern them.
• Operates on schedule. Alerts, the brief and reports only read your instance, on the dates and at the times you configure. In addition, for as long as the connection exists, the Service deletes the preview pages it created on your website seven days after their last update; if you delete the connection first, they remain on your site and you will have to delete them from Odoo.

In addition, every write triggers your instance's own logic: its automations, its cascading deletions (when a record is deleted or changed, Odoo deletes or recreates other records that depend on it) and the emails Odoo sends automatically, such as the invitation to a new user or to a meeting, the notice to a record's followers or the email set up on a stage. Those emails are sent by your instance through your mail server and, once sent, cannot be recalled.

In your GitHub repositories, the Developer:

• reads the linked repository (its structure and the code of the Odoo modules) and the structure of your instance (its version, the installed modules, the fields of each model and the external identifiers), without reading your business data or writing to your instance;
• saves its changes in commits (each commit is a batch of changes recorded in the repository's history) on an iNoddo branch of its own (inoddo/…), a line of work separate from yours; increases the version number stated in the manifest (the file that describes each module) of the existing modules it modifies; and opens against your testing branch (or, if you declared none, against your production branch) a pull request (PR), that is, the proposal you review before incorporating it, whose description it keeps up to date: as a draft or, where your repository does not support drafts, as a regular PR marked «[Borrador]» (Spanish for “Draft”) in its title, which can be merged like any other;
• if the work stops halfway (because it needs an answer from you, the request's Credit ceiling is reached or your balance runs out, the limit of work rounds is reached or a call fails during the work), it tries to push what it had prepared as a commit titled «Avance guardado por iNoddo al detenerse» (progress saved by iNoddo on stopping), provided it passes the automatic checks; that commit goes into the PR if it was already open, and a PR containing unfinished progress is not ready to be merged. It pushes nothing if you cancel the request or when our servers restart;
• receives from GitHub the results of the builds and automated checks your systems run on its commits, and notifications about the installation, the repositories and the PR.

The Developer does not merge pull requests and does not write to the branches you declare as production or testing, nor to protected branches. Each commit it pushes may, however, trigger whatever you have connected to your repository: on Odoo.sh a new branch creates a development build, and your continuous integration processes (the automated tests and deployments you have set up) run. Unlinking a repository prevents new requests and causes those left halfway (queued, paused or awaiting your answer) to end as failed the next time they try to continue; it does not stop the run in progress at that moment, which may still push commits and open the PR, it does not withdraw the permission and it does not delete branches or PRs. To stop a request, cancel it: it stops once the current step is finished, and whatever it has already pushed stays on the branch. To withdraw access, uninstall the iNoddo application on GitHub or remove the repository from it; closing your account with the Service does not withdraw it either.

By email, as a result of what you do in the Service, the following go out to people other than you:

• from iNoddo, using our sender address: scheduled reports, to the addresses you specify; the emails you send from Panels to the contacts in your instance; access links to your portals; the invitations, reminders, closing requests and PDF plan of a Discovery; invitations to read a document and the access codes sent to the people you invite; and invitations to your workspace;
• from your Odoo instance, through your mail server: the messages you post on a record from Collections, CRM, Support and Recruitment, which Odoo sends to the contact and to the record's followers; the notice to the person to whom you assign a ticket or an activity; and invitations to meetings and interviews.

Part of this work continues while you are not there. An internal process checks frequently (currently, every minute) what is pending: it runs scheduled jobs and starts approved phased implementations and Developer requests. If a phased implementation or a Developer request is interrupted by a failure or restart of our servers, the Service resumes it automatically from the last safe point, with a limited number of retries; an implementation that was interrupted while applying a plan waits, however, for you to decide. If an alert, a brief or a scheduled report fails, that run is lost and is attempted again at its next scheduled time. A plan that is not phased keeps executing even if you close the tab, but its final check is only carried out with the application open. When an implementation or a request needs a decision from you, fails, stops or finishes, you will see it in the application's notifications and, in most cases, the person who started it will also receive an email; that email is a courtesy that may not arrive, so do not rely on it alone. While an implementation or a request is running you can cancel it from the application; cancelling does not undo what has already been applied.

We keep a record of implementations and Developer requests: the request and the conversation, the approved plan, who approved it and when, each step with the values it wrote and its outcome, the previous values of what it modified and the subsequent verification. For portals and job sites we keep what is described in clause 4; for reports, the file generated; and for each email sent with our sender address, the recipient's address, the subject and whether it could be sent. We do not keep a record of our own of the actions you run in the CRM, Support, Recruitment and Collections applications: they remain in your instance's history. The record of implementations and requests contains data from your instance, including third parties' personal data. We use it to show you what happened, to revert where possible, to diagnose faults and to evidence what occurred in the face of a claim or before an authority. Within your workspace, it is visible to the person who started each operation (whoever approved the plan, made the request, created the portal or scheduled the report); the Account Owner cannot see from the application the record of their members' operations, but if they need it as controller (to respond to a data subject, an authority or a claim) they can write to us and we will provide it. If the person who started it shares a document made from it with other members, or with the Account Owner, they see in it, read-only and in summary form, the conversation or implementation it came from, with its phases and the latest entries of its record, provided they have been granted that section and access to all Odoo apps. Our authorised staff consult it only when needed to provide you with support, investigate a fault affecting your account or respond to a claim concerning that operation, and they do not operate in your instance from it. How long it is kept is stated in clause 16.

What is for you to do, as controller of the data in your instance: choose the Odoo user and its permissions; review plans before approving them and code before merging it; keep your own backups, because we do not back up your instance; decide whom the emails you configure are addressed to; and have a lawful basis for processing third parties' data and state it in your own privacy notice. Our tools are not designed for sensitive personal data and do not collect on your behalf the consent the law requires to process it: if you need it, obtain it yourself, outside the Service.

If we notice that an instruction appears contrary to data protection rules or to the terms and conditions, we may inform you and decline to carry it out until you clarify it. The Service also applies automatic limits (on the number of records in each step, on the operations it accepts and on the code before each commit) and rejects whatever exceeds them; those limits reduce risk, but they do not replace your review.

If a security breach affects data we process on your behalf, we will notify you without undue delay, with the information available to us (what happened, what data was compromised, what measures we took and what we recommend), so that you can inform the data subjects, and we will cooperate with you to a reasonable extent.

The allocation of responsibilities between you and us for these operations, the limits of our liability and the indemnities are governed by the terms and conditions, in particular by clauses 5, 6, 7, 9, 10, 19, 23 and 24. None of this extends or reduces the rights the law grants you or the persons whose data we process on your behalf.

6. What we use your data for

Purposes that do not require your consent, being necessary for the existence and performance of the legal relationship we maintain with you:

• creating and administering your account, authenticating you and managing your workspace and its members;
• connecting to your Odoo instance and running the queries and operations you request, approve or configure, on the terms of clause 5;
• if you use the Developer, reading the GitHub repositories you link and writing to them, on your instruction, only on iNoddo's own branches and in pull requests (PRs) for your review;
• storing, editing, exporting and sharing the documents you create, and sending the invitations and access codes to the people you share them with;
• storing the demo videos you share and showing them to anyone who has the link, until you stop sharing them;
• processing your payments, tracking your Credit consumption and issuing tax receipts;
• sending you operational communications: brief, alerts, reports, service notices and plan changes;
• providing support, handling incidents, investigating faults and preventing fraud and abuse;
• keeping logs for the security of the Service and to evidence what occurred in the face of a claim;
• complying with legal, accounting and tax obligations, and responding to requirements of a competent authority.

Purposes that do require your consent and which you may refuse or withdraw without this affecting your use of the Service:

• sending you commercial communications about product news, content and promotions;
• measuring the effectiveness of our advertising and attributing sign-ups to the campaign that generated them, on the terms of clause 11;
• producing aggregated and de-identified statistics to improve the Service;
• processing your voice in Conversation mode, in accordance with clause 8.

If you do not wish your data to be used for any of the purposes in this second group, or you wish to withdraw consent you have given, write to us at [email protected] saying so; that notice is enough, it is free of charge and you need not give reasons. In the case of measurement and of voice, you can also withdraw it from the interface itself.

7. Processing by artificial intelligence models

To generate replies, the Service transmits to language model providers the instructions you write and the context needed, which may include fragments of data from your Odoo instance, the files you attach, the answers and comments of those who complete or read a Discovery, the text of a document when you ask the AI for help within it (and, if you ask, the conversation or implementation it came from, including what your instance returned there) and, if you use the Developer, the code of the repositories you link. Those files are hosted on the model provider's infrastructure, not on ours.

Of the Developer's work we keep what is needed to show it to you and to evidence it: the request, your answers, the model's questions, the texts it writes on finishing — summary, how to test it and closing note, which may quote fragments of the code —, the link to the pull request, the status of the builds and, for each commit, its subject, the paths and fingerprints (hashes) of the files and the warnings from the automatic checks, plus a log of steps without their content. We do not keep the repository files: they live in your repository.

Those providers act as processors. We have contracted and configured with them the prohibition on retaining content for their own purposes and on training models with it.

What we cannot promise you, and would rather say: zero retention. None of the providers of the models we use offers it today across their whole range, so they may retain content for short periods for security, abuse detection and compliance purposes, in accordance with their own policies.

The current providers are listed in clause 10. If your organisation needs the contractual detail in writing, or needs processing restricted to a specific Tier, write to us at [email protected].

8. Conversation mode: processing of your voice

If you activate Conversation mode, the Service captures the audio from your microphone, transcribes it into text and synthesises the reply as speech, through a specialist provider.

We process your voice for the sole purpose of understanding what you say and replying to you. We do not use it to identify you or to verify your identity, we neither build nor store a voice pattern or voiceprint, and we do not use it to train models. The audio is processed during the session and we do not retain it afterwards; the transcript follows the same processing and the same retention as the rest of your conversations.

Because voice may be regarded as biometric data, this processing is based on your express consent, which you give by activating the mode and may withdraw at any time by ceasing to use it or by revoking it in writing. Not activating it has no effect whatsoever on the rest of the Service.

If other people are present while it is used, it is for whoever activates it to inform them and obtain their consent beforehand.

9. Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We do not assess your creditworthiness, we do not score you and we do not build profiles for that purpose.

The Service does generate proposals automatically — change plans, code, text, reports — and carries out operations in your systems, but on an instruction from you or from a member of your workspace, on the terms of clause 5. A phased implementation and a Developer request are approved once, and the Service then executes their steps without asking for approval of each one; the decision to approve them, and the decision to merge the code, remains yours.

10. Processors, sub-processors and transfers

To operate the Service we rely on the following processors, which process data on our behalf and under our instructions. Communications of data to processors do not require your consent.

• IONOS — Hosting of the application, the database and the files stored in the Service, such as the images and PDFs of documents and the demo videos you share. Processing in the United States.
• Anthropic — Processing of the prompts and context needed to generate replies, and storage of the files you attach (Pro tier). Processing in the United States.
• OpenRouter, routing to GMICloud — Processing of the prompts and context of the Standard tier, with data collection and training denied by configuration. Processing in the United States.
• ElevenLabs — Speech synthesis and transcription, only if you use Conversation mode. Processing in the United States.
• Stripe — Payment and subscription processing. Processing in the United States.
• Mailgun — Delivery of the Service's emails, both those we send you and those you send to third parties through it, and receipt of replies to support tickets. Processing in the United States.
• Cloudflare — Content delivery and protection network for the site: traffic between your browser and the Service passes through its network, which protects the Service against attacks. Processing in the United States and the data centre of its network closest to whoever connects.

All of them process data in the United States (Cloudflare's network, in addition, in the data centre closest to whoever connects, which may be in Mexico or elsewhere), so that use of the Service involves communicating data outside Mexico, mainly to the United States. Since these are processors, that communication is a remisión (a disclosure to a processor) and does not require your consent; the data remains subject to the purposes and limits described in this notice, and we have entered into the contractual commitments that underpin it.

One nuance about the payment processor: in addition to processing data on our behalf, it acts as a controller in its own right in order to prevent fraud and to comply with its own financial and regulatory obligations. That processing is governed by its own privacy notice.

We may change processors or bring in new ones. The current list is always the one published in this notice, and we will give reasonable prior notice of additions to the customers whose processing is affected.

If you take part as a member in another person's workspace, its Account Owner sees your email address, the sections they give you access to, your Credit consumption by feature and the links and invitations with which you share documents outside the workspace (with the document's title, each invitee's email address and when it was opened) and the demo videos you share by link, which they can withdraw: this disclosure is necessary for your relationship with them. If you share a document with other members, they will see your name and what the document contains and, if they have been granted the section it comes from and access to all Odoo apps, also the conversation or implementation it came from, as it appears on screen; anyone who can edit it can ask the AI to read it. People outside with whom you share it see the name by which the Account Owner identifies you in the team, if they gave you one, including in the invitation email; and anyone who opens the link to a demo video you share sees that same name.

We do not sell your personal data and we do not share it for consideration. Beyond what is described in this clause and the next, we do not disclose it to third parties; we will do so only before a competent authority where there is a well-founded and reasoned requirement, or in the context of a corporate transaction transferring the business, informing you of it.

11. Measurement and advertising

If you authorise it, we share measurement data with the following recipients in order to know which advertisements generate sign-ups. They appear in a clause separate from the previous one because their role is different: they do not process the data solely on our behalf, they also use it for their own purposes. Without your consent they are not activated and nothing is sent to them.

• Google (Analytics 4 and Google Ads) — Measuring use of the public site and which ads generate sign-ups, including the conversion event of an account created. Processing in the United States.
• Meta (Facebook and Instagram) — Measuring which ads generate sign-ups. To attribute a conversion, your email address transformed with SHA-256 (a hash), your IP address and your browser details are sent: the email address does not travel in readable form, but Meta uses it to recognise you among its users. Processing in the United States.

This happens only on the public site and on the sign-in screens, never inside the application: data from your Odoo instance, your conversations and your files are never sent to any advertising recipient under any circumstances.

You may withdraw your consent whenever you wish from the "Measurement cookies" link in the page footer. Once withdrawn, no further data is sent.

12. Cookies and similar technologies

Strictly necessary cookies: they keep your session signed in and remember interface preferences, such as the state of the menu or the theme; and, if you open a document someone has shared with you, they keep your reading session open for twelve hours, so that you do not have to open the link or enter the password or the code again on each visit. They cannot be disabled without rendering the Service unusable, and they are not used for advertising. In addition, if you leave a document you are editing with changes that were not saved (for example, because the connection dropped), your browser keeps them on your device to upload them when you open it again, and deletes them as soon as they are saved or if you no longer have access to the document.

Measurement and advertising cookies: only on the public site and on the sign-in screens, and only if you authorise them. They serve to identify which advertisement or which search brought someone who went on to create an account. They are set by Google and Meta, and we additionally store a first-party cookie with the advertisement click identifier and the campaign parameters of the address you arrived with.

Inside the application there are no third-party advertising or measurement cookies at all.

How this is decided: if you browse from the European Economic Area, the United Kingdom or Switzerland, no measurement is activated until you expressly accept it. From other countries it is activated by default and you can disable it whenever you wish. In both cases, the "Measurement cookies" link in the page footer lets you change the decision, and once withdrawn no further data is sent.

You can block cookies from your browser, but if you do, signing in will stop working.

13. Your ARCO rights

You have the right to Access your personal data, to Rectify it where it is inaccurate or incomplete, to Cancel it where you consider it is not required for the stated purposes, and to Object to its processing for specific purposes. These are known in Mexico as ARCO rights.

To exercise them, send a request to [email protected] including: your name and a means of communicating our reply to you; a document evidencing your identity or the legal representation of whoever acts on your behalf; a clear description of the data and of the right you are exercising; and any element that makes the data easier to locate. If the request is for rectification, also state the correction and attach supporting material.

We will answer your request within a maximum of twenty (20) days, which we may extend once by an equal period where the circumstances of the case justify it, informing you of the reason. Where the request is upheld, we will give effect to it within the fifteen (15) days following communication of our reply.

Exercising these rights is free of charge, without prejudice to justified shipping or reproduction costs for media where applicable. Unless you tell us otherwise, we will reply to the email address you write from.

We may refuse access, rectification, cancellation or objection in the cases provided by law; if so, we will tell you with reasons.

14. Withdrawal of consent

You may withdraw the consent you have given us by writing to [email protected], following the same procedure as for ARCO rights. We will confirm the withdrawal and stop processing the data for the purpose withdrawn.

Please bear in mind that, in certain cases, withdrawal may prevent the continuation of the Service or be limited by legal obligations requiring us to retain certain information.

15. Limiting use and disclosure

In addition to the rights above, you may ask us to limit the use or disclosure of your data by writing to [email protected]. We will handle the request on the terms of the applicable rules and confirm to you whether it is upheld and when it takes effect.

In particular, you may ask us to stop sending you commercial communications, and we will do so at no cost and without this affecting the rest of the Service.

16. How long we keep the data

We keep your account data for as long as you keep the account active. After closure, we delete or de-identify it within the ninety (90) calendar days following, except for data we must retain by legal obligation or for the defence of possible claims. As a guide:

• Account, profile and conversations: for as long as the account is active, and up to ninety (90) days after closure.
• Connection credentials: deleted at the moment you delete the corresponding connection, and in any event when you close your account. Deleting the connection does not undo what the Service wrote in your instance. The address (URL) and the database name of each instance you connect are kept for as long as your account exists, to prevent the same instance from being used in several accounts.
• Implementer operations record — plans, steps, previous values and verifications —: for as long as the connection to the instance it concerns exists. It is deleted when that connection is deleted, and with it the possibility of reverting; the conversation in which each plan was prepared, which shows the plans and the outcome of their steps, is kept with the rest of your conversations.
• Developer data (connected GitHub accounts, linked repositories, requests and the record of their commits): for as long as the account is active, and up to ninety (90) days after closure. Unlinking a repository keeps the history of its requests; deleting the connection to the instance deletes it. The code lives in your repository and is governed by your relationship with GitHub.
• Attached files: for as long as the conversation they belong to needs them, and deleted with the account. Their retention on the model provider's infrastructure is additionally governed by that provider's policies.
• Conversation mode audio: we do not retain it after the session; the voice provider may retain it for a short period in accordance with its own policy.
• Billing records and tax receipts: five (5) years, as required by tax legislation.
• Technical and security logs: up to twelve (12) months.
• Portal submissions and access requests, and job site applications: for as long as the connection to the instance they depend on exists; deleted when it is deleted or, if the customer who is the controller closes their account, within the following ninety (90) days. Discovery answers: until the customer who is the controller deletes the Discovery or, if they close their account, within the following ninety (90) days.
• Documents, with their versions, their images and their PDF copies, and the data of those who read them outside the workspace (each invitee's email address, their access codes and the access log): for as long as the account they belong to exists, and up to ninety (90) days after it is closed. When a document is deleted it stops being visible at once, and its images, its PDF copies, its links, its invitations with each invitee's email address, its codes and the access log are deleted; its text, its versions and its internal log are kept, with no one able to open them from the application, until the account is closed or the customer asks us to delete them. If the person who created a document leaves the workspace, the document is kept in full, with no one able to open it from the application unless that person returns, and whatever they shared outside stops opening; it is deleted when the account is closed or earlier, if the customer asks us to. Each invitee's email address also appears in the record of emails sent, which is kept for as long as the account of the person who invited them exists, even if the document is deleted or the invitation withdrawn. Deleting the conversation a document comes from does not delete the document.
• Videos of the demos you share by link, with their subtitles and chapters: for as long as you share them. When you stop sharing one it is deleted from our servers at that moment, and our backups do not include them. They are also deleted when the demo is deleted, if whoever shared it leaves the workspace, and when the account is closed. For a deleted video we keep only a record without its content (who shared it, when, its size, how many times it was watched and when it stopped being shared) for as long as the account exists. A video you record and do not share does not leave your computer: your browser keeps it.
• Generated reports: for as long as the scheduled report that produces them exists.
• Record of emails sent through the Service (recipient, subject and sending result): for as long as your account exists.
• Advertising measurement data: the period set by the recipient in its own policy and, in our own first-party cookie, until you withdraw consent.

Once those periods have elapsed, the data is deleted or de-identified so that it cannot be associated with you. The backups of our database are renewed on a rotating basis (we keep the most recent ones and one per month, up to twelve) and keep deleted data for as long as that rotation lasts. Files attached to support tickets are kept for up to twelve (12) months after the ticket is closed, or less if you ask us to delete them sooner; if you close your account, they are deleted within the following ninety (90) days.

17. Security measures

We apply administrative, technical and physical measures to protect personal data against damage, loss, alteration, destruction or unauthorised use, access or processing. These include: encryption of connection credentials using AES-256-GCM, irreversible storage of passwords, encryption of traffic in transit, access control by account and by workspace, activity logging, and restriction of staff access to what is strictly necessary.

No system is infallible. Should a security breach occur that significantly affects your economic or moral rights, we will notify you without undue delay, describing what happened, the data compromised, the recommendations you may adopt and the corrective action taken.

18. Minors

The Service is aimed at adults in a professional setting. We do not knowingly collect data from minors; if we detect that such data has been provided, we will delete it. If you believe a minor has provided us with data, write to us and we will proceed to delete it.

19. If you are in the European Union, the EEA or the United Kingdom

Where the General Data Protection Regulation or its UK equivalent applies to a given processing operation, the legal bases we rely on are: performance of the contract, for the purposes in the first group in clause 6; our legitimate interest in maintaining the security of the Service and preventing fraud; compliance with legal obligations; and your consent for the purposes in the second group.

In addition to ARCO rights, you may be entitled to data portability, to restriction of processing, to object to processing based on legitimate interest, and to lodge a complaint with the supervisory authority in your country.

Transfers outside the European Economic Area are covered by the standard contractual clauses approved by the European Commission or by whichever mechanism applies in each case, together with any supplementary measures required.

If your organisation needs a data processing agreement under Article 28 of the Regulation, we will enter into one on request. Write to us at [email protected] and we will tell you the procedure.

20. If you are in the United States

We do not sell personal data and we do not share it for cross-context behavioural advertising, within the meaning given to those terms by California privacy legislation and other state laws.

If you reside in a state that recognises rights of access, correction, deletion or portability over your personal data, you may exercise them by writing to [email protected]. We will not treat you differently for having exercised them.

21. Changes to this notice

We may update this notice on account of legal changes, changes to the Service or changes in our practices. We will publish the version in force at inoddo.com, stating its update date. If the change is material (in particular if it broadens the purposes, brings in new recipients or changes what the Service does in your systems under clause 5), we will notify you by email or within the application at least fifteen (15) calendar days in advance, unless the change is required by law or by an authority, or corrects the description of processing that already takes place: in those cases we will publish it and notify you immediately. Changes to clause 5 that alter what approving a plan authorises are also governed by clause 26 of the terms and conditions.

22. Supervisory authority

If you consider that your right to the protection of personal data has been infringed, or that the processing involves some breach of the applicable rules, you may go before the Secretaría Anticorrupción y Buen Gobierno del Gobierno de México (the federal Anticorruption and Good Governance Ministry of the Government of Mexico), which is the competent authority in this field, to file the complaint or commence whichever procedure applies.

We would be grateful if, before doing so, you gave us the opportunity to address your concern directly.

23. Language

This notice was originally drafted in Spanish. Any version in another language is a courtesy translation and, in the event of any discrepancy, the Spanish version prevails.

24. Contact

Personal Data Department: [email protected].

Address: Calle Nayarit 2901, C.P. 36057, Ciudad de México, México.