Privacy policy

1. Data controller

The controller responsible for the personal data processed through the service is Odalon.

You may contact Odalon regarding privacy and data protection matters at contact@odalon.com. For operational support or account incidents, you may write to support@odalon.com.

2. Personal data we may process

Depending on how you use Odalon, we may process the following categories of data:

• Identification and account data: name, email address, user identifier, account type, subscription status, and preferences associated with the account.
• Authentication and security data: encrypted password or credentials associated with access providers, verification codes, two-factor verification settings, technical security records, and activity.
• Content entered by the user: messages, queries, conversations, documents, files, images, or any information you choose to enter or upload to the service.
• Usage and analytics data: platform usage events, messages sent, chats created, files uploaded, sign-ins, registrations, feature usage, errors, and technical metrics needed to operate and improve the service.
• Payment and billing data: information necessary to manage subscriptions, payments, renewals, cancellations, and billing status. Card details or other payment methods may be processed directly by external payment providers such as Stripe.
• Technical data: IP address, browser, device, operating system, technical identifiers, cookies, or similar technologies where necessary to provide the service, maintain the session, protect the account, or analyze platform operation.
• Communications: messages sent to support, legal queries, privacy requests, incidents, responses, and communications related to the service.

The user should avoid entering particularly sensitive data, third-party confidential information, or unnecessary personal data if they do not have a legal basis, sufficient authorization, or adequate measures to do so.

3. Purposes of processing

We process personal data for the following purposes:

• Create, maintain, and manage user accounts.
• Allow access to the chatbot and Odalon features.
• Process messages, documents, and files entered by the user to generate responses through artificial intelligence.
• Manage authentication, password recovery, email verification, email-address changes, and two-factor verification.
• Manage plans, subscriptions, payments, renewals, cancellations, and access to paid features.
• Provide support, answer queries, manage incidents, and respond to user requests.
• Protect platform security, prevent abuse, fraud, unauthorized access, and uses contrary to the terms.
• Improve the service, analyze platform usage, debug errors, measure performance, and develop new features.
• Comply with legal obligations and respond to requests from competent authorities where necessary.
• Defend rights, legitimate interests, and our own or third-party claims.

4. Legal bases for processing

The legal bases that may legitimize the processing of personal data are:

• Performance of a contract or application of pre-contractual measures: to create and maintain the account, provide the service, manage plans, process payments, and allow the use of requested features.
• Legitimate interest: to maintain service security, prevent abuse or fraud, improve the platform, carry out reasonable internal analytics, debug errors, and address incidents.
• Compliance with legal obligations: where we must retain certain information, issue or manage payment-related documentation, respond to authorities, or comply with applicable regulations.
• Consent: where a specific feature requires it, for example for certain communications, optional preferences, or non-essential cookies if implemented.

5. Use of artificial intelligence and content processing

When you use the chatbot, Odalon may process the messages, instructions, files, and documents you enter in order to generate responses and provide the requested service.

You should carefully review the information you share with the platform and avoid entering personal data, trade secrets, regulated information, credentials, keys, sensitive information, or third-party data where it is not strictly necessary or where you do not have sufficient authorization.

Responses generated by artificial intelligence may be inaccurate or incomplete. They should not be used as the sole basis for critical decisions, formal audits, regulatory compliance, responses to real incidents, or actions that may affect third parties without appropriate professional review.

6. Recipients and providers

To provide Odalon, we may use technology providers that process data following our instructions or acting as providers necessary for the operation of the service. These providers may include, among others:

• Infrastructure, hosting, database, deployment, and storage providers.
• Email delivery and transactional communication providers.
• Authentication, security, and abuse-prevention providers.
• Payment processing and billing providers, such as Stripe.
• Artificial intelligence model providers or services necessary to generate responses and process requests.
• Internal technical analytics, monitoring, and service-diagnostic tools.

We may also disclose data where necessary to comply with legal obligations, respond to requests from competent authorities, protect rights, investigate abuse, or defend ourselves against claims.

7. International transfers

Some technology providers necessary to provide the service may be located outside the European Economic Area or process data from countries that do not offer an equivalent level of protection. In such cases, efforts will be made to use appropriate safeguards in accordance with applicable regulations, such as standard contractual clauses, adequacy decisions, or other legally recognized mechanisms.

8. Retention periods

We will retain personal data for the time necessary to provide the service, maintain the account, manage the relationship with the user, and fulfill the purposes described in this policy.

• Account data will be retained while the account remains active and subsequently for the periods necessary to meet legal obligations or possible liabilities.
• Conversations, messages, documents, and files associated with use of the service may be retained while the user maintains the account or until deletion is requested, unless an obligation or legitimate interest justifies retention.
• Verification, password-recovery, and security codes will be retained for short periods linked to their purpose and expiration.
• Data relating to payments, billing, or subscriptions will be retained for the periods required by applicable tax, accounting, or consumer regulations.
• Technical records, security logs, and analytics events may be retained for the time reasonably necessary for security, diagnosis, abuse prevention, and service improvement.

When data is no longer necessary, it will be deleted or reasonably anonymized, unless it must be retained due to legal obligations or for the defense of claims.

9. Rights of users

You may exercise the rights recognized by data-protection regulations, including:

• Right of access to your personal data.
• Right to rectify inaccurate or incomplete data.
• Right to erasure where applicable.
• Right to object to certain processing.
• Right to restriction of processing.
• Right to data portability where applicable.
• Right to withdraw consent for processing based on consent, without affecting the lawfulness of processing before its withdrawal.

To exercise your rights, you may write to contact@odalon.com indicating the right you wish to exercise and the information necessary to identify your account.

If you consider that the processing of your data does not comply with applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency or the competent supervisory authority.

10. Information security

Odalon applies reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or improper destruction. These measures may include password encryption, authentication, email verification, two-factor verification, access controls, technical records, and infrastructure-security mechanisms.

No system is completely infallible. The user must protect credentials, keep devices secure, and notify support if they suspect unauthorized access to the account.

11. Cookies and similar technologies

Odalon may use cookies or similar technologies necessary to maintain the session, remember preferences, enable security features, and operate the platform correctly.

If analytical, advertising, or non-strictly necessary cookies are introduced in the future, the user will be informed and consent will be requested where required under applicable regulations.

12. Minors

Odalon is not specifically directed at minors. If you are a minor, you must use the service only with the authorization and supervision of your parents, guardians, or legal representatives where applicable regulations so require.

If we detect that an account has been created in breach of this condition or without sufficient authorization, we may suspend or delete it.

13. Automated decisions

Odalon uses automated systems and artificial intelligence to generate responses to user requests. We do not use these systems to make automated decisions with legal effects on users or that similarly affect them significantly, unless expressly disclosed and there is a legal basis for doing so.

14. Changes to this policy

We may update this privacy policy to adapt it to legal, technical, operational, or service-functioning changes. Where the changes are relevant, efforts will be made to inform users by reasonable means, such as a notice on the platform or an email communication.

The current version will be available on this page, indicating the date of the last update.

15. Contact

For queries regarding privacy, data protection, or the exercise of rights, you may contact Odalon at contact@odalon.com.

For technical incidents, access problems, or account support, you may write to support@odalon.com.