Odoo Service Policies

How do we protect your privacy?

On Odoo.com and when you use our services, Prisma Hexagon and its affiliates offer several services to help you manage your business. One of them is a platform to host your own Odoo database. As part of the management of those services, we collect your data and your business data, which are essential not only for the operation of our services, but also for the security of our services and all our users.

This policy explains what information we collect, why we collect it, and how we use it.

Information we collect

Most of the personal information we collect is provided to us by our users when they register and use our services. Other information is collected through recordings of interactions with our services.

Account and contact details: when you register on our website to use, download, or subscribe to one of our products or services (such as Odoo online, a free trial, Odoo apps, Odoo.sh, among others), you provide us with certain information on a voluntary basis, just as when you fill out our contact forms. Usually, this includes your name, company name, email address, phone number, address (for invoices or product shipping), business sector, your interest in Odoo, and a personal password.

We never record or store our customers' banking information. Our PCI-DSS compliant payment processors handle both credit card and recurring payment processing.

Job application data: We generally collect your contact information (name, email, phone) and any other details you choose to share in your cover letter and resume when applying for a job through our website or an employment agency. If we offer you a job, we will request additional personal details to comply with legal obligations and personnel management requirements.

We will not ask you to provide information that is not necessary for the recruitment process. In particular, we will never collect information about your racial or ethnic origin, political opinions, religious beliefs, trade union membership, or sex life.

Browser data: when you visit our website and access our online services, we detect and store your browser language and geolocation to customize your experience. Our servers also passively record a summary of information sent by your browser for statistical, security, and legal purposes: your IP address, date and time of visit, accessed resource, browser version, platform, and referring web page.

We may also use your browser to store and retrieve your current session data with the help of a session cookie (see the Cookie section for details).

Form protection: Some of our forms may be protected by Google reCAPTCHA. This technology uses heuristic procedures based on your browser and device's technical characteristics and may use Google-specific cookies. Please see Google's privacy policy and terms of use in the Third-Party Service Providers section below.

Customer databases: when you subscribe to an Odoo cloud service and create your own Odoo database (e.g., a free trial), any information or content you upload to your database belongs to you, and you remain in full control of it.

Similarly, when you upload a local database to the Odoo update website, the data within it remains yours.

Often, this data includes personal information such as employee lists, contacts, customers, messages, images, and videos. We collect this information solely on your behalf, and you will always retain full ownership and control over it.

Free trial session recording: when you start a free trial on our Odoo cloud service, we may give you the option to authorize the recording of your free trial session to help us improve product user experience.

If you give your consent, we collect visible screen information during the first two hours of your free trial and your interactions with our applications (clicks, menus opened, etc.). This data is compiled into a video reviewed temporarily by our user experience experts.

This may include personal data like names, emails, phone numbers, and photos entered during the recording period. We automatically exclude passwords and sensitive fields, though we cannot completely rule out capturing sensitive text entered in other fields.

The other sections of this policy explain:

• How we process this data.
• How long we store it.
• How you can access or request its deletion.
• Which external service providers are involved.

If you do not give your consent or if we do not offer you the option, your test session will not be recorded and we will not collect any data for this purpose.

Github.com account details: When you subscribe to the Odoo.SH platform and create your project, the platform requires authorization to access your Github.com account, including an OAuth token granting access to your project repository contents.

In-app purchase transaction data: When you use Odoo in the Cloud or a self-hosted deployment, optional "in-app purchase" services may be active by default, including auto-complete functions and third-party integrations for sending/receiving SMS messages, letters, etc.

When using these services, necessary transaction data is transmitted to Odoo Cloud services and shared with third parties. Detailed privacy policies can be found in the IAP Privacy Policy. IAP services are always optional.

How do we use this information?

Account and contact information: We use your contact information to provide our services, fulfill requests, bill you, and manage your account. We may also use it for marketing with an opt-out option, and in aggregate/anonymous form to analyze trends.

If you register for an event, we may share your name, email, phone, and company name with organizers and sponsors. If you show interest in Odoo or request contact, we share this information with local Partners in your region for local support.

Job application data: Processed solely for recruitment, evaluation, follow-up, and contract preparation if a job offer is made. You can request deletion at any time.

Browser data: Analyzed anonymously to maintain and improve services. Google reCAPTCHA is used for security to prevent abuse based on anonymous scores.

We only link this data to personal data when required by law or security policies if our terms are violated.

Customer database: Collected and processed strictly on your behalf to deliver subscribed services based on your configuration instructions. Technical support staff may access it reasonably to resolve issues or ensure security.

Free trial session recording: Used exclusively by our R&D Usability team to improve user experience under strict confidentiality. Stored and processed using FullStory tools.

Github account data: During setup, your OAuth token configures project webhooks and deployment keys to detect repository commits. The token is deleted upon logging out or after 2 days. Repository contents remain active during your Odoo.SH subscription.

Security

We protect your personal information using technical, administrative, and organizational security measures detailed in our Security Policy.

Service providers / external subprocessors

We rely on trusted service providers for payment processing, hosting, analytics, and marketing. They comply with data protection regulations under specific processing contracts.

A continuación encontrarás una lista con los proveedores de servicios que usamos en este momento, por qué los utilizamos y qué tipo de datos les compartimos.

A. Subprocessors

These external service providers process data for which Odoo is controller or processor.

Subprocessors	Purpose	Shared data
OVH S.A.S. Privacy and security	Infrastructure and hosting of Odoo.com, Odoo SaaS, Odoo.SH backups, and DDoS protection.	Production data from Odoo.com, SaaS customer databases, update services, and cloud service backups. Certifications: ISO 27001, SOC 1/2, PCI-DSS, CISPE, SecNumCloud, CSA STAR.
Google Cloud EMEA Ltd Privacy and Security	Odoo.com infrastructure and hosting, Odoo SaaS, Odoo.SH production/backups, and DDoS protection.	Production data from Odoo.com, SaaS/PaaS customer databases, update services, and cloud backups. Certifications: ISO 27001/17/18, SOC 1/2/3, PCI-DSS, HIPAA, CISPE, CSA STAR.
Amazon Web Services, Inc. Privacy and Security	Infrastructure and hosting (inherited legacy).	Legacy database upgrade services for pre-existing upgrade web platforms. Certifications: ISO 9001/27001/17/18, SOC 1/2/3, PCI-DSS, HIPAA, CISPE, CSA STAR.
FullStory Security and privacy	Free temporary trial registrations for users consenting to UX improvement programs.	Screen recordings for the first 2 hours of free trial sessions + FullStory cookies.