Privacy policy

This website and Odden are operated by CaskStack, LLC ("we", "us"), 101 Cooper Street, Santa Cruz, CA 95060, United States. We are the controller of the personal information described here, except where we say Stripe is, and except for the information customers put into their Odden Cloud workspaces, for which we are the customer's processor (see "Odden Cloud workspaces" below). For anything about your information, contact us at privacy@odden.io.

What we collect

• The early-access list. If you join the Odden Cloud early-access list, we collect what you enter: your email address and, if you give them, your name, company, team size, interests and notes.
• When you sign up for Odden Cloud. We collect your name, email address, a protected form of your password, your workspace's name and address, the plan you chose, your agreement to our terms, and the IP address and browser details of the request, which we use to limit abuse such as repeated sign-ups. Cloudflare Turnstile checks that the request comes from a person and receives your IP address for that check.
• When you buy. Our payments are taken by Stripe (see below). Stripe gives us your name, email address, billing country and postal code (and more of your address where tax requires it), the identifiers of your customer record, payment, invoice and subscription, and what you bought. We never receive your card or other payment details.
• Your licenses. We keep a record of each license: its owner, the billing email, the domain you set for it, its dates, and a fingerprint of its key (never the key itself). The software's daily check-in, which you can turn off, sends us your site's domain and the versions of the paid Odden packages, PHP and Laravel it runs. It sends nothing from your CRM.
• Your account. If you claim your licenses, we keep your name, email address and a protected form of your password, and your two-factor setup if you turn it on.
• Messages to us. If you email us, we keep the emails.
• Calls to our support phone number. If you call and leave a message, we keep your phone number, the time and length of the call, a recording of your message, a written transcript of it and a one-line summary. The greeting tells you before the tone that your message will be recorded. We email the recording, the transcript and the summary to our support inbox, and we make a support ticket from them: the ticket holds your number, the summary and the transcript, and the recording stays in the email. We do not store the recording anywhere else, and once it has been emailed we delete the copy Telnyx made. If you hang up without leaving a message, we keep no record of the call; Telnyx, which runs the phone line, keeps its own log of calls under its terms. Telnyx takes the call and records your message. Google's Gemini then listens to the recording to write the transcript and the summary, and to judge what kind of message it is and how urgent it sounds; that only sets a label on the ticket, and a person reads every message. Google handles the recording under its paid terms, which do not let it use the recording to train its models (see below).
• Website visits. Our servers and Cloudflare, which protects the site, keep technical logs such as IP addresses, to keep the site secure.
• Odden Cloud accounts. If you use Odden Cloud, we keep your name, email address, a protected form of your password, your two-factor setup, your time zone if you set one, the workspaces you belong to and your role in each, and when and where you signed in. See "Odden Cloud workspaces".
• Your profile picture. If you add a picture to your Odden Cloud profile, we keep that image. It is stored privately, shown only through links that expire after an hour, and deleted when you replace it or your account is deleted.
• The Odden Cloud audit log. To keep every workspace secure we keep a log of sign-ins and failed sign-ins, changes to a workspace's settings, members and domains, exports and deletions, and support access to a workspace, each with the time, the user who acted and their IP address. The log is kept for up to 400 days.
• Hosted email in Odden Cloud. If a workspace sends email through our hosted email service, we keep, for each message, the sender and recipient addresses, the time and the delivery result, including bounces, spam complaints and delivery confirmations our email provider reports to us. We also keep the list of addresses we have stopped sending to for that workspace. We use this to deliver the email, protect the sending reputation that every workspace shares, apply our fair-use limits and let the workspace see what happened. The workspace owner controls the content of the messages; see "Odden Cloud workspaces".

Odden Cloud workspaces

Odden Cloud is the hosted version of Odden. Two kinds of information are involved, and we treat them differently.

• Your account. Described above. We are the controller of this information.
• Your workspace data. The contacts, companies, deals, tickets, messages, campaigns, forms and submissions, files and other records that you or your team put into a workspace, and the details of the people they are about. This belongs to the customer. The customer decides what goes in and why, so the customer is the controller, and we process it only to run the service for them, on their instructions. Our data processing addendum and our sub-processor list apply. We do not use workspace data for our own purposes, and we do not sell it.

If you are a person whose details are held in someone's workspace (for example you are a customer or a contact of an organisation that uses Odden Cloud), please contact that organisation first about your information and your rights. If you contact us instead, we will pass your request on to them.

Inside the product, our staff reach a workspace only through a recorded support session: only a platform administrator with two-factor authentication on can start one, they must give a reason, it lasts at most an hour, it is read-only unless the workspace has allowed changes (and even then cannot export or delete the workspace, which only owners can do), the workspace's owners are emailed when one starts, and every session is written to the workspace's audit log. Separately, a small number of named operators at Odden can use our hosting and database tools to run and maintain the service. That access is protected by the hosting provider's sign-in; commands run through the hosting provider's tools are kept in the provider's command history; opening the application's console or database tools is recorded in our own audit log; and the access is used to operate the service, not to read workspace data, except where a customer asks for help that needs it.

Why we use it, and our legal basis

Who receives it

• Stripe, Inc., our payment processor, which takes your payment and is a separate controller of the payment and billing information it collects. We calculate tax and handle refunds ourselves, using Stripe's tools. See Stripe's privacy notice.
• Our service providers: Laravel Cloud (hosting, in the United States), Amazon Web Services (sending license and account emails), Cloudflare (site security and email routing), Telnyx (our support phone number: it answers the call and records your message), Google (Gemini, which turns the recording of your message into a transcript and a summary), and Microsoft (our email and our support inbox, which handle the messages you send us).
• For Odden Cloud, the providers that process workspace data for customers are listed, with what each does and where, on our sub-processor page: Laravel Cloud (hosting, database and file storage, and Laravel Nightwatch for application monitoring), Amazon Web Services (hosted email, Odden's own account emails and delivery notifications), and Cloudflare (network protection), among the others listed there.
• Advisers and authorities, such as accountants and lawyers, and tax or law-enforcement authorities where the law requires it.

We do not sell your information.

Where it is stored and processed

• Your details are stored in databases hosted by Laravel Cloud in the United States.
• Odden Cloud workspace data is stored in databases hosted by Laravel Cloud in the United States (US East, Ohio). Profile pictures and data exports are kept in Laravel Object Storage, whose location is chosen automatically by the provider and is not limited to one region.
• Hosted email is sent, and email sent to a workspace's Odden address is received, through Amazon Simple Email Service in the US East (Ohio) region; received messages are held briefly in Amazon S3. The content and recipient addresses of a message pass through Amazon Web Services while it is delivered, and delivery and bounce events come back to us through Amazon's notification service.
• Early-access details are also added to our customer relationship management system (Odden, which we operate ourselves), hosted the same way, so we can manage invitations.
• When you sign up, an email notification containing your details is sent to our team through Cloudflare's email service.

If you are in the UK or the European Economic Area

We are based in the United States, and the information we hold is stored and processed there. If you are in the UK or the European Economic Area, that means your information is sent outside your country. UK and EU law allows this when there is a safeguard in place. We rely on safeguards the law accepts, such as the standard contractual clauses that our service providers include in their data processing agreements with us, and we choose providers that offer them. Stripe, which takes your payment, is responsible for the safeguards that apply to the payment and billing information it collects; its privacy notice explains them. If you would like to know more about the safeguards that apply to your information, or to see a copy of them, contact us at privacy@odden.io.

If you are a California resident

This section is for California residents and describes our practices under the California Consumer Privacy Act (CCPA). It covers the personal information we collect about visitors, buyers, license holders and Odden Cloud account holders. It does not cover the information customers keep in their Odden Cloud workspaces: for that we are the customer's service provider, and the customer is responsible for requests about it (see "Odden Cloud workspaces" above and our data processing addendum).

What we collect, and why. In the last 12 months we collected the following categories of personal information, from you, from Stripe when you buy, and from your use of our site and software, for the purposes in "Why we use it, and our legal basis" above:

Who we disclose it to. We disclose personal information for business purposes to the service providers listed in "Who receives it" above and on our sub-processor page, to Stripe for payment, and to advisers and authorities where the law requires it.

We do not sell or share your personal information. We have not sold or shared (for cross-context behavioral advertising) any personal information in the last 12 months, and we do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for any purpose that California law lets you limit. We use no advertising or analytics cookies, and we do not track you across other sites, so a "Do Not Track" or Global Privacy Control signal has nothing to change.

Your rights. You have the right to know what personal information we collect, use and disclose, to receive a copy of it, to have it deleted or corrected, and not to be treated differently for using these rights. To use them, email privacy@odden.io. We will ask you to confirm the request from the email address on the account or license so that we do not give your information to someone else, and we will answer within 45 days (we will tell you if we need more time, up to 45 more). You may use an authorized agent: they will need your written permission, and we may check it with you. "How long we keep it" above lists how long we keep each kind of information. California's "Shine the Light" law lets you ask which categories of personal information we disclosed to third parties for their direct marketing: we do not make such disclosures.

How long we keep it

• Order, payment and license records: for as long as the law requires us to keep financial records.
• Early-access sign-ups: until you ask us to remove you, or we have invited everyone and closed the list.
• Odden Cloud sign-ups that are never confirmed by email: the sign-up and the workspace made for it are removed after 7 days.
• Daily check-in records: while your license is active and for 12 months afterwards, then they are deleted automatically.
• Your account: until you ask us to delete it, unless we need to keep something for legal reasons.
• Closing an Odden Cloud account: you can close your account yourself. It is switched off at once and, after 30 days, the account and the personal details we hold about you are erased, unless you reopen it with the link we email you. We keep a record that a purchase happened, without your name or email address, as tax law requires.
• Odden Cloud workspace data: for as long as the workspace exists. When a workspace is deleted it is switched off at once and kept for 30 days, so an accidental deletion can be undone, and then it is deleted permanently, including its uploaded files, exports and custom domains. Our database backups are kept for 7 days, so deleted data leaves them within 7 days after that. A workspace's address is not given to anyone else for 90 days.
• Emails received at a workspace's Odden address: the raw message for up to 2 days, and the record we keep of it for 30 days.
• Odden Cloud exports: a data export is available to the workspace's owners for 7 days and then deleted.
• The audit log: up to 400 days.
• Application monitoring data (requests, errors, queries, jobs and log entries, held by Laravel Nightwatch): 90 days.
• Hosted email records: the details of each message and its delivery events for 13 months; after that we remove the times it was sent, opened and clicked and its delivery events, and keep only a short record of which campaign it belonged to and who it was sent to, its status and the reference in its unsubscribe link, for as long as the workspace exists, so an unsubscribe link in an older email still works. Monthly totals of messages sent, delivered, bounced and complained, for each workspace and without addresses, for 24 months. A workspace's list of suppressed addresses for as long as the workspace exists, so that someone who complained is not emailed again.
• Messages left on our support phone number: the number, the time, the length, the transcript and the summary for 90 days, then they are deleted automatically. The support ticket made from a message is kept like any support ticket, for as long as we need it to help you and until you ask us to delete it. The recording is kept only in the email to our support inbox, which we treat as any email sent to us. Telnyx's own copy of a recording is deleted automatically as soon as the message has been emailed to us, normally within a minute; if that deletion fails we try again for three days, and a copy that still remained would be kept under Telnyx's own terms, which at present is up to a year unless it is deleted sooner, and we would delete it when you ask us to delete your information. Google receives the recording only to write the transcript and the summary, and may keep it for a limited time under its own terms to detect abuse.
• Sales records: we keep a record of each sale (date, amount and the identifiers Stripe gives it), without your name, email address or domain once you ask us to erase your data, for as long as the law requires financial records to be kept.

Your rights

Depending on where you live, you may have the right to see the information we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable form, and withdraw consent you have given. You can also complain to your data protection authority. To use any of these rights, email us at privacy@odden.io. We will answer within one month.

Your data in Odden Cloud

• People in a workspace's records. The customer who runs the workspace is responsible for requests about the information they hold about you. We help them respond, and if you write to us we pass your request on.
• Customers. A workspace owner can export everything in the workspace at any time (Workspace, Export your data), in files that open in any spreadsheet or database, and can delete the workspace (Workspace, Delete this workspace). Owners can still export during the 30 days after they delete it.

Asking us to delete your information

You can ask us to delete everything we hold about you, whether or not the law of where you live gives you that right. When you do, we delete your account, sign-in sessions and the records of which sites your licenses were used on, and we remove your email address, name and IP address from our logs. If you left a message on our support phone number, we also delete the record of the call, the ticket made from it, the recording in our inbox and the copy Telnyx holds. We keep a record that a sale happened (its date, amount and the identifiers Stripe gave it), because the law requires us to keep financial records, but we take your name, email address and domain off it. If a license of yours is still paid up, we turn it off first and tell you before we do. Stripe collects your payment details itself and decides how to handle them, so ask Stripe directly to delete what it holds; we will tell you how. We will confirm in writing what we deleted and what we kept, within one month.

Security

We protect your information with measures such as encrypted connections, hashed license keys and passwords, access limited to the people who need it, and an audit log of changes to licenses and accounts. For Odden Cloud: every workspace's data is kept separate from every other's and the separation is tested; two-factor authentication is required for anyone who belongs to more than one workspace and for our administrators; inside the product our staff can enter a workspace only through a recorded support session, and use of our server console and database tools is recorded; and we take care that passwords, tokens and other secrets are kept out of our audit log and monitoring.

Cookies

This site uses only the cookies it needs to work: a session cookie and a security token that protect forms, and a cookie set by Cloudflare to protect the site from automated traffic. They expire within two hours. Signing in to Odden Cloud sets one session cookie (host-only, secure and HTTP-only) and a security token that protects forms; they are needed for you to stay signed in. The Odden Cloud sign-up and chat pages also load Cloudflare Turnstile, which checks that a sign-up or chat message comes from a person. We do not use analytics or advertising cookies. When you open the payment page, Stripe provides it and may set its own cookies, which its privacy notice describes.

Contact

To ask about or remove your information, or to use any of the rights above, contact us at privacy@odden.io.