Odden Cloud customers put their own business information, and information about the people they deal with, into workspaces. For that information the customer decides what is collected and why, and we process it on their behalf under our data processing addendum. To do that we use the companies below. We choose providers that give contractual commitments to protect the data, and we remain responsible for what they do for us.
Who we use
| Sub-processor | What it does for us | Where | What data it handles |
|---|---|---|---|
| Laravel Holdings Inc., Laravel Cloud | Runs the application and the database for Odden Cloud | United States (US East, Ohio) | All workspace data |
| Laravel Holdings Inc., Laravel Object Storage (built on Cloudflare R2) | Stores profile pictures and the zip files of data exports, privately | Location chosen automatically by the provider (Cloudflare R2); not limited to one region | Profile pictures; export files, for up to 7 days |
| Laravel Holdings Inc., Laravel Nightwatch | Monitors the application for errors and performance | United States (US East, Ohio) | Technical data about requests, errors, database queries, queued jobs, mail and notification events, log entries and source-code snippets of errors, kept for 90 days. Request bodies are not captured, and addresses that carry secrets (invitations, sign-in hand-offs) are kept out |
| Cloudflare, Inc. | Network protection and delivery in front of Odden Cloud, and Turnstile, which checks that a sign-up comes from a person | Global network | Technical request data such as IP addresses, and the content of requests while they pass through |
| Amazon Web Services, Inc., Amazon Simple Email Service, Amazon Simple Storage Service and Amazon Simple Notification Service | Sends the email a workspace sends through hosted email and Odden's own account emails (password resets, workspace invitations, export and deletion notices), sends on a workspace's behalf, when it cannot send email itself, a visitor's ticket acknowledgement, booking confirmation or sign-up confirmation from an address on our domain, receives email sent to a workspace's Odden address and holds each received message for up to 2 days before it is deleted, and tells us about bounces, complaints, deliveries and received messages | United States (US East, Ohio) | Sender and recipient addresses, the subject and body of messages, attachments, delivery results |
| Telnyx LLC | Carries the text messages a workspace sends and receives, and registers the workspace's business and texting number with US mobile carriers and The Campaign Registry | United States | The phone numbers and the words of each text while it is on its way (Telnyx keeps the words for about 10 days), and the workspace's registration details. Telnyx keeps its own record of each message (the numbers, the time and the result) as its own controller, for as long as it needs to run its service. The Campaign Registry and the mobile carriers receive the business details and the number for registration |
Laravel Holdings publishes its data processing agreement and security documents at trust.laravel.com. That is the agreement we rely on for the three Laravel services above.
Not sub-processors
- Stripe, Inc. takes payment for purchases and subscriptions. It does not receive the contents of a workspace. It handles the payment and billing information it collects (such as your card details) as a controller in its own right. See its privacy notice.
- Telnyx runs our support phone number: it answers the call and records a message left on it. For the phone line it handles the caller's number and the recording for us, and never receives the contents of a workspace. (Telnyx also carries workspaces' text messages, as a sub-processor; see the table above.) We delete Telnyx's copy of a recording automatically as soon as the message has been emailed to us, normally within a minute; if that fails we try again for three days, and a copy that still remained would be kept under its terms, at present up to a year unless it is deleted sooner. See its privacy policy.
- Google LLC, with its Gemini API, turns a message left on our support phone number into text: we send it the recording, and it returns the transcript, a one-line summary and a label for the kind of message and how urgent it sounds. It receives only that recording, never the contents of a workspace. We use a paid Google account, whose terms do not let Google use the recording to train its models, and under which Google may keep it for a limited time to detect abuse. See its privacy policy.
- Your own AI provider. The AI features use your own Anthropic account and key (more providers may be added), under your agreement with them.
- Your own email server, if you connect one instead of using hosted email.
- Your own DNS provider, if you use a one-click setup for the DNS records of a sending domain: that is your account with them.
Changes
We will add a new sub-processor to this page, and email the owners of every workspace, at least 30 days before it starts to process workspace data. If you object on reasonable data protection grounds within that time, write to support@odden.io and we will work with you to resolve it. If we cannot, you may stop using the affected part of Odden Cloud and we will refund any fees you have prepaid for the period that remains.