Privacy Policy

1. Scope

This policy covers the ODDVX desktop application (the “Software”) and this website, oddvx.com (the “Site”). For anything not covered here, contact hello@oddvx.com.

2. What stays on your device

The Software runs locally. Your Google Tag Manager container contents, your Google Analytics 4 data, the Google account credentials you provide, and every audit, report or export the Software generates are processed on your computer and are not uploaded to us. If you choose to email a report, its content and recipient address pass through our report relay and email provider for delivery. Support messages include the information and screenshots you choose to send. Optional Oddie conversations and basic screen context go to your chosen AI provider using your own API key; the provider’s terms and data practices apply.

3. Information we process

• Licensing (Premium). To issue and validate a paid licence we process your email address, your licence key, a randomly generated device identifier, your machine hostname and the application version. This lets us bind a licence to a device, enforce seat limits and provide support.
• Free tier. The Free tier has no licence key and no sign-up. Free installations send device activity pings — the randomly generated device identifier, the application version and a coarse operating-system string (e.g. “Windows 11”). No email, no hostname, no account, and nothing about your analytics or how you use the app. We use these records to understand device activity and versions. A device record does not establish a unique person or a completed audit.
• Billing. Card payments are processed by our third-party payment provider. We receive your subscription status and billing contact details; we do not receive or store your full card number.
• Support and enquiries. If you contact us, we process your message and contact details to respond and keep a record of the correspondence.
• Website. The Site uses Google Tag Manager and Google Analytics to understand how it is used, and standard server logs (IP address, request metadata) for security and operation.

4. Why we process it, and our legal bases

We process the data above to provide and secure the Software and Site, to validate licences and enforce fair use, to take payment, to respond to you, to meet legal obligations, and to understand and improve how the Site and product are used. Where the GDPR or similar law applies, our legal bases are performance of our contract with you, our legitimate interests in running and protecting the service, compliance with legal obligations, and — for non-essential Site analytics — your consent where required.

5. Sharing and sub-processors

We do not sell your personal data. We share it only with a small number of service providers that help us run ODDVX — for licensing, payment processing, email delivery, support and website hosting — and only as needed for those functions. The current sub-processor list, with hosting regions, is available on request and forms part of our Data Processing Agreement. We may also disclose data where required by law.

Google receives requests from the Software because you direct it to connect to your Google accounts; that processing is governed by Google’s own terms.

6. Retention

We keep licensing and billing records for as long as your licence is active and then for as long as needed to meet legal, tax and accounting obligations. Support correspondence is kept for a reasonable period. Report delivery also involves the email provider’s processing and retention practices. Contact us for current provider details. Site analytics data is retained according to our analytics configuration.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent. To exercise any of these, email hello@oddvx.com. You also have the right to complain to your local data protection authority.

8. International transfers

Our providers may process data in countries other than yours. Where they do, we rely on appropriate safeguards such as standard contractual clauses.

9. Children

ODDVX is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

10. Security

We use technical and organisational measures appropriate to the limited data we hold, including encryption in transit and access controls. No system is perfectly secure, but by design the Software keeps your analytics data and credentials on your own machine.

11. Changes

We may update this policy. Material changes will be posted here with a new “last updated” date.

12. Contact

hello@oddvx.com. See also our Terms and Security Overview.