Legal
Privacy notice
Who we are
Ody AB, company reg. no. 559546-8124, Tyresö, Sweden, is the controller for the processing described here. This notice covers the website ody.one and the form where you request access to Ody.
This notice also covers data about contact persons at our customers (see "Customer contacts").
This notice does not cover the content of the platform. When an organisation uses Ody, we process personal data on that organisation's behalf, as a processor, under our data processing agreement. This also applies to your user account and sign-in if you use Ody as an employee of a customer. Your employer is then the controller, and you should contact them first.
What data we process
When you submit the form. Name, work email address and organisation. In addition, facts about the organisation: size, sector, who owns the AI question and which topics you are interested in. We also store the language the page was shown in and which version of this notice applied when you submitted the form. We do not store your IP address or browser details with the request.
When you write to us through the contact form. Your name, email address and message. We store the message, forward it to our inbox and send you a confirmation by email.
When you order the self-assessment report. To get the report, you agree that we store your email address and email you more insights on AI adoption. We store the address, your six answers, the language and which version of the consent text applied. The address is also held briefly in the server's working memory to limit how many reports go to it. Every email has a link to unsubscribe, and we then erase the address.
When you visit the website. As with any website, our delivery network receives your IP address, browser details and the page you request, in order to show the page. We keep no visitor logs. We measure visits with Plausible Analytics (Plausible Insights OÜ, Estonia), which sets no cookies and does not store your IP address; we see only aggregate figures, such as how many people visited a page. The data is stored in the EU.
Abuse protection. When you submit the form, your IP address is used briefly in the server's working memory to limit the number of requests. It is never written to logs or the database and disappears when the server instance is recycled.
Technical logs. The server logs technical details of each request: request id, route, method, status code and duration. The logs do not contain your IP address or what you typed in the form.
Cookies. The website sets no cookies while you read the pages. When you submit the form, a security cookie (csrf_token) is set. It contains a random value that is not linked to you, prevents other websites from submitting the form in your name, and disappears when you close the browser. The cookie is necessary for the form to work.
When we reply to you. We reply by email. We then process your name, email address, organisation and the content of our correspondence.
Purposes and legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answer your request and book a meeting | Name, email, organisation, organisation facts | Legitimate interest (Article 6(1)(f)): to respond to organisations that have shown interest in Ody |
| Correspond with you | Name, email, organisation, email content, messages from the contact form | Legitimate interest (Article 6(1)(f)): to hold a dialogue with organisations that have shown interest |
| Send the self-assessment report and more email about AI adoption | Email, answers, language | Consent (Article 6(1)(a)), which you withdraw with the link in every email |
| Protect the form from abuse | IP address (briefly), security cookie | Legitimate interest (Article 6(1)(f)): to keep the website secure |
| Serve the website and troubleshoot | Technical request data | Legitimate interest (Article 6(1)(f)): to operate the website |
| Manage contracts and invoicing with customers | Contact persons' name, email, role, correspondence | Legitimate interest (Article 6(1)(f)) and legal obligation (Article 6(1)(c)) for bookkeeping |
Where we rely on legitimate interest, we have weighed our interest against yours. You have the right to object, see "Your rights".
Retention
- Requests from the form: 24 months after you submitted the form, then deleted automatically.
- Messages from the contact form: 24 months after you sent them, then deleted automatically.
- Self-assessment contacts: until you unsubscribe, and no longer than 24 months after the latest report. They are then deleted automatically.
- Database backups: 7 days. Deleted data disappears from backups within that time.
- Technical logs: 14 days.
- IP address for request limits: only in the server's working memory, never stored.
- Security cookie: until you close the browser.
- Email: for as long as the dialogue continues, and no longer than 24 months after last contact.
- Customer contacts: for the term of the agreement and 24 months after. Invoices and other accounting records are kept for seven years under the Swedish Bookkeeping Act.
Customer contacts
When your organisation is a customer of ours, or is negotiating to become one, we process your name, email address, role and our correspondence with you as a contact person. The purpose is to enter into and manage the agreement and to invoice.
Recipients
We do not sell personal data or share it for others' marketing. These processors handle data on our behalf:
- Amazon Web Services (AWS): website hosting, database and page delivery. Data is stored in the EU.
- Google (Google Workspace): email correspondence. Data is stored in the EU.
- Amazon Web Services (Amazon SES): sending the self-assessment report and confirmations of messages from the contact form. Data is processed in the EU.
- Plausible Insights OÜ (Plausible Analytics), Estonia: visitor statistics for the website, without cookies. Data is stored in the EU.
Within Ody, only authorised staff have access to the data, and only when needed to answer the request or operate the website.
Subprocessors for the platform are listed at https://ody.one/trust/subprocessors/.
Transfers outside the EU
Data from the form is stored in the EU. The website is delivered through a global network (Amazon CloudFront). If you visit from a country outside the EU, the page may be served from a server near you, and your IP address and page request are then processed there.
AWS is a US company. Transfers rely on the EU adequacy decision (EU-US Data Privacy Framework) and the EU Standard Contractual Clauses included in the AWS Data Processing Addendum.
Google is a US company. Transfers rely on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses in Google's data processing terms.
Your rights
You have the right to:
- know what data we hold about you and receive a copy,
- have inaccurate data corrected,
- have data erased,
- ask us to restrict processing,
- object to processing based on legitimate interest,
- receive data you provided in a machine-readable format, where processing is based on consent or contract,
- withdraw consent at any time, where processing is based on consent. This does not affect processing that took place before.
Contact privacy@ody.one. We reply within one month.
Complaints
If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se. We appreciate it if you contact us first so we can try to resolve it.
Contact
Ody AB, company reg. no. 559546-8124, Parkvägen 29, 135 52 Tyresö, Sweden. Data protection questions: privacy@ody.one.
Changes to this notice
Each version has a date and its own address, and earlier versions remain available. This version applies from 15 October 2026 and is available at a dated address under https://ody.one/legal/privacy/. If we make material changes, we will say so on the website before they take effect.