Privacy Policy

Who we are and what this policy covers

Unite Source LLC operates OddyOS. This Privacy Policy explains how we handle personal information when you visit our website, use our services, contact us, or receive a workspace invitation. Our mailing address is 9309 Thunder Falls Ct, Las Vegas, Nevada 89149, USA. Our privacy and support contact is [email protected].

We handle account and service information to operate our business. We process workspace content on a customer’s behalf when that customer directs the processing. The applicable agreement and any data processing addendum describe those respective responsibilities. For requests concerning an employer’s business records, contact that employer; we will cooperate as the agreement and law require.

Information we collect

Account and service information includes your name, email address, authentication identity, organization membership, permissions, preferences, support communications and, when collected, agreement acceptance records. We receive content you or authorized users provide, such as messages, contacts, tasks, tickets, documents and attachments. The particular information depends on the features you use.

We receive transaction and billing information needed to administer purchases, such as billing contacts, plan details and payment status. Payment processors handle card information through their own systems; the information we receive depends on the payment method and integration used.

We also process limited device, usage and security information, including IP addresses, browser and device details, timestamps, errors and actions needed to operate, secure and troubleshoot the service. Information may come directly from you, your organization, authorized collaborators, or a third-party service you choose to connect.

How we use information

We use personal information to provide the features you request, authenticate users, administer workspaces and permissions, process authorized transactions, provide support, improve reliability and usability, prevent abuse and meet legal obligations. Service messages may include invitations, security alerts, billing notices and agreement changes.

Optional analytics or marketing technologies are subject to the choices described under Cookies and similar technologies. We do not sell personal information or use it for cross-context behavioral advertising.

Workspace content and private email

Business records and shared channels can be viewed by people authorized for that record or channel under the workspace’s permissions. A workspace administrator’s role does not by itself authorize access to a person’s privately connected mailbox.

Each person’s connected mail is private to that person. Combining your own mailboxes in one inbox does not combine their permissions with anyone else’s. Mail content is not made available to other users through shared Directory records, search, exports, tickets or workflows merely because you connect an account. If a feature lets you copy or share content into a shared destination, the action and destination must be made clear before you choose it; recipients can then access the shared copy according to that destination’s permissions.

Google and other connected accounts

Signing into OddyOS with Google does not itself connect Gmail. Where an email connection is available and you separately authorize it, the connection notice identifies the requested access. Depending on the enabled feature and your grant, this can include mailbox identity, message headers and participants, subjects and bodies, attachments, threads, labels, read state and drafts. We use only the authorized access needed for the enabled feature, such as displaying and searching mail, maintaining synchronization, organizing mail as you direct, and sending a message you submit from the selected connected account.

Connection credentials are used to maintain the authorized connection. Connecting an account does not enable every possible capability or authorize unrelated uses. We request additional permissions or consent where required before expanding access or using data for a new purpose. Future features described in the Terms do not become active merely because this policy is published.

You can revoke access in your provider’s account controls and, where the connection feature is available, disconnect in OddyOS. Once processed, this stops future synchronization and sending through that grant. Revocation is separate from deletion of data previously stored. To request deletion of stored mailbox information, contact [email protected]. Disconnecting cannot recall sent messages or remove copies held by recipients or independently by your provider.

Google API data and Limited Use

OddyOS’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

We use Google API data only for disclosed, user-facing features you authorize. We do not sell it, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models. Any email AI feature requires accurate additional disclosure and authorization where required; connecting email alone is not permission for undisclosed AI processing.

We transfer Google data only as permitted by Google’s policy, including where needed to provide or improve the authorized user-facing feature, for security, to comply with applicable law, or in a qualifying business transaction with the required explicit prior consent. Human access is limited to the circumstances Google permits, such as your affirmative agreement for specified data, a necessary security investigation, legal compliance, or permitted internal operations involving aggregated, anonymized data. Routine workspace administration does not provide access to private mail.

Service providers and other disclosures

We use providers to host and store data, authenticate users, deliver communications, process payments, secure the service and provide support. Our infrastructure includes Cloudflare for hosting, network delivery and file storage, and Supabase for database and authentication services. Other providers may process information when you enable the corresponding payment, messaging or integration feature. Providers receive information needed for their service, subject to applicable obligations and instructions.

We may disclose information to authorized recipients you choose, to comply with lawful requests, to protect rights and security, or in a merger, acquisition or asset transfer subject to appropriate protections. Restrictions on Google API data continue to apply, including Google’s specific consent requirements. A connected third-party service also handles information under its own terms and privacy policy.

Cookies and similar technologies

We use necessary cookies or similar storage for authentication, security, preferences and remembering your cookie choice. The public website asks before enabling optional analytics or marketing categories. You can accept, reject or change those choices through Cookie settings on the website. Rejecting optional categories does not prevent core service access.

Browser settings can also restrict cookies, though blocking necessary storage can prevent sign-in or other features from working. Do Not Track browser signals do not currently change our processing; use the available cookie controls and privacy request contact to exercise your choices. We do not permit cross-context behavioral advertising through our service.

Retention, account closure and deletion

We retain information for as long as reasonably necessary for the purpose for which it was collected, the customer’s instructions and agreement, and applicable legal, accounting, security and dispute-resolution requirements. Relevant criteria include whether your account or connection remains active, whether the information is needed to provide a requested feature, and whether a legal obligation or unresolved issue requires retention.

Workspace records and attachments follow the customer’s service and deletion instructions. Connected-mail copies are retained to support the authorized feature unless deleted under those instructions or an applicable request; disconnecting a provider is not by itself a request to erase existing copies. Connection credentials are used only for the authorized connection and are no longer used once revocation or disconnection has been processed.

Limited security, transaction and agreement records may be retained after account closure when needed for their stated purpose or legal obligations. Backup copies may remain until overwritten or expired in the ordinary backup cycle and are restricted from routine use. We may preserve information subject to a lawful hold. We do not promise a single deletion period for every record category. Contact [email protected] to request deletion, obtain information about retention relevant to your account, or discuss available exports before closure.

Security and processing locations

We use reasonable administrative, technical and organizational measures designed to protect personal information and limit access. No internet service, transmission or storage system can be guaranteed completely secure. Report a suspected security issue to [email protected].

Information may be processed in the United States and other countries where we or our providers operate. Those countries may have different data-protection laws. Where applicable law requires a transfer mechanism or additional safeguards, we use the appropriate contractual or other lawful arrangements.

Your privacy choices and rights

Depending on your location and our role in the processing, you may have rights to request access, correction, deletion, portability, restriction or objection; withdraw optional consent; or appeal a request decision. Contact [email protected] with your request. We may need to verify your identity or authority, and legal exceptions may apply. We will respond within the period required by applicable law. You may also complain to an appropriate data-protection authority.

Nevada residents may use [email protected] as the designated address for a verified request concerning the sale of covered information. We do not sell personal information. We will not unlawfully discriminate against you for exercising an applicable privacy right. Where your employer controls the requested business records, we may direct the request to that organization or assist it in responding.

Children

OddyOS is intended for business users aged 18 or older and is not directed to children. We do not knowingly solicit personal information from children under 13. If you believe a child has provided such information, contact us so that we can investigate and take appropriate action.

Changes and contact

We post policy updates with their effective date and provide additional notice of material changes as required. We request consent before new uses of Google data when required. A policy update does not silently expand connected-account permissions or record acceptance of a service agreement.

For privacy questions or requests, contact Unite Source LLC at [email protected] or 9309 Thunder Falls Ct, Las Vegas, Nevada 89149, USA. Our Terms of Service include the software license governing use of OddyOS.

Email open tracking

Connect can include a small remote image in email sent by an OddyOS user. When an email client or intermediary requests that image, we record an image-load signal and its first and most recent recorded time, associated with the sending user's message. Open tracking is enabled by default; the sender can turn it off in their personal Connect settings for all their connected accounts. Turning it off stops recording new open signals, including for earlier tracked messages; existing records may remain with the sender's communications history.

Open signals are visible only to the private mailbox owner. They do not establish that a person read the message or identify which recipient opened a message addressed or forwarded to multiple people. Email clients, image proxies and security scanners can load images automatically or block them. No tracking cookie is required. The open-tracking record does not store the recipient's IP address, device or browser profile; our hosting providers may process ordinary network and security logs as described elsewhere in this policy.

We use these signals to provide the sender-facing communication feature, not for advertising or to train generalized AI models. Open tracking does not enable workflow or AI email sending. Tracking images stop recording after 90 days, and a sender's loss of authorized mailbox access also stops recording new signals. Recipients can use their email client's remote-image and privacy controls or contact [email protected] with questions.