Privacy Policy

1. Who we are

This policy applies to the website odoma.app and the web dashboard dashboard.odoma.app (the “dashboard”). Their operator is ODOMA SERVICES OSAÜHING, registry code 17589729, VAT number EE103025241, address Kari tn 24-12, 10315 Tallinn, Estonia (“we”).

The mobile apps Odoma Tracker and Odoma Checkit are published by the non-profit association Odoma Digipädevuse Selts (reg. no. 80659718). Everything the app does on the phone is described in the apps' privacy policy. The apps' policy ends where data from the phone, by the person's decision, reaches their employer's dashboard; from there on, this policy applies.

For questions about data write to support@odoma.ee. We respond within 30 days.

2. Two roles: the company and us

The company is the controller. The company that opens an account in the dashboard decides which employees are connected, which trips, receipts, customers and invoices are kept in it, and which of its people get access. Within the meaning of the GDPR the company is the controller of this data and we are the processor acting on its instructions (Article 28). Using the dashboard for its intended purpose counts as the instruction; the processing terms are part of the terms of use. An employee whose data the company keeps turns first to the company for access, rectification or erasure; we help the company fulfil such a request.

We are the controller for the data needed for the account and the agreement to exist: the email address and name of the account owner, company details, plan invoices and their payment, support requests, technical logs of the service.

3. What we store

3.1 Account and company (we are the controller)

• Sign-in: email address, name from the profile, the identifier of sign-in via Google or Apple, or an account with a password. The password is stored by Google's Firebase Authentication; it never reaches our servers.
• Company: name, registry code, VAT number, address, IBAN, phone and email addresses for invoices; confirmation of email addresses (hash of the address, date).
• Plan and payment: the chosen plan, plan invoices with a permanent reference number, payment dates; the record of acceptance of the terms and this policy: the version, date and time, who accepted (account and email), the screen language. You pay for the subscription by bank transfer or online via MakeCommerce (section 5). With online payment we receive from MakeCommerce only information about the payment: the amount, invoice number, status, time and payment method. We have no card or online bank sign-in data of yours.
• Support: the text of requests and correspondence, who wrote and when.
• Usage and technical data: usage counters (people, devices, documents), server request logs, partial screen load events, an audit log of operator actions on the account.

3.2 Company data in the dashboard (the company is the controller, we are the processor)

• People: the device pseudonym (a random identifier the phone created itself), the label given by the company, where needed the first and last name, IBAN for paying compensation, hourly rate, roles and permissions.
• Work trips: date, start and end time, start and end addresses, distance, odometer readings, purpose of the trip, site, compensation amount and a simplified route line (no more than a few dozen points) from which the dashboard determines the site and the time on it. Trips come only from a phone the person has connected to the company themselves with an invitation code, and only those marked as work trips.
• Receipts: the photo of the receipt and the recognised fields (vendor, date, amount, VAT, payment method, last four digits of the card). The full card number is never stored.
• Sites and customers: names, addresses, contacts, company details.
• Invoices, quotes, work reports, payments: the contents of documents, the PDF “as sent”, e-invoices, to whom and when they were sent.
• Bank: statements the company uploads itself (CAMT, CSV), with the names and IBANs of counterparties from those statements.
• Incoming email: emails and attachments sent to the company's unique address of the form company-name@odoma.app (earlier ones: docs+code@odoma.app), and the invoices recognised from them.
• Online payment of invoices: if the company connects Montonio, we store its Montonio access keys and records of received payments (amount, order number, date). The payer's data is processed by Montonio.

3.3 Phone diagnostic logs

The phone sends us diagnostic logs only in developer mode, which the person enables themselves in the app settings. Such logs may contain coordinates and details of the tracker's operation and are needed to investigate errors. In normal operation they are not sent to the server.

3.4 Emails to companies about the dashboard (we are the controller)

We write to small companies in Estonia that may find the dashboard useful. We compile the list from the open data of the Estonian Business Register (e-Business Register) and the Tax and Customs Board (EMTA).

• Recipient data: the company's name, registry code, email address, county and main activity; the name of a management board member or sole proprietor — only to address the email.
• Email records: date sent and language of the email, whether it was delivered, whether it was opened, a click on the link, a reply, a rejection by the mail server, an unsubscribe.
• If the company created an account after the email: a note "came from the email campaign" in the company's data and a link to the email. When the company is deleted, the link is deleted with it.

Every email contains an unsubscribe link: after it, no more emails will come. You can also object by replying to the email.

4. What we do not store

• Personal trips. A trip marked as personal is not transferred to the dashboard. If a work trip is changed to personal, the server copy is deleted.
• Passwords and full card numbers. See above.
• Data for advertising. The website and the dashboard have no advertising networks, third-party visitor counters or trackers. We do not sell data and do not pass it to brokers.
• Raw GPS tracks from the phone. Only the simplified line of a work trip described in 3.2 reaches the dashboard, not a stream of coordinates.

5. Where the data is and who else sees it

Payments. We are responsible for the processing of your personal data. To carry out an online payment of a plan invoice, we transmit to the authorised payment processor Maksekeskus AS (MakeCommerce) the personal data necessary for the payment: the amount and invoice number, the company name and the billing email. The payer enters bank or card details on the MakeCommerce page; their processing is described in the MakeCommerce data protection terms.

Database backups are made automatically: daily backups are kept for 7 days, weekly for 98 days; once a week a copy is exported to a separate storage in the EU with a 30-day deletion lock, and old copies are deleted no later than 12 months.

6. How long we keep it

• While the account exists — all company data. After the end of the trial or paid period the dashboard switches to view-only mode, the data is not deleted; the phones keep recording, and sync with them stops until payment.
• At least 90 days after the end of the paid period we keep the data unchanged. After that we may archive or delete it, having given at least 30 days' notice by email to the account address.
• Deleting the company is done by the account owner in the settings. For 30 days the data is frozen and the deletion can be cancelled, then everything is deleted irreversibly; the data disappears from backups as they expire.
• Plan invoices we issued to the company and the records of their payment — 7 years under the Estonian Accounting Act.
• Emails to companies (section 3.4): email records — no longer than 24 months after the last email; an address that unsubscribed — in the campaign suppression list as a hash, without a time limit, so that we do not write again.
• Email suppression list (addresses that returned a delivery failure or a complaint) — as a hash, until the address is confirmed again.
• Service records: keys for repeated requests — 30 days, interface event counters — 90 days, links in emails — from 48 hours to 7 days.

7. Legal bases

• Contract (Art. 6(1)(b) GDPR) — account, plan, invoices and their payment, including passing payment data to MakeCommerce, support.
• The company's instructions (Art. 28 GDPR) — data of the company's employees, trips, receipts, customers and documents.
• Legal obligation (Art. 6(1)(c)) — keeping our invoices and accounting records.
• Legitimate interest (Art. 6(1)(f)) — security of the service, protection against abuse, technical logs, a copy of support requests to the operator, emails to companies about the dashboard (section 3.4; you may object at any time — GDPR Art. 21).

8. Your rights

The account owner can at any time in the dashboard: export all company data as a single archive (Settings → Data → Export: records, receipt photos, invoice PDFs), correct company details and records, delete the company with a 30-day cancellation window. An employee of a company turns to their company; if the company does not respond, write to us and we will help.

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) — by email to support@odoma.ee. A complaint can be lodged with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

9. Security

• Connections only over HTTPS; sign-in via Firebase Authentication with email address confirmation; roles and permissions within the company.
• Sending invoices and emails is closed until the sender's address is confirmed; limits on emails and requests.
• Operator actions on accounts are recorded in an audit log; the database can be restored to any point in time within 7 days; the backups described above.
• Company employees appear in the dashboard under device pseudonyms; names are added only by the company itself.

10. Cookies and browser storage

The website odoma.app sets no cookies and uses no counters. If you came via a link in our email (section 3.4), the website and the dashboard keep a marker of that email in localStorage for up to 30 days — to note that the company came from the email campaign. The dashboard stores sign-in data (Firebase Authentication) and your screen settings in the browser's localStorage; there are no third-party cookies.

11. Children

The dashboard is intended for companies and their employees. We do not open accounts for persons under 16.

12. Changes

We announce material changes by email to the account address and update the date at the top of the page.

This policy is drawn up in Estonian, Russian and English; in the event of a discrepancy between the versions, the Estonian version prevails.

Change log

• 2026-09-04 — first version for ODOMA SERVICES OSAÜHING (dashboard and website odoma.app).
• 2026-09-14 — English translation of the Russian version of 2026-09-04; added to section 12: in the event of a discrepancy, the Estonian version prevails.
• 2026-09-15 — added to 3.1: the record of acceptance of the terms and the policy.
• 2026-09-22 — the database was moved from the europe-west2 (London, United Kingdom) region to europe-west3 (Frankfurt, EU): all data is hosted in the EU; section 5 and the date at the top updated; clarified that account sign-in (Firebase Authentication) is processed by Google in the USA.
• 2026-09-24 — in 3.2: the company's incoming email address is now based on its name (company-name@odoma.app); addresses of the form docs+code@odoma.app issued earlier keep working.
• 2026-09-27 — online payment of plan invoices via MakeCommerce (Maksekeskus AS): 3.1, section 5 (recipient and the “Payments” paragraph), 6 and 7; section 1 — address, clarified boundary with the apps' policy; section 6 — without payment, sync with phones stops.
• 2026-09-30 — emails to companies about the dashboard: new section 3.4, sections 5, 6, 7 and 10 extended (email marker in localStorage).