Privacy policy
[EFFECTIVE DATE]
This policy explains how [LEGAL ENTITY NAME] ("OdysseyCMS", "we") handles personal data when you use our website, sign up for an account, or visit a website hosted on OdysseyCMS.
Who is responsible for your data
For our own website and for customer accounts, OdysseyCMS is the controller of your personal data.
For websites our customers build on OdysseyCMS, the customer is the controller of data collected from their visitors, for example through their forms. We process that data on their behalf as a processor, under our terms and any data processing agreement in place. If you submitted a form on a site hosted on OdysseyCMS, contact that site's owner first.
What we collect
Account data
Your name, email address, password (stored only as a secure hash), the sites you belong to and your role on each, and billing details needed to invoice you.
Content you store
Pages, posts, media, form definitions and settings you add to your sites, including any email server or Microsoft 365 credentials you enter so your site can send mail.
Data collected by customer sites
Form submissions sent by visitors to customer sites, and technical request data such as IP address, user agent and requested URL, which we use to serve pages, score spam and record 404 errors.
Our website and demo requests
What you enter in our demo request form, and technical data about your visit. Analytics cookies are only set if you accept them.
How we use it and our legal bases
- To provide the service you signed up for (performance of a contract).
- To secure the service, prevent spam and abuse, and keep backups (legitimate interests).
- To reply to demo requests and support questions (legitimate interests, or steps before a contract).
- To send service messages about your account, such as trial and billing notices (performance of a contract).
- To meet legal, tax and accounting obligations (legal obligation).
- To send product news, only where you have agreed to it (consent). You can withdraw consent at any time.
Who we share it with
We do not sell personal data. We share it only with service providers who help us run OdysseyCMS, under contracts that require them to protect it: [HOSTING PROVIDER AND REGION], [PAYMENT PROVIDER], and Google reCAPTCHA where a form uses it.
Email sent by a customer site goes through that customer's own SMTP server or Microsoft 365 account, which the customer chooses and controls.
We may disclose data where the law requires it, or to protect the rights and safety of our users and the public.
How long we keep it
Account data and site content are kept while your account is active. After an account is closed we delete site content within [N] days, except copies held in daily database backups, which expire on their normal rotation of [N] days. Billing records are kept for as long as tax law requires. Demo requests are deleted [N] months after our last contact unless you become a customer.
How we protect it
Each site's data is isolated from every other site. Traffic is served over HTTPS with HSTS, passwords are hashed, and the database is backed up daily. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authority as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. Email [PRIVACY CONTACT EMAIL] and we will respond within one month. You also have the right to complain to your data protection authority.
Cookies
Our website uses essential cookies to keep you signed in and to protect forms against cross-site request forgery. Forms protected by reCAPTCHA load Google's script, which may set its own cookies. Analytics cookies are set only after you accept them in the cookie notice, and you can change your choice at any time.
International transfers
Data is hosted in [REGION]. Where a provider processes data outside your country, we rely on [TRANSFER MECHANISM, e.g. Standard Contractual Clauses] to protect it.
Changes and contact
We will post any changes on this page and update the date above. For material changes we will email account owners before they take effect. Questions: [PRIVACY CONTACT EMAIL], [LEGAL ENTITY NAME], [REGISTERED ADDRESS].