Privacy Policy

1. Introduction

Odyssai Systems Ltd. ("Odyssai Systems," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our websites and services.

Odyssai Systems Ltd. is a company incorporated in British Columbia, Canada, and serves as the data controller for your personal information.

This policy applies to all services operated by Odyssai Systems, including TabiWay, AssetWorthIQ, and odyssaisystems.com.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, and password when you register
• Profile Information: Any additional information you choose to provide
• Payment Information: Billing details processed securely by our payment processor (Stripe)—we do not store credit card numbers
• Communications: Messages you send us via contact forms or email
• Service-Specific Data: Information required for specific services (e.g., travel preferences for TabiWay)

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and interactions (with consent)
• Device Information: Browser type, operating system, device type, screen resolution
• Log Data: IP address, access times, referring URLs
• Cookies: See Section 6 for detailed information on cookies

2.3 Information from Third Parties

• Social Login: If you sign in via Google or other OAuth providers, we receive your name and email
• Payment Processors: Transaction confirmation and billing details from Stripe

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: Provide, operate, and maintain our services
• Account Management: Create and manage your account, authenticate users
• Payment Processing: Process transactions and send billing communications
• Communication: Respond to inquiries, send service updates and security alerts
• Personalization: Customize content and recommendations based on your preferences
• Analytics: Understand usage patterns and improve our services (with consent)
• Security: Detect, prevent, and address fraud and security issues
• Legal Compliance: Comply with legal obligations and protect our rights

5. Data Sharing and Disclosure

We share your information with the following categories of recipients:

Service Providers

• Supabase: Authentication and database hosting (EU/US servers)
• Stripe: Payment processing
• Vercel: Website hosting and deployment
• Google Analytics: Usage analytics (with consent only)
• Anthropic (Claude AI): AI-generated content (only service preferences, not personal identity)
• Formspree: Contact form submissions

Other Disclosures

• Legal Requirements: When required by law, court order, or government request
• Protection of Rights: To protect our rights, property, or safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

6. Cookies and Tracking Technologies

Essential Cookies

Required for our services to function. These include authentication session cookies. You cannot opt out of essential cookies.

Analytics Cookies

We use Google Analytics 4 to understand how users interact with our services. These cookies are only set with your consent. You can change your preferences at any time through our cookie banner or browser settings.

Local Storage

We use browser localStorage to save preferences and form progress locally on your device. This data is not transmitted to our servers.

Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our services.

7. Data Retention

We retain your information for the following periods:

• Account Data: As long as your account is active, plus 30 days after deletion request
• Service Data: Up to 2 years after account closure, or as required for legal/business purposes
• Payment Records: 7 years for tax and accounting compliance
• Analytics Data: Anonymized after 26 months (Google Analytics default)
• Contact Inquiries: 2 years from the date of communication

9. International Data Transfers

Your information may be transferred to and processed in countries outside your country of residence, including Canada and the United States, where our servers and service providers are located.

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
• Data Processing Agreements: With all our service providers
• Adequacy Decisions: Where applicable (Canada has been deemed adequate by the EU for commercial transfers)

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure authentication mechanisms
• Regular security assessments
• Access controls and logging

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us immediately and we will delete it.

12. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry-standard interpretation. However, you can control tracking through our cookie consent mechanism.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last updated" date
• Sending an email notification for significant changes (if you have an account)

Your continued use of our services after such changes indicates acceptance of the updated policy.

14. Contact Information

For privacy-related questions, to exercise your rights, or to file a complaint:

EU/UK Supervisory Authorities

If you are in the EU/EEA or UK and are unsatisfied with how we handle your data, you have the right to lodge a complaint with your local data protection authority:

• EU: Find your local DPA
• UK: Information Commissioner's Office (ICO)