Odeet

Last updated: October 18, 2026

Privacy policy

This policy explains which personal data Odeet processes, for which purposes, on which legal bases, and how to exercise your rights.

This English version is provided for convenience only. In case of discrepancy, the French version prevails.

Data controller

DIDEK Josselin (Odeet) is the controller of the processing carried out to operate the Odeet service. Data protection contact: contact@odeet.fr.

Data collected

  • User account: name, email address, country, verification status, session identifiers and active organization.
  • Organization: name, members, invitations, logo, display name, contact details and legal notices used in reports.
  • Audits: submitted URLs, discovered pages, axe-core results, technical captures, scores, exports, human validations, revocable share links.
  • Billing: plan, subscription status, Stripe identifiers, payment events and information required for invoices.
  • Contact and support: messages, contact details, any attachments, request handling history.
  • Technical data: security logs, application errors, IP address, user-agent, timestamps and traces required to operate the service.
  • Free preview without an account: address of the submitted page and the results of its analysis, with no screenshot kept; the IP address is only used to limit the number of previews.
  • Public website audience measurement: pages viewed, referring site, browser and device type, approximate location, with no cookie and no IP address kept (details in the cookie policy).

Purposes and legal bases

  • Account creation and management: performance of the contract or pre-contractual measures.
  • Running audits, generating reports and exports: performance of the contract.
  • Managing organizations, teams and invitations: performance of the contract.
  • Payment, billing and accounting: performance of the contract and legal obligations.
  • Support, responding to requests and B2B commercial follow-up: legitimate interest or pre-contractual measures.
  • Security, abuse prevention, error diagnostics and service improvement: legitimate interest.
  • Free one-page preview without an account: legitimate interest (presenting the service).
  • Anonymous traffic statistics for the public website: legitimate interest, measurement exempt from consent.
  • Marketing or non-essential trackers: consent where required.

Recipients and processors

The detailed list of sub-processors (entity, purpose, data location, transfer safeguards) is published on the site's “Sub-processors” page (/subprocessors); any change is notified to customers at least 30 days before it takes effect.

  • Authorized Odeet staff for operations, support, security and billing.
  • OVHcloud for infrastructure hosting.
  • Stripe for payment, billing and the customer portal.
  • Resend or the configured email provider for transactional emails.
  • Sentry or an equivalent configured service for error monitoring.
  • Google only if the user chooses Google authentication.
  • Anyone holding the link to a free preview.
  • Administrative or judicial authorities where required by law.

Transfers outside the European Union

Odeet favors European providers whenever possible. Some technical or payment services may nevertheless involve processing outside the European Union. In that case, Odeet relies on the safeguards provided by the GDPR, in particular standard contractual clauses, an adequacy decision or the mechanisms offered by the provider concerned.

Retention periods

  • Account and organization: for the duration of use of the service, then limited archiving where necessary for evidence, security or legal obligations.
  • Audits and reports: kept as long as the account or organization maintains them in the service, unless deletion is requested or operational.
  • Invoices and accounting data: statutory period applicable to accounting and tax obligations.
  • Contact requests: up to 3 years after the last relevant commercial exchange, unless an obligation or objection applies.
  • Technical and security logs: limited to what is strictly necessary, generally 12 months or less except in case of incident.
  • Free previews without an account: 7 days, unless added to an account, where they become an audit.
  • Audience statistics: 25 months after the visit.

Your rights

You may request access to, rectification or erasure of your data, restriction of processing, object to processing, or request portability where these rights apply. You may also withdraw your consent where processing is based on it, and give instructions regarding your data after your death. Contact: contact@odeet.fr. You have the right to lodge a complaint with the CNIL (the French data protection authority).

Security

Odeet implements reasonable security measures: HTTPS encryption, authenticated sessions, separation by active organization, access control on audits, backups, technical logging, restricted administrative access and server hardening.