Privacy Policy

• OdooSync reads orders, draft orders, products and customers from your Shopify store and sends the records you choose to your Odoo database.
• To stage, filter and retry syncs, we store copies of those records along with your Odoo connection details, field mappings and sync logs.
• For your customers’ personal information, you are the controller and Invizo processes it on your instructions.
• We don’t sell personal information or use it for advertising.

To get a copy of your data, or to have it corrected or deleted, email privacy@invizo.io.

OdooSync is a product of Invizo. In this policy, “we”, “us” and “our” mean Invizo, and “you” means the merchant who installs and uses OdooSync.

This policy explains how we collect, use, share and protect information when you install OdooSync on your Shopify store, use the app and its dashboard, or contact us. It also covers information about your store’s customers that OdooSync processes for you.

It does not cover Shopify or any other service you connect to OdooSync; those services have their own privacy policies. Your use of OdooSync is also subject to our Terms of Service.

When you install OdooSync, Shopify asks you to approve the access it needs to your store. OdooSync uses that access as follows:

read_orders, read_all_orders

Read new and updated orders, and import past orders, so they can be staged and synced to Odoo.

read_draft_orders

Read draft orders so they can be staged and synced to Odoo.

read_products

Read products, variants and collections so they can be staged and synced to Odoo.

read_customers

Read customers so they can be staged and synced to Odoo.

You can withdraw this access at any time by uninstalling OdooSync from your Shopify admin.

The information we collect depends on the features you use. It comes from your Shopify store through the Shopify API, from details you enter in OdooSync, and from messages you send us.

Store details

Your shop domain, store name, contact email, Shopify plan, billing country and time zone, which Shopify shares when you install the app, plus your OdooSync plan and settings.

Shopify access token

The token Shopify issues so OdooSync can read your store’s data. We delete it when you uninstall the app.

Orders and draft orders

Order numbers, dates, line items, prices, taxes, discounts, shipping, and payment, fulfillment and refund status, with the customer’s name, email address, phone number and billing and shipping addresses.

Products

Product titles, descriptions, SKUs, variants, prices, stock levels and collections.

Customers

Customer names, email addresses, phone numbers and addresses.

Odoo connection

Your Odoo server URL, database name, username, the API key or password you enter, and the Odoo user ID returned when OdooSync connects.

Sync settings

Your field mappings, sync rules and filters, and sync frequency.

Sync activity

Sync status, timestamps, record IDs and counts, and error messages, including errors returned by your Odoo server.

Support conversations

Messages you send us by email or through the in-app chat, and anything you include in them.

We use the information we collect to:

• Sync the records you choose from your Shopify store to your Odoo database.
• Stage records for review and apply your sync rules, filters and field mappings.
• Show sync status, pending records and activity logs in the app.
• Count synced records against your plan’s monthly limit, and manage your plan and billing through Shopify.
• Answer your support requests.
• Keep a record of the stores that install and uninstall OdooSync, so we can support merchants and run our business.
• Keep OdooSync secure and working, for example by verifying requests from Shopify and investigating sync errors.

We don’t sell personal information or use it for advertising.

If you are in the European Economic Area (EEA) or the United Kingdom, data protection law requires a legal basis for each way we use personal information. We rely on the following bases:

Contract

To provide OdooSync under our Terms of Service, including syncing your data, showing sync activity and billing through Shopify.

Legitimate interests

To keep OdooSync secure and reliable, answer support requests and keep records of the stores that use our apps. We rely on these interests only where your rights don’t override them.

Legal obligation

To keep the records that tax and accounting law require, and to respond to lawful requests from public authorities.

For your customers’ information, you decide the legal basis, as explained under Controller and processor roles.

When OdooSync processes personal information about your store’s customers, you are the controller of that information and Invizo is your processor. We process it only to provide OdooSync, on your instructions.

For information about you as a merchant, such as your store details and the messages you send us, Invizo is the controller.

OdooSync sends the records you sync to the Odoo server at the address you enter: customers’ names, email addresses and phone numbers, sales orders and their lines, products with their categories and attributes, and any other fields you map. It also reads field lists and existing records from Odoo, to map fields and avoid creating duplicates.

Once data is in your Odoo database, it is under your control, and Odoo’s terms and privacy policy apply. Deleting data from OdooSync doesn’t delete it from Odoo, so delete it there too when you need to.

Use an https:// address for your Odoo server, so data is encrypted on its way there.

We share personal information only with the sub-processors listed below, who help us run OdooSync, and with services you connect to OdooSync on your instructions. Those services’ own terms and privacy policies apply to them.

We may also disclose information when the law requires it, to protect the rights, property or safety of Invizo, our merchants or others, or as part of a merger, acquisition or sale of our business, in which case this policy continues to apply to your information.

OdooSync’s servers are in Germany. Invizo is based in Bangladesh, and the team that runs and supports OdooSync may access data from there. Your information may therefore be processed in countries whose data protection laws differ from those where you live.

Our sub-processors and their locations are listed under Sharing and sub-processors.

We keep your store’s data while OdooSync is installed: staged and synced records, so you can review sync history and retry failed syncs, plus your Odoo connection details, settings and activity logs. We keep basic records of your account, such as your store name, contact email, plan and install and uninstall dates, for as long as we need them for accounting, tax and legal purposes.

For what happens when you remove the app, see Deletion when you uninstall.

When you uninstall OdooSync, syncing stops and we delete the access token Shopify gave us. The rest of your store’s data, including synced records, Odoo connection details, field mappings, filters and logs, stays stored until you ask us to delete it. We delete it within 30 days of your request.

To ask us to delete your information, email privacy@invizo.io.

We protect the information OdooSync handles with these measures:

• Every webhook and request from Shopify is verified with Shopify’s signature before we act on it.
• Each store can see only its own data in the app, after Shopify confirms who is signed in.
• Traffic between your browser, Shopify and OdooSync is encrypted with HTTPS.
• We never write your Odoo API key or password to our logs.

No way of storing or sending data is completely secure, so we can’t guarantee absolute security. If a security incident affects your data, we will tell you without undue delay and notify the authorities where the law requires.

If you think your account or data has been compromised, email privacy@invizo.io.

OdooSync doesn’t set its own cookies, and it doesn’t use analytics, advertising cookies or tracking pixels.

The app runs inside your Shopify admin, which uses Shopify’s own cookies. Shopify’s privacy policy explains them.

The in-app support chat is provided by Crisp, which stores an identifier in your browser so your conversation carries over between pages. Crisp’s privacy policy explains how it handles this.

Depending on where you live and the laws that apply, you may have the following rights over your personal information.

European Economic Area and United Kingdom

If you are in the EEA or the UK, the GDPR and the UK GDPR give you the right to:

• Access the personal information we hold about you.
• Have inaccurate or incomplete information corrected (rectification).
• Ask us to erase your information (erasure).
• Ask us to restrict how we process your information.
• Object to processing based on our legitimate interests.
• Receive the information you gave us in a structured, machine-readable format, or have it sent to another provider (portability).
• Withdraw your consent at any time, where we rely on consent.
• Complain to a data protection supervisory authority, such as the one where you live or work.

California

If you are a California resident, the CCPA, as amended by the CPRA, gives you the right to:

• Know what personal information we collect, use and disclose, and get a copy of it.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information.
• Not be discriminated against for exercising these rights.

How to exercise your rights

To make a request, email privacy@invizo.io. We reply within one month. Before we act on a request, we may ask you to confirm it comes from you, for example by writing from your store’s contact email address.

If you shop at a store that uses OdooSync

Please contact that store first. Stores can pass access and erasure requests on to us.

OdooSync is a tool for businesses and isn’t meant for children. We don’t knowingly collect personal information from children for our own purposes. If you think we have, email privacy@invizo.io and we will delete it.

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If we make significant changes, we will also tell you by email or in the app before they take effect.

If you have questions about this policy or how we handle your information, contact Invizo: