1. Introduction and Who We Are
This Privacy Policy explains how ODDVUE PMI LLP ("OddVue," "we," "us," or "our") collects, uses, stores, shares, and protects your personal data when you use the OddVue website, desktop application, and browser extension (together, the "Service").
- Entity: ODDVUE PMI LLP, a Limited Liability Partnership registered in India.
- Role: We are the data controller (under GDPR) and data fiduciary (under India's DPDPA 2023) for the personal data described in this Policy, except where stated otherwise (see Section 5.1 — Paddle).
- Scope: This Policy applies to all users of the Service, regardless of location. Where specific laws grant you additional rights (e.g. GDPR for EEA/UK users, CCPA/CPRA for California residents, or DPDPA for Indian users), those are described in Section 8.
This Privacy Policy should be read together with our Terms of Service.
If you do not agree with this Privacy Policy, please do not use the Service.
2. What Data We Collect
2.1 Data You Provide to Us
| Data category | Examples | When collected |
|---|---|---|
| Account information | Name, email address, password (stored as a cryptographic hash — we never store your password in plain text) | Registration |
| Journal data | Trade entries (symbol, price, exchange, timestamp, notes, setup name, edge, tags), position events (side, fills, exits, stops), derived metrics (returns, R, risk badges), screenshots on the device (and inside a zip if you create one), daily journal notes | Stored on your device when you use the Service. Not a live cloud journal. Leftover hosted JSON rows may exist until deleted with the account or a later purge |
| Product preferences | Position-sizing numbers (total capital, ideal position size); AI research button preference (gemini, pplx, or gfin) | When you save these Settings on the device (they travel in a zip or OddVue copy you create; they are not live-synced across computers) |
| Optional OddVue copy | At most one user-linked backup archive (zip) of the book on that device, which may include trade records and screenshots; plus metadata such as size, created time, and trade count | Only if you ask OddVue in Settings to create or replace that copy |
| Communications | Support requests, feedback, feature suggestions | When you contact us |
| Temporary entries (drafts) and draft screenshots | Unsaved temporary entries you create in the app (including draft text/metadata) and any screenshots attached to those drafts | When you create or edit temporary entries before logging/saving them as permanent entries |
In this Policy, "temporary entries" means user-created draft entries that you have not finalized as permanent journal entries.
Temporary entries are stored locally in the app database on your device. Draft screenshots are stored as local image files on your device. These temporary entries and draft screenshots are local-only unless you include them in a zip or OddVue copy you create.
We may automatically remove stale temporary entries that have not been updated for 120 days. This behavior applies to temporary entries only and does not upload the live journal.
2.2 Data Collected Automatically
| Data category | Examples | When collected |
|---|---|---|
| Device information | Device identifier (a locally generated ID for trial management), browser type and version, operating system, app version | When you use the Service |
| Usage data | Pages visited, features used, timestamps of access, login/logout events | When you use the Service |
| Research-button usage | When you click FinTwit Ft.X or the AI research button (Deep Ft.Gem, Fin Ft.Goog, or Res Ft.PPLX): which button, which AI slot was showing, your OddVue timezone, a random client id stored only on that device (not your trial device id, email, or account id), and the UTC time of the click. We do not record the ticker, the prompt, or your email / user id on that record. These records are not linked to your account. | When you press those buttons |
| IP address | Your Internet Protocol address | Each time you connect to the Service |
2.3 Data Collected by the Browser Extension
If you install and use the OddVue browser extension, it may collect:
| Data category | Examples | Source |
|---|---|---|
| Trade data from supported pages | Symbol, price, exchange, timestamp | Captured from supported third-party web pages (e.g. certain TradingView chart pages) that you visit while the extension is active. Captured values may be stored as journal or Position Manager data after you can edit or confirm them. The extension does not provide a hidden TradingView feed. |
For full details on the extension's data practices, see Section 10.
2.4 Data from Payment Processors
When you subscribe to a paid plan, your payment is processed by Paddle.com Market Ltd ("Paddle") for users worldwide, including India and all other countries. Paddle may act as Merchant of Record for the transaction. See Section 5.1 for details.
We may receive from Paddle: your name, email address, country, subscription status, transaction ID, and billing dates. We do not receive or store your full credit/debit card number, CVV, or bank account details. These are held exclusively by Paddle (or its payment partners) as applicable.
2.5 Data We Do NOT Collect
For clarity, OddVue does not collect:
- Brokerage account credentials or login details
- Live broker open positions or brokerage account balances (Position Manager data is user-entered or user-confirmed journal data, not broker sync)
- Full credit/debit card numbers (held by payment processors only)
- Government-issued identification numbers (e.g. Aadhaar, SSN, passport)
- Biometric data
- Precise geolocation (GPS) data. The OddVue timezone stored with research-button usage records is a region proxy, not GPS or precise location
- Data from websites the browser extension does not run on
3. How We Use Your Data
We use the data we collect for the following purposes:
| Purpose | Data used | Why |
|---|---|---|
| Provide and operate the Service | Account info, optional OddVue copy, device info | To create and maintain your account, keep timezone and billing working, store an optional OddVue copy when you ask, and deliver the features you use. The live journal stays on your device |
| Process payments | Name, email, country (shared with Paddle) | To process your subscription, manage billing, and handle refunds |
| Send transactional communications | Email address | To send OTP verification codes, password resets, subscription notices, billing receipts, and service alerts (see our Terms of Service, Section 19) |
| Enforce our Terms and prevent abuse | Account info, device ID, IP address, usage data | To detect and prevent fraud, enforce one-trial-per-device limits, and ensure acceptable use |
| Show relevant pricing | IP address (country only, derived from your connection) | We may use IP-derived country to show pricing and offers on our website. Pricing is shown based on your approximate location; if you use a VPN, displayed information may not match your actual country. |
| Improve the Service | Aggregated usage data; research-button click records (not linked to your account) | To understand how the Service is used, identify bugs, and plan new features. We use research-button click records to understand which research destinations people use so we can improve those features. We may also use aggregated counts (for example by destination and timezone region) to decide whether to pursue partnerships. We do not send these click records to X, Google, or Perplexity. We do not use individual-level data for profiling. |
| Comply with legal obligations | Varies | To meet legal, regulatory, and tax requirements (e.g. retaining anonymized billing records under Indian tax law) |
| Respond to your requests | Communications, account info | To answer support and privacy requests |
We do not:
- Sell your personal data to anyone.
- Use your journal or trade data to provide investment advice, recommendations, or financial services.
- Share your data with advertisers.
- Use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.
4. Legal Basis for Processing (GDPR)
This section applies if you are in the European Economic Area (EEA) or the United Kingdom. Under GDPR, we must have a lawful basis for each processing activity.
| Processing activity | Legal basis | Explanation |
|---|---|---|
| Creating and maintaining your account | Contract (Art. 6(1)(b)) | Necessary to perform the contract (our Terms of Service) you entered into with us |
| Storing an optional OddVue copy | Contract (Art. 6(1)(b)) | Account operation and the optional other-computer copy you request. The live journal is on your device |
| Processing payments (via Paddle) | Contract (Art. 6(1)(b)) | Necessary to process the subscription you purchased |
| Sending transactional emails (OTP, billing, service alerts) | Contract (Art. 6(1)(b)) | Necessary for account operation and security |
| Enforcing one-trial-per-device and fraud prevention | Legitimate interest (Art. 6(1)(f)) | Our legitimate interest in preventing abuse and fraud. We have assessed that this does not override your rights given the limited data involved (device ID only). |
| Security monitoring (detecting unauthorized access) | Legitimate interest (Art. 6(1)(f)) | Our legitimate interest in protecting the Service and user data |
| Retaining anonymized billing records for tax compliance | Legal obligation (Art. 6(1)(c)) | Required under Indian tax law (Income Tax Act, GST regulations) |
| Sending marketing emails (if introduced in future) | Consent (Art. 6(1)(a)) | Only with your explicit opt-in consent; you can withdraw at any time |
Your right to object: Where processing is based on legitimate interest, you have the right to object. See Section 8.2.
6. International Data Transfers
ODDVUE PMI LLP is registered in India. Our infrastructure and some of our service providers are located outside India, including in the United States.
Where your data is stored
| Data | Location | Provider |
|---|---|---|
| Application database (account, billing, legal acceptances) | United States | Railway (Postgres) |
| API hosting | United States | Railway |
| Optional OddVue copy (zip) | United States, Railway Storage Buckets, US West (sjc) | Railway |
| Transactional emails (in transit) | United States | Google (Workspace) |
| Payment data (subscription checkout) | United Kingdom / European Union and other locations per Paddle's processing | Paddle |
Transfer safeguards for EEA/UK users
If you are in the EEA or the UK, your personal data is transferred to the United States for hosting and email delivery. We rely on the following safeguards for these transfers:
- Standard Contractual Clauses (SCCs): We use SCCs approved by the European Commission (and, for UK transfers, the UK International Data Transfer Addendum) in our agreements with service providers who process data outside the EEA/UK.
- Google Workspace DPA: Includes SCCs for international data transfers.
- Paddle: Paddle processes payment data in the UK/EU and has its own GDPR compliance measures. See Paddle's GDPR page.
Transfer safeguards for Indian users
India's DPDPA 2023 permits cross-border transfer of personal data except to countries specifically restricted by the Central Government (none restricted at the time of this Policy). We comply with any applicable restrictions on cross-border data transfers under Indian law.
7. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this Policy, or as required by law.
| Data category | Retained for | What happens after |
|---|---|---|
| Account data (name, email, password hash) | As long as your account is active | Permanently deleted within 30 days of account deletion request |
| Journal data on your device | As long as you keep the app data / local zips | We do not host the live book. Account deletion does not delete zip files on your computers |
| Leftover hosted catalog JSON | Until account deletion or a later purge of those tables | Deleted with the account (journal table deletes remain until that purge) |
| Optional OddVue copy (one zip + metadata) | Until you replace it, delete your account, or we remove it on request | Object and metadata deleted on account deletion. A previous copy is kept if a new upload is over 1 GB |
| Device records (device ID, trial dates) | As long as your account is active | Permanently deleted within 30 days of account deletion request |
| Consent records (ToS acceptance, version, timestamp) | Duration of account + up to 8 years after deletion | Anonymized on account deletion (user ID removed); retained for legal compliance |
| Billing / transaction records | Up to 8 years after the transaction | Anonymized (identifying details removed); retained for tax and legal compliance per Indian law (Income Tax Act, GST regulations) |
| Transactional emails (OTP codes, notifications) | Sent and not stored by OddVue; Google Workspace retention per Google's policies | OTP records in our database are deleted on verification or expiry (e.g. 10 minutes) |
| IP addresses (in consent records) | Duration of account | Removed on account deletion (anonymized in retained consent records) |
| Temporary entries (drafts) (including draft metadata) | Stored only on your device in the app database; included in a zip only if you create one | May be automatically deleted if stale for 120 days, and may also be lost if you clear local app data or lose the device; we do not have access to these local-only drafts |
| Draft screenshots (temporary entry images) | Stored only on your device as local image files; included in a zip only if you create one | May be automatically deleted along with stale temporary entries after 120 days, or lost if local files are removed from your device |
| Local app preferences (settings and convenience preferences) | Stored in your browser/app local storage on your device | Retained locally until you clear local storage, reset the app, or uninstall |
| Research-button click records | 24 months from the time of the click | Automatically deleted after 24 months. Not deleted when you delete your account, because they are not linked to the account |
| Inactive accounts (no login for 24+ months, no active subscription) | Notified by email; 30-day grace period | Deleted or anonymized per Terms of Service, Section 5 |
When you use the in-app "Delete my account" feature, we remove your data from our active systems immediately. The "within 30 days" period applies to (1) the completion of processing so that your data is no longer present in any backup or other system we control, and (2) requests received by email or other means, which we will process within 30 days.
We retain backups of our systems for no longer than 30 days. Backups are purged or overwritten within this period so that deleted data is not restored.
Your right to deletion: You may request deletion of your account and data at any time. See Section 8.
8. Your Privacy Rights
8.1 Rights for All Users
Regardless of your location, you have the following rights:
| Right | Description | How to exercise |
|---|---|---|
| Access | Request a copy of personal data we hold about your account (plus OddVue copy metadata). This is not a zip of the live book on your device | Use the "Export my data" feature in the app, or email privacy@oddvue.com |
| Correction | Request correction of inaccurate data | Edit directly in the app (journal entries are editable), or email privacy@oddvue.com for account data |
| Deletion | Request deletion of your account and personal data | Use the "Delete my account" feature in the app, or email privacy@oddvue.com |
| Data export / portability | Receive your data in a structured, machine-readable format (JSON or CSV) | Use the "Export my data" feature in the app |
| Withdraw consent | Where processing is based on consent (e.g. marketing emails), withdraw at any time | Unsubscribe link in marketing emails, or toggle in account settings, or email privacy@oddvue.com |
Research-button click records are not included in Export my data because they are not associated with your account. Use Backup All Data or Restore from OddVue for the complete on-device book.
How we respond: We will acknowledge your request within 5 business days and complete it within the applicable deadline for your jurisdiction (see below). We may need to verify your identity before processing (e.g. by confirming the request came from your registered email address).
8.2 Additional Rights for EEA/UK Users (GDPR)
If you are in the European Economic Area or the United Kingdom, you also have:
| Right | Description |
|---|---|
| Restrict processing | Request that we stop using (but continue storing) your data in certain circumstances — e.g. while we verify accuracy of disputed data, or if you believe processing is unlawful but prefer restriction over deletion. Your account will be "frozen" during restriction. |
| Object to processing | Object to processing based on our legitimate interest (e.g. fraud prevention, security monitoring). We will stop unless we can demonstrate compelling legitimate grounds that override your interests. |
| Lodge a complaint | You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state where you reside, work, or where the alleged infringement occurred. You may also complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk. |
Response deadline: 30 days from receipt of your request. We may extend this by up to two additional months if the request is complex, in which case we will inform you within the initial 30 days.
No fee: We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.
Representative: We do not currently have a representative in the EU/EEA under GDPR Article 27. If one is appointed, we will update this Policy.
8.3 Additional Rights for California Residents (CCPA / CPRA)
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Categories of personal information we collect (CCPA categories):
| CCPA category | Examples from OddVue | Source | Business purpose |
|---|---|---|---|
| A. Identifiers | Name, email address, IP address, device ID | You; automatically | Account, service operation, security |
| B. Personal information (Cal. Civ. Code 1798.80) | Name, email address | You | Account creation |
| D. Commercial information | Subscription plan, transaction history, billing dates | You; payment processor | Billing, service access |
| F. Internet or network activity | Pages visited, features used, login timestamps | Automatically | Service operation, security |
| G. Geolocation | Approximate location derived from IP address (city/country level only) | Automatically | Tax determination (via Paddle where applicable), security |
| L. Sensitive personal information — financial data | Trade symbols, prices, exchange names, timestamps, journaled position events and derived metrics (user-entered or user-confirmed; not live brokerage holdings) | You; browser extension | Core journal service |
Your CCPA/CPRA rights:
| Right | Description |
|---|---|
| Right to know | Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, including sources, purposes, and categories of third parties with whom we shared it. |
| Right to delete | Request deletion of your personal information (subject to exceptions for legal compliance). |
| Right to correct | Request correction of inaccurate personal information. |
| Right to opt-out of sale/sharing | We do not sell or share (as defined by the CCPA) your personal information. There is no need to opt out because no sale or sharing occurs. If this changes in the future, we will provide a "Do Not Sell or Share My Personal Information" link. |
| Right to limit use of sensitive PI | You may request that we limit the use of sensitive personal information (e.g. financial data) to purposes necessary to perform the Service. We already limit use to this purpose. |
| Right to non-discrimination | We will not discriminate against you for exercising any of your CCPA/CPRA rights (e.g. we will not deny you the Service, charge a different price, or provide a different quality). |
How to exercise: Email privacy@oddvue.com or use the in-app features described in Section 8.1.
Response deadline: 45 days from receipt of your verifiable request. We may extend this by up to 45 additional days if reasonably necessary, in which case we will inform you.
Authorized agent: You may designate an authorized agent to submit a request on your behalf. We may require verification that the agent is authorized (e.g. a signed written authorization or power of attorney).
Financial incentives: We do not offer financial incentives related to the collection, sale, or deletion of personal information.
Disclosures for the preceding 12 months:
- Personal information sold: None.
- Personal information shared for cross-context behavioral advertising: None.
- Categories of PI disclosed for a business purpose: Identifiers and commercial information disclosed to Paddle for payment processing; identifiers disclosed to Google for email delivery; all categories disclosed to Railway for hosting and the application database.
8.4 Additional Rights for Indian Users (DPDPA 2023)
If you are in India, you have rights under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025:
| Right | Description |
|---|---|
| Right to access | Request a summary of the personal data we process about you and the processing activities. |
| Right to correction and erasure | Request correction of inaccurate or misleading data, completion of incomplete data, or erasure of data that is no longer necessary for the purpose it was collected. |
| Right to grievance redressal | File a grievance with our Data Protection Contact (see Section 15). We will acknowledge your grievance and respond within a reasonable timeframe. |
| Right to nominate | Nominate another individual to exercise your rights on your behalf (e.g. in case of death or incapacity), as provided under DPDPA. |
| Right to complain | If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India (once operational). |
Consent and withdrawal:
- We process your personal data based on the consent you provide at registration (by accepting our Terms of Service and this Privacy Policy via a required checkbox).
- You may withdraw your consent at any time by deleting your account (via the "Delete my account" feature in the app or by emailing privacy@oddvue.com). Withdrawal of consent is as simple as giving it — a few clicks in the app.
- Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- If you withdraw consent, we will stop processing your personal data and delete your account and data within 30 days, subject to any data we are required by law to retain.
Response deadline: We will respond to your request within 90 days, as specified in the DPDP Rules, 2025.
Data Protection Contact: See Section 15.
8.5 Users in Other Jurisdictions
If you are located in another jurisdiction that provides privacy rights (e.g. Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, or other US states with privacy laws such as Virginia, Colorado, Connecticut, Texas, Oregon, Montana, etc.), we will make reasonable efforts to honor your requests to access, correct, delete, or export your personal data. Please contact privacy@oddvue.com.
10. OddVue Browser Extension — Specific Disclosures
This section provides detailed information about the data practices of the OddVue browser extension, as required by Chrome Web Store policies and applicable privacy laws.
What the extension does
The OddVue browser extension is a convenience tool that helps you capture trade data (such as symbol, price, exchange, and timestamp) from supported third-party web pages and send that data into your OddVue journal. Captured values may populate journal fields and Position Manager inputs after you can edit or confirm them. Position Manager does not receive a hidden TradingView feed. The extension's purpose is to reduce manual data entry.
What pages the extension runs on
The extension is configured to run only on specific pages that we designate. For example:
- Certain TradingView chart pages (e.g. URLs matching
tradingview.com/chart/*or similar patterns)
The extension does not run on, read from, or interact with any other websites. The specific URL patterns are declared in the extension's manifest file and can be verified in your browser's extension permissions.
What data the extension captures
When active on a supported page, the extension may read:
- Symbol (e.g. "AAPL", "BTCUSD")
- Price (e.g. current or last traded price displayed on the page)
- Exchange (e.g. "NASDAQ", "NSE")
- Timestamp (e.g. the time displayed on the chart or the time of capture)
This data is captured from the visible content of the supported web page (i.e. what is already displayed in your browser).
What the extension does NOT capture
- Passwords or login credentials for any website
- Cookies or session data from third-party websites
- Data from websites the extension is not configured to run on
- Your browsing history (other than the fact that you visited a supported page while the extension was active)
- Any data from your brokerage, exchange, or trading account beyond what is visibly displayed on the chart page
Where extension-captured data goes
- Captured fields are sent from the browser extension to the OddVue desktop application on your computer (
localhost). After you attach the extension, that send is encrypted on the device so only that OddVue application can decrypt it. OddVue then stores the values in your local journal. We do not send extension capture to OddVue's cloud instead of the desktop app; the desktop app is the first hop. - It is treated identically to manually entered journal data for the purposes of this Privacy Policy (storage on the device, deletion, export, and all your privacy rights apply).
- No extension-captured data is sent to any third party other than our own infrastructure (Railway for hosting, as described in Section 5).
Your control
- You can disable or uninstall the extension at any time through your browser's extension settings.
- You can review and edit all data captured by the extension in your OddVue journal — the captured data populates editable fields.
- You can delete any journal entry, including those created by the extension.
Accuracy
We do not guarantee that the extension will capture data correctly or completely in all cases. Capture accuracy may vary depending on the webpage structure, platform updates, browser, device, or exchange. You are responsible for verifying captured data. See our Terms of Service, Section 11 for full details.
11. Third-Party Websites and Features
OddVue includes features that direct you to third-party websites and may copy text to your local clipboard. For example:
| Button | OddVue does | You do |
|---|---|---|
| FinTwit Ft.X | Open an X public search URL; copy a research prompt to the clipboard | View X; optionally paste into Grok or another tool |
| Res Ft.PPLX | Open a Perplexity Finance URL; copy a prompt to the clipboard | Paste or submit on Perplexity |
| Deep Ft.Gem | Open gemini.google.com/app; copy a prompt to the clipboard | Paste; optionally select Deep Research in Gemini's UI |
| Fin Ft.Goog | Open a Google Finance quote URL; copy a prompt to the clipboard | View the dashboard; optionally paste into Research |
OddVue does not transmit your journal or personal data to X, xAI, Perplexity, or Google except: (1) ticker syntax in a user-opened public URL (X search query; Perplexity Finance path; Google Finance quote path google.com/finance/quote/SYMBOL:EXCHANGE or google.com/finance/quote/BTC-USD), and (2) whatever you later paste or submit yourself. OddVue does not use those platforms' APIs, scrape them, or post on your behalf.
OddVue may record that you used a facilitation button, as described in Section 2.2. We still do not submit content to those sites for you.
Your interaction with those websites is governed by their own terms and privacy policies, not by this Privacy Policy. Those include, without limitation: X Terms and Privacy Policy; xAI Terms and xAI Privacy Policy when you use Grok; Perplexity Terms and Privacy Policy; and Google Terms of Service, the Gemini Apps Privacy Notice, the Google Privacy Policy, and the Google Finance disclaimer when you use Gemini Apps or Google Finance.
Google may use Gemini chats (including Research on Google Finance, which is Gemini-family) to improve its services and may use human reviewers, as described in Google's notice. OddVue does not control that. Do not put confidential journal notes in the default prompt (the product copies a ticker and research instructions).
We are not responsible for the content, availability, or privacy practices of any third-party website.
12. Children's Privacy
The Service is not directed at or intended for use by individuals under the age of 18 (or the age of majority in the user's jurisdiction, if higher).
We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will take steps to delete that data promptly.
Under India's DPDPA 2023, processing of children's personal data requires verifiable consent from a parent or legal guardian. Since we do not target children and require users to be at least 18 years old, we do not implement a parental consent mechanism. If a parent or guardian believes their child has provided personal data to us, they should contact us at privacy@oddvue.com, and we will delete the data.
13. Security
We implement reasonable technical and organizational measures to protect your personal data, including:
- Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
- Encryption at rest: Account data in Postgres is encrypted at rest by the database host. Optional OddVue copies in Railway Storage Buckets are encrypted at rest per Railway.
- Password hashing: Passwords are stored as cryptographic hashes (bcrypt); we never store or have access to your plain-text password.
- Authentication: All API endpoints that access personal data require authentication (JWT tokens).
- User isolation: Database queries are filtered by user ID to prevent access to other users' data.
- Rate limiting: API endpoints are rate-limited to prevent brute-force attacks and abuse.
- Access control: Access to production infrastructure and databases is restricted to authorized OddVue personnel.
No system is perfectly secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@oddvue.com.
If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant authorities in accordance with applicable law.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do:
- We will update the "Last updated" date at the top of this page.
- For material changes (e.g. new categories of data collected, new third-party processors, changes to your rights, or changes to how we use your data), we will notify you by:
- Email to your registered address, and
- A prominent notice in the Service (e.g. a notification at login requiring re-acceptance — see Terms of Service, Section 18)
- For minor changes (e.g. clarifications, formatting, corrections that do not change the substance), we may update the Policy without individual notice.
Your continued use of the Service after we post changes constitutes your acceptance of the updated Policy, except where applicable law requires your explicit consent — in which case we will require re-acceptance before you can continue using the Service.
Version history is at /privacy/history. Replaced versions will be listed there after this Policy is updated, and remain available upon request.
15. Contact and Data Protection Officer
For questions about this Privacy Policy, to exercise your privacy rights, to submit a Data Subject Access Request (DSAR), or to file a grievance, please contact:
Data Protection Contact
ODDVUE PMI LLP
Email: privacy@oddvue.com
Website: oddvue.com/contact
Registered Office: Z P COLONY, PLOT NO 51, SATARA-415002, MAHARASHTRA, INDIA
How to submit a request:
- Preferred: Email privacy@oddvue.com with the subject line "Privacy Request — [Access / Deletion / Correction / Other]".
- In-app: Use the "Export my data" or "Delete my account" features in the application settings.
- Response time: We will acknowledge your request within 5 business days and complete it within the applicable deadline for your jurisdiction (30 days for GDPR, 45 days for CCPA, 90 days for DPDPA).
Complaints:
- EEA users: You have the right to lodge a complaint with a supervisory authority in the EU member state where you live or work. A list of authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
- UK users: You may complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.
- Indian users: You may file a complaint with the Data Protection Board of India (once established and operational) at https://www.meity.gov.in/.
- California users: You may contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/.