Privacy policy

1. Who we are

This Privacy Policy explains how Odvert ("Odvert", "we", "us") collects, uses, and shares personal data when you use our website, marketplace, dashboard, waitlist, and related services (the "Service").

Related product rules are in our terms of service. Contact details for privacy requests will be published here when available.

2. Data we collect

Depending on how you use Odvert, we may collect:

• Account and profile data: email address, name, company name, website URL, and similar profile fields you provide.
• Authentication data: magic-link sign-in details, session information, and, if you choose GitHub sign-in, identifiers and profile information provided by GitHub for authentication.
• Waitlist data: email, name, interest (publisher, advertiser, or both), website, company, and optional visitor or ad-budget ranges.
• Marketplace and campaign data: website listings, descriptions, categories, placement settings, prices, creatives, campaign details, approvals, messages related to bookings, and usage of the dashboard.
• Traffic verification data: if a Publisher connects Google Analytics, we process connection status and aggregated traffic or audience insights needed to verify and display site metrics on Odvert.
• Payment data: billing and payout-related information processed by our payment provider (Stripe). We do not store full card numbers on Odvert servers; Stripe handles sensitive payment credentials.
• Technical and usage data: IP address, device and browser information, pages viewed, referrers, and approximate location derived from IP, used to operate, secure, and improve the Service.
• Communications: emails and messages you send us, and transactional messages we send you (for example magic links or booking notices).

3. How we use data

We use personal data to:

• Provide, operate, and improve the Service.
• Create and manage accounts, authenticate users, and keep the Service secure.
• Run the marketplace: listings, browsing, bookings, creatives, approvals, and campaign delivery tooling.
• Process payments, platform fees, refunds, and publisher payouts.
• Verify publisher traffic where a Publisher connects analytics.
• Manage the waitlist and communicate about access, product updates, and service messages.
• Detect abuse, fraud, and violations of our Terms.
• Comply with law and enforce our rights.

Where UK GDPR or similar laws apply, we typically rely on one or more of: performance of a contract, legitimate interests (such as securing and improving the Service), consent (where we ask for it), and legal obligation.

4. How we share data

We may share personal data with:

• Other marketplace users, as needed to operate bookings (for example, Publishers seeing advertiser campaign details they need to approve, and Advertisers seeing public or authorised listing information).
• Service providers that help us run Odvert, including hosting, authentication (such as Supabase), payments (Stripe), email delivery, and analytics.
• Professional advisers or authorities when required by law or to protect rights, safety, or security.
• A buyer or successor if we are involved in a merger, acquisition, or asset sale, in which case data may transfer under appropriate safeguards.

We do not sell your personal data. Marketplace visibility settings may limit what guests can see about a listing; signed-in users may see additional listing details as described in the product.

5. Cookies and similar technologies

We use cookies and similar technologies that are necessary to run the Service, such as authentication and session cookies so you can stay signed in and use the dashboard securely.

We also use Simple Analytics for privacy-friendly website analytics. Simple Analytics is designed to avoid tracking individuals across sites and typically does not rely on cookies for analytics. You can learn more at Simple Analytics' privacy documentation.

Your browser may let you block or delete cookies. Blocking essential cookies may prevent sign-in or other core features from working.

6. International transfers

We and our providers may process data in the United Kingdom, European Economic Area, United States, or other countries. When we transfer personal data internationally, we use appropriate safeguards required by applicable law (such as standard contractual clauses) where needed.

7. Retention

We keep personal data only as long as needed for the purposes described in this policy, including to provide the Service, resolve disputes, enforce agreements, and meet legal, tax, and accounting requirements. Retention periods vary by data type. For example, account data is generally kept while your account is active and for a reasonable period afterward; payment records may be kept longer where required by law.

8. Security

We use technical and organisational measures designed to protect personal data, including access controls and encrypted transport (HTTPS). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office).

To exercise privacy rights, use the contact details published in this policy when available. We may need to verify your request before acting on it. Some account settings can also be updated directly in the dashboard.

10. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

11. Third-party sites and services

The Service may link to or integrate third-party sites and services (including Stripe, Supabase, GitHub, Google Analytics for connected Publishers, and Simple Analytics). Their privacy practices are governed by their own policies. We are not responsible for third-party practices we do not control.

12. Changes

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Continued use of the Service after an update means you acknowledge the revised policy. If changes are material, we may provide additional notice in the product or by email where appropriate.

13. Contact

Contact details for privacy requests and questions will be published here when available.