Privacy Policy
Rafi is a phone app that reads your business's Odoo so you can ask questions about it, set up monitors that watch it, and get alerts. This policy says what we collect, why, who else sees it, and what you can do about it.
Who we are
Vortex Studios Ltd publishes Rafi and is the controller of the personal data described here. It's a company registered in England and Wales (company number 15754797), with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Contact: j@vortexstudios.io.
What Rafi does in your Odoo
Rafi reads your Odoo as a separate read-only user. Before it connects, it checks that this user can't create, change or delete sales orders, purchase orders, stock, invoices or products, and refuses one that can. Rafi changes something in your Odoo only when you confirm the change in the app, or to set up, renew and tidy up its own read-only user.
If an Odoo admin signs in to set Rafi up or renew its access, their password and any two-factor code are used for that step only. They're never stored, logged or sent to an AI provider.
The read-only user's key is encrypted as soon as Rafi has it. It's never kept on your phone or sent to an AI provider.
After setup, Rafi reads only the Odoo apps and companies you choose.
People in your business
An admin of an Odoo that's already connected can join its business in Rafi as a manager. The owner is told, and sees who joined on the People screen.
Everyone in a business shares its read-only user and its AI credits. A manager only gets answers about the companies their own Odoo user can see. Rafi checks this each day, and asks managers to sign in to Odoo again every 90 days.
Each person's chats, monitors and alerts are private to them. Nobody else in the business sees them, the owner included.
A manager's chats, monitors and alerts are deleted when the owner removes them, when their Odoo user is archived or can't see any of the business's companies, or when the business moves to another Odoo database.
What we collect
- Your account: the name, email and id that Apple or Google share when you sign in, the tokens they issue, your business and role, and when you agreed to AI sharing and usage stats. If you signed in to Odoo to set up or join, also that Odoo user's name and id and the companies it can see.
- Your sign-ins: for each signed-in phone, a session token, its IP address and device type.
- Your business: its name, currency and time zone, the Odoo address and database and Odoo's id for it, the read-only user's login and encrypted key, and which apps and companies Rafi reads.
- Your chats: your questions, the answers, and the Odoo records read to answer them. You can delete a chat in the app while your Odoo is connected, or ask us by email at any time.
- Your monitors and alerts: what each monitor watches, the alerts it raised and the records they're about, and weekly summaries with the figures and records they list.
- Your phone's settings: its language, region and clock format go with each request, so answers use your formats. If you turn on notifications, we keep its notification token, language and region, and your quiet hours.
- Usage records: the Odoo reads made for you (not the records themselves), how many questions each person asked, the AI tokens and credits used, and a record of each AI call with what it was for, the model used, its cost, timing and outcome, and the provider's reference for it. These never hold a question, an answer or Odoo data.
- If you're removed: a short record, so you can't rejoin until the owner allows it. It's deleted when they do or when you close your account. If you leave a business any other way, a note stays until you join another business or close your account.
- The in-app waitlist: if your Odoo can't connect yet, the email and Odoo address you give us. We use them only to tell you when it can, and leaving the list in the app deletes them.
- Support: we look at a chat or monitor only when you ask us for help with it and agree. We record who looked, which one and when, but nothing from it.
How long we keep it
We keep your data while your account is open. You can delete your account in the app under Settings › Delete account (how to delete your account). An owner's deletion closes the business for everyone in it. A manager's deletion removes their account, chats and monitors, and the business keeps its usage records without their name. Copies in our backups are gone within 90 days. If you can't use the app, email us and we delete your account within 30 days.
Deleting your account doesn't remove the read-only user from your Odoo. Archive it there.
AI providers
Rafi uses AI providers to answer questions and run smart monitors. Nothing goes to them until you agree in the app. Rafi can't answer without them, and you can stop sharing at any time in Settings › AI sharing.
When it's on, they get your question, the earlier messages in that chat with the Odoo records read for them, and the Odoo records needed to answer, such as stock counts, sales totals and customer names. When you set up a monitor, they get what you type to describe it. Smart monitors send them the rows they check.
They never get your Odoo key or passwords. They don't keep what they're sent or train their models on it.
Before a new AI provider gets anything, Rafi asks for your OK in the app.
Usage stats
Usage stats are a fixed list of events, like "question sent", holding only categories, numbers and yes/no values. They carry random ids for you and your business, never your questions, answers, Odoo data, name or email. Your IP address isn't kept and there's no session recording.
If your phone's region is set to the EU, the EEA, the UK or Switzerland, nothing is sent until you tick "Share usage stats" or turn it on in Settings. Elsewhere it's on, and you can turn it off in Settings › Privacy › Usage stats. Events are kept for 12 months.
Who else handles your data
We use service providers that act only on our instructions, under contracts that require them to protect your data as this policy does.
- AI providers, as above.
- Hosting and security providers in the EU, which run Rafi, store its data and backups, and hold the keys that encrypt your Odoo key.
- A crash-reporting provider, which keeps reports in the EU for 30 days. A report says what failed, the app version and the phone's model and system, and after a crash more about the phone's settings, hardware and state. It carries random ids only, including one made for the app on that phone, never an advertising id. A crash can catch a fragment of a question, an answer or an Odoo value, which is deleted as the report arrives, before it's stored.
- A usage-stats provider in the EU, when usage stats are on.
- A notification and app-update provider. A notification says only what kind of alert it is, how many updates a digest has, or that someone joined. The details open in the app. When the app checks for an update, this provider sees your phone's IP address, the app version and a random id, to count installs.
- Apple and Google, for sign-in, subscriptions bought in their stores, and delivering notifications. We learn whether you're subscribed, never your payment details.
If you tap the microphone, your phone's own speech recognition turns your voice into words and may send it to Apple, Google or your phone's maker under their terms. We get only the words, once you send them.
Our providers lists each provider by name, with what it does and where. We update it before a new provider starts.
The website
hellorafi.com has no cookies, analytics or ads, and loads nothing from other sites. Our hosting provider logs each visit with its IP address to keep the site running and safe.
If you join the waitlist, an email provider in the EU keeps your email and which kind of Odoo you use, and sends our emails. If the link that brought you to hellorafi.com names an ad or site, it keeps that too. We first email you a link, and you're on the list only once you open it. Our emails record when they're opened and their links clicked. We use the list only to tell you when Rafi launches, and the ad or site only to see which ones bring people. We keep your details until then or until you leave. Every email has a link to leave the list, which deletes your details from it.
Data outside the UK and EU
Rafi's servers and database are in the EU. Some providers, including AI providers, handle data in the US or other countries. Each of these transfers is covered by a UK or EU adequacy decision, such as the EU-US Data Privacy Framework for providers certified under it, or by the European Commission's standard contractual clauses with the UK's addendum to them. Email us for a copy.
Why we use it (legal bases)
- To run Rafi for you: your account, connection, chats, monitors and alerts, and support you ask for (contract).
- Answering with AI providers: to provide the service you signed up for (contract), once you've agreed in the app. You can stop it in Settings.
- Usage stats: your consent where we ask for it, otherwise our legitimate interest in improving Rafi, which you can turn off.
- Security, the activity log, crash reports and the record of each AI call: our legitimate interest in keeping Rafi safe, working and affordable.
- The website's waitlist: your consent, given when you open the link in our first email. You can leave from any of our emails.
- The ad or site that sent you to the waitlist: our legitimate interest in knowing which ones work.
- The website's visit log: our legitimate interest in keeping the site running and safe.
Your rights
You can ask for a copy of your data, including the names of everyone who receives it, or ask us to correct it, delete it, restrict or object to how we use it, or move it elsewhere, by emailing us. If you're in the UK or EU you can also complain to your data protection authority (in the UK, the ICO).
Changes
We'll update this page when what we do changes, and tell you in the app when the change matters.