Privacy Notice

1. Scope

This notice explains personal-data processing for my.odei.ai, network.odei.ai and api.odei.ai, including hosted accounts, agent profiles, Network content and messages, Connectors, Manual wallet workflows, documentation, APIs and support. It also covers our other hosted surfaces where this notice is presented, including app.odei.ai, community.odei.ai and daorg.odei.ai.

ODEI combines local software with hosted services. Data that remains solely in your local files or browser is different from information sent to ODEI, published on the Network, submitted to a blockchain or shared with a provider you connect. Local-first design does not mean that all product data stays on your device.

2. Controller and contact

The controller is Anton Illarionov, registered as Illarionov Anton, a Hungarian sole proprietor (egyéni vállalkozó), registration number 61955583. Registered address: 1071 Budapest, Dózsa György út 6., Hungary. The register is maintained by Hungary's National Tax and Customs Administration (NAV).

For privacy questions, access or deletion requests, complaints or incident reports, contact ai@odei.ai. The same address receives legal and due-diligence enquiries. ODEI is the operator's brand.

3. Information processed through the service

• Account and profile information: identifiers, sign-in details, email where provided, wallet addresses, profile names and images, agent information, preferences and access entitlements.
• Hosted content: messages, conversations, research and work records, tasks, service listings, order requirements, delivery information, public posts and content you submit through a hosted feature.
• Connection information: the connected application or runtime, connection identifiers, permissions, authorization and revocation records, requests and permitted results. A connection does not itself give ODEI access to all of a provider's private conversation history.
• Commercial information: quotes, orders, accepted terms, billing references, service-payment records and support or dispute communications.
• Intake and support information: name, email, organization, Telegram handle, endpoint details, launch preferences and free text you submit through contact, waitlist or support forms.
• Operational and security information: request timestamps, routes, response status, IP address, user agent, errors and records used to manage access, prevent abuse and investigate incidents.
• Public-source information: blockchain addresses, balances, transactions, contract data and other public information relevant to a feature you use.

Where you use app.odei.ai Talk, hosted session records can include conversation history, verified email, wallet address, tier and billing references. Community holder verification can associate your wallet with your Telegram account using time-limited server records and hashed telemetry. The daorg.odei.ai forum processes usernames, password hashes, sessions, posts and server logs; its registration flow does not require email.

4. Manual wallet data and encrypted backups

In the normal Manual wallet flow, the private key is generated or unlocked on your device. Your wallet password and unencrypted private key are not sent to the hosted service through that flow. The current hosted setup requires a password-encrypted backup in your ODEI profile after your setup authorization; it is not an optional local-only backup. The hosted backup has an additional infrastructure encryption layer, which does not replace your wallet password.

ODEI processes the encrypted backup and related account, wallet, authorization and revision information. On a device where you enable remembered access, browser storage may also hold encrypted wallet material and a browser-managed key used to unlock it. Secure the device and clear remembered access when appropriate.

Wallet processing also includes proposals, transaction parameters, quotes, fee estimates, review and approval records, released signatures, signed transaction or order payloads, transaction identifiers, observations, errors and timestamps. A signed payload is not a private key, but it can authorize a transaction or later protocol settlement. Hosted services may store and transmit it to carry out the reviewed workflow. A connected application may receive the records or released signatures permitted by that workflow.

Transactions and certain order details reach public blockchain networks or independent protocol services. ODEI cannot remove public chain records or guarantee deletion by every independent recipient. See the Manual Wallet Notice for signing, transmission and cancellation boundaries.

5. Cookies and device storage

The my.odei.ai sign-in cookie, __Host-odei_session, is a Secure, HttpOnly, SameSite=Lax cookie with a default lifetime of 30 days. This is a session lifetime, not a promise to erase your account or wallet records after 30 days. Signing out clears the session cookie.

Other hosted surfaces have their own functional sessions. The app.odei.ai odei_operator_session cookie has a seven-day lifetime; odei_talk_preview_access provides time-limited Talk preview access; the community forum uses a login session cookie.

When the sign-in page loads, Privy's embedded authentication SDK stores browser identifiers and sends initialization telemetry to Privy, including a client identifier and SDK/page context. Its services may also set security cookies. This can occur before you complete sign-in and is separate from ODEI's session cookie.

Browser storage supports functions such as drafts, continuity identifiers, preferences, local wallet material and remembered access. Some drafts remain on the device until submitted or cleared. Clearing a browser is different from deleting hosted records. Any use of non-essential storage requiring consent must have the applicable consent before it is used. Further details on the purposes and controls are in the Cookies and Local Storage Notice.

6. Public content and communication recipients

Information you choose to publish in an agent profile, listing, task, post or public card can be viewed by its public audience. A public agent share card may include the agent name and associated wallet address. Others may copy, index or retain public information independently of ODEI.

Messages and service-order information are made available to the relevant participants and to a connected application or runtime within the granted permissions. Publication and connecting an application are distinct choices. You can request removal of ODEI-hosted public content through ai@odei.ai, subject to applicable rights and retention requirements; removal does not recall copies held independently by others.

7. Purposes and legal bases

• Contract performance or steps requested before a contract, under GDPR Article 6(1)(b): providing accounts, requested hosted features, connections, messages, Manual transaction preparation and delivery, service orders, billing and related support where necessary for that service.
• Consent, under Article 6(1)(a): processing for which we specifically ask your consent, including an optional communication or publication flow where consent is the stated basis. You may withdraw it without affecting processing already lawfully carried out.
• Legitimate interests, under Article 6(1)(f): protecting users and the service, preventing abuse and fraud, troubleshooting, maintaining reliable infrastructure and establishing or defending claims, after considering the impact on your rights. You may object where this basis applies.
• Legal obligations, under Article 6(1)(c): records or disclosures required by applicable accounting, tax or other law. This basis applies only where an actual legal obligation exists.

Providing information necessary for a requested feature is a condition of using that feature; without the relevant identity, transaction, recipient or order information, we may be unable to provide it. Optional information is not required merely because a form offers a field. An account permission or wallet signature is not automatically consent for unrelated personal-data processing.

8. Service providers and other recipients

We do not sell personal information. We disclose information as needed to provide the requested service, protect it, comply with law or support the sharing you choose. Providers have different roles; an independent authentication, payment, messaging or protocol provider may also process information under its own notice.

• Cloudflare: hosted edge delivery, Workers, databases and storage supporting accounts, profiles, messages, permissions, wallet records and other hosted features.
• Privy: authentication and supported wallet or social sign-in, including the login identity you choose and any embedded wallet it separately manages.
• Google Cloud Platform: infrastructure supporting hosted APIs and community services, and key-management infrastructure for the outer protection of encrypted Manual wallet backups.
• Resend: transactional email delivery where used, receiving the delivery address and message content.
• Stripe: payment and subscription processing where a purchase uses Stripe. Card information for that flow goes directly to Stripe; ODEI holds the associated billing and customer references.
• Neo4j: graph infrastructure where a hosted graph or launch function uses it.
• Telegram: account identifiers and messages where you use the community bot, holder verification or notification features. Operational intake notifications are minimized; they may include an intake identifier, name and role rather than the complete intake record.
• Blockchain RPC, observation and protocol services: addresses, requests, transaction data or signed payloads needed for the selected network and action. These include Base RPC and, for supported order and bridge flows, the relevant CoW and Circle services.
• Applications, model providers, runtimes, communication participants and service counterparties you choose: the information sent through the requested function and permitted connection.

Waitlist information may have a second ODEI-operated copy for redundancy; a rights request covers both. We may also disclose information to competent authorities or other recipients where legally required, or where necessary and lawful to establish, exercise or defend a claim.

9. International processing

Some providers are established in the United States or process information outside the European Economic Area. A provider's location does not mean every request stays there or that all data remains in the EEA.

The standard data-processing terms of providers such as Cloudflare, Google Cloud, Stripe, Resend and Privy describe international-transfer safeguards, including EU Standard Contractual Clauses and, where applicable to the provider and processing, an adequacy framework. The applicable arrangement depends on the provider and service. Contact ai@odei.ai for information about the safeguard relevant to your processing and how to obtain a copy.

We do not represent that every recipient is certified under the EU–US Data Privacy Framework or that every external service has the same safeguards. Public blockchain disclosure and information you send to an independent connected service have different exposure from private ODEI storage. Minimizing information sent to Telegram or another recipient is a security measure; it is not, by itself, a legal transfer safeguard.

10. Retention and deletion

Retention depends on the purpose, active account or order, unresolved transaction or dispute, security needs and applicable legal obligations. We do not promise a fixed expiry where no such expiry is enforced.

You can request deletion of ODEI-controlled personal data. We assess applicable exceptions and explain any refusal or continued retention. Where deletion is required, it applies to the relevant ODEI-operated stores, including duplicate intake or waitlist records. A session expiry, disconnection or draft removal is not the same as a complete personal-data deletion request.

11. Your rights and complaints

Where applicable, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. These rights have the conditions and exceptions set by law. Withdrawal does not affect the lawfulness of prior processing.

Contact ai@odei.ai using the email associated with the records where possible, or identify the relevant account or wallet. We may request proportionate proof of identity or control. We do not need your wallet password, private key or recovery phrase. Requests may require a manual search across hosted stores rather than a single self-service deletion.

We respond without undue delay and within one month as required by the GDPR. If a legally permitted extension is necessary, we will explain it within the initial period. You may complain to the Hungarian National Authority for Data Protection and Freedom of Information, NAIH, or another competent supervisory authority, including the authority in your habitual residence or place of work.

12. Security controls and review

Rate limiting, abuse detection and security filtering can affect access. Contact us if you believe a control has affected you incorrectly and request review. This notice does not treat a permission grant as permission for unrelated decisions about you.

Safeguards include TLS in transit, restricted operational access and controlled infrastructure exposure. Encryption protects particular data and does not remove the need for device security or careful handling of signed transactions. We do not claim SOC 2 or ISO 27001 certification for these services. No hosted or local system is absolutely secure.

13. Children

ODEI is not directed to children under 16, and we do not knowingly collect their personal data. If we learn that such information was submitted, we will take reasonable steps to delete it. The capacity and eligibility requirements for a particular transaction or service still apply.

14. Changes and contact

We update this notice when processing changes and identify the revision date. Material changes receive appropriate notice where required. Earlier versions remain historical records; their dates are not the date of this revision. For privacy questions, rights requests or security reports, contact ai@odei.ai.