Your data, handled the way we handle a case.

§ 01

Who we are

Odjo Ltd (“Odjo”, “we”, “us”) builds case-management software for property teams. The product captures conversations across phone, email, WhatsApp and web chat, turns each one into a tracked case against the right property, and allocates it to the right person - so nothing gets lost between lettings, management and accounts. Odjo Ltd is registered in England and Wales, company number 15812052.

This policy covers this website and the Odjo platform. Odjo Ltd is the data controller for the personal data described here and is responsible for it under the UK General Data Protection Regulation and the Data Protection Act 2018. Any enquiry about your data can be sent to hello@odjoai.com.

You have the right to complain at any time to the Information Commissioner’s Office (ico.org.uk), the UK supervisory authority for data protection. We would appreciate the chance to address your concern first, so please contact us before you approach the ICO.

§ 02

The two hats we wear

For visitors to this site - when you browse, book a demo or contact us - Odjo is the data controller. We decide what is collected and why, and this policy is the full story.

Inside the product, the position is different, and it matters. When a tenant rings a number Odjo answers for a property firm, or emails an inbox Odjo watches, that conversation belongs to the property firm - they are the controller, and Odjo processes it as their processor, on their documented instructions, under a data-processing agreement. In that role we:

• process personal data only on the controller’s instructions, and ensure everyone with access is committed to confidentiality;
• apply technical and organisational security measures appropriate to the risk;
• engage no further processor without the controller’s prior authorisation;
• assist the controller in responding to data-subject requests, and make available what is needed to demonstrate compliance, including audits;
• notify the controller without undue delay after becoming aware of a personal-data breach;
• return or delete all personal data at the end of the contract, at the controller’s choice.

Sub-processors

We use a small number of trusted providers to run the product. Each processes personal data only to provide its part of the service, under contractual protections consistent with UK data protection law.

• Supabase - database hosting and the case record - United Kingdom
• ElevenLabs - AI voice answering and transcription - United States
• Twilio - inbound and outbound call handling - United States
• OpenAI - language-model processing for extraction and drafting - United States
• Google - email integration where you connect a Google account, via OAuth - United States

We will tell affected controllers before adding or changing a sub-processor, giving them the chance to object.

If you are a tenant, leaseholder, landlord or contractor whose messages pass through Odjo, your first port of call for privacy questions is the property firm you deal with - and we will support them in answering you.

§ 03

The data we collect

On this website and in our dealings with you, we may collect:

• Identity & contact data - your name, email address and phone number, for example when you book a demo or email us;
• Technical data - IP address, browser type and version, operating system and approximate location;
• Usage data - how you use the website and the product;
• Marketing preferences - whether you want to hear from us;
• Billing & transactional data - for customers, billing details and records of payments.

Inside a customer’s workspace, the product captures the communications the customer connects: call recordings and their transcripts, emails, WhatsApp and web-chat messages, and the case details drawn out of them - the property they concern, the issue raised, who it is allocated to, and the documents and invoices attached to the case. That is the product working as designed: every conversation lands on the property record it belongs to.

§ 04

What the AI does with it

Odjo’s core technology is applied to one job: turning unstructured conversations into structured cases. In practice, that means:

• Transcription - inbound calls are answered and transcribed, so a searchable written record exists alongside the recording;
• Extraction - language models read each call, email or message and draw out the case details: which property it concerns, what the issue is, and how urgent it is;
• Drafting & answering - the assistant drafts replies and answers questions from what is already on the record.

The content of your communications is not used to train generalised AI models. Models process your data to run the product for you - every action they take is written to the case record, which is the audit trail the product exists to provide.

The assistant triages and prioritises cases to help your team act quickly, but it does not make decisions that produce legal or similarly significant effects on anyone by automated means alone. A person stays in control of the case.

§ 05

Email & OAuth integrations

Where you connect an email account, Odjo integrates using OAuth - a secure protocol that grants limited, scoped access without ever sharing your password. Depending on the scopes you approve, that access lets Odjo read incoming mail into the case record, send replies on your behalf, and manage “send as” aliases you explicitly approve.

• Access is limited to the scopes you grant, and you can revoke it at any time from your email provider’s settings - for Google accounts, at myaccount.google.com/permissions;
• data accessed through Google Workspace APIs is not used to develop, improve or train generalised AI or machine-learning models, in line with Google’s API Services User Data Policy;
• messages captured into your workspace are retained on the case record under your organisation’s control, for as long as your organisation keeps them.

§ 06

Our legal bases

Every use of personal data rests on one of the legal bases the UK GDPR lays out:

• Consent - where you opt in, for example to marketing;
• Contract - data needed to provide the service you have signed up for;
• Legal obligation - data we must process by law, such as for fraud prevention;
• Legitimate interests - data necessary to run our business, where that does not override your rights.

Special categories of personal data are processed only with explicit consent.

§ 07

Hosting, security & retention

Primary data stores, including the case record where your conversations and cases live, are located in the UK. Some processing is carried out by sub-processors outside the UK, under the safeguards described in the international transfers section. We apply technical and organisational measures appropriate to the risk of the processing, and limit access to people who need it and are bound by confidentiality.

Workspace data - the calls, messages and cases on your property records - is retained while your organisation is a customer and in line with its instructions, because the complete record is the point of the product. Website and account data is kept no longer than needed for the purposes above.

If you ask us to delete your data, we will permanently delete it within 14 business days - including revoking any active integration tokens - unless the law requires us to keep it.

§ 08

International transfers

Some of the processing behind the product is carried out by trusted providers located outside the UK, principally in the United States, so that calls can be answered, transcribed and turned into cases. Where personal data is transferred outside the UK, we rely on the safeguards UK data protection law provides for those transfers - the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, and, where a provider is certified, the UK Extension to the EU-US Data Privacy Framework. The case record itself, where your conversations and cases live, is held in the UK.

§ 09

Your rights

Under the UK GDPR you have the right to:

• request access to the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing of it;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis.

To exercise any of these, email hello@odjoai.com. For deletion, use the subject line Data Deletion Request. None of these rights costs anything to exercise. Deletion requests are actioned within 14 business days; we respond to any other request within one month.

§ 10

Cookies, changes & contact

This site keeps tracking to a minimum. We use privacy-respecting, aggregate page analytics to understand how the site is used. Third-party tools load only when you use them - the scheduling widget when you book a demo, and the video player when you play the product demo - and each is governed by its own privacy policy.

When this policy changes, we will update it here and revise the date at the top of the page.

Questions, requests or concerns: hello@odjoai.com.