Privacy notice

Who we are

ZALTRIC LIMITED is the data controller. We are a company registered in England and Wales, company number 17138588, and our registered office is 31a Dewsbury Gate Road, Dewsbury, England, WF13 4AX. We are registered with the Information Commission as a data controller, reference ZC267968. Write to us through the contact page, or by post to our registered office, about anything in this notice.

If you visit this site

• No cookies, and no analytics service. No page on this site makes a request to a third party, with one exception: the contact form and the invitation form load Cloudflare Turnstile, a check that a submission comes from a person. That check may set a cookie on those two pages only, for that purpose only.
• Page views. We count page views ourselves, on our own server: which page, which website linked to it, and the campaign tag in the link, if any, so we know which posts bring people. We also note whether the visit looks like a search engine or other automated program rather than a person, so that programs are not counted as readers. We keep nothing that identifies you: not your network address, your browser or anything else about you. This serves our legitimate interest in knowing which of our posts bring visitors to the site. The page-view count is kept for three months, then Cloudflare deletes it.
• Server logs. The program that runs this site keeps no log of your visit: its logs are switched off. Cloudflare, which carries every request to the site, keeps its own security records, for a period Cloudflare sets and we do not, and shows us summary statistics about traffic to the site. Both serve our legitimate interest in keeping the site running and secure.
• The contact form. Your name, email address and message are emailed to our mailbox so that we can reply. To check that the message comes from a person, Cloudflare Turnstile is given your network address. This site keeps no copy of the message. We keep the conversation for up to 12 months after the last message, then delete it.
• The invitation form. Your name, email address, shop name, shop website, Odoo version, where Odoo runs, the country you sell in, the number of products, the plan you are interested in and anything else you write are emailed to our mailbox so that we can decide the invitation and reply. Turnstile checks it the same way. This site keeps no copy of the request. We keep the conversation for up to 12 months after the last message, then delete it.
• The free checker. Our free checker, which shows what an AI assistant can see of a shop, has its own privacy notice.

If you subscribe

• Billing. Stripe takes the payment and holds the card. We see your name, email address, company name, address and invoices, never the card number. We keep invoices and payment records for 6 years after the end of the financial year they relate to, because UK tax law requires it. We delete them after that. The notices Stripe sends us about your billing, which carry your name, email address, billing address and any tax number, are deleted 30 days after we have processed them.
• Your catalogue. The module sends your product details (names, descriptions, prices, stock, images and the shop they belong to). When you connect, it also sends the details that describe your Odoo: its version and edition, where it is hosted, its web address and database ID, its websites, languages and currencies, and the module's own version. On its own, it does not send Zaltric your customer list or your orders. Once a night, a connected module (version 6.31.1 and later) also reads a small public file on downloads.zaltric.com to learn whether a newer version exists. That request carries nothing about your shop: like any visit to a web page it comes from your server's internet address, and it names no shop, product or version. When an order comes from a checkout its platform signed, your Odoo sends that platform updates on the order (confirmed, cancelled and delivered, and also refunded, with the amount, for checkout inside AI assistants) directly, not through Zaltric. The catalogue is kept while the connection exists. When the connection is closed, your shop window stops serving it within about a minute and it is deleted from our database within about 91 days; write to us to have it removed sooner.
• Your shoppers and customers, through the shop window. When a shopper checks out through an AI assistant, their name, email address, phone number and delivery address pass through Zaltric's shop window into your Odoo, which keeps them on a quotation in your Sales app. Your Odoo's answer, with the basket's items, totals and any discount code, goes back the same way. Where Zaltric has switched it on for your shop, a customer with an account on your shop can also sign in from their AI assistant. The prices and orders they then ask to see, and the delivery addresses your checkout offers them, go from your Odoo, through the shop window, to them. When a checkout through an AI assistant becomes a sale, your Odoo reports it directly to that AI assistant's platform; if the platform asks for the order, it is read through the shop window and not kept. Zaltric does not keep any of these details. Card numbers do not pass through Zaltric. Unless you switch on card payments for AI assistants or take sales through Stripe, no payment details do either: the shopper pays on your own website. With card payments switched on, an AI assistant can pay with a single-use Stripe token, charged on your own Stripe account through your Odoo Stripe provider; the token passes through the shop window to your Odoo. The token itself is never stored: your Odoo keeps only a one-way fingerprint of it, so that the same payment is not taken twice. If you take sales through Stripe, the shopper pays Stripe directly, into your own Stripe account. Stripe's checks on each sale, for your delivery prices, your tax and your shop's approval, pass through the shop window to your Odoo, and carry the shopper's name, email address and delivery address and the card's brand, last four digits and expiry date. When Stripe sends the shopper's phone number, the shop window passes it to your Odoo as the phone number of that order's delivery address, and Zaltric neither stores it nor logs it. An order without a phone number is still accepted. Stripe's notices about your sales, refunds and disputes pass through the shop window to your Odoo the same way. Your Odoo keeps each sale as an order. Zaltric processes the details above on your behalf, as your processor, on the infrastructure of Cloudflare, which hosts the shop window. You are the controller of them. The shop window has nowhere to store them and its logs are switched off, so it keeps no copy. In your Odoo, the module keeps each checkout's details with its quotation. With the module's checkout setting for AI assistants switched on, a checkout made that way that ends unpaid is deleted by the module's nightly clean-up once a day has passed since it ended, with its quotation and the guest contact made for it. It is kept if the shopper opened the basket in a browser, or if a payment on it is still being settled. The record the module keeps so that a repeated request is answered once, not twice, goes at the nightly clean-up once it is a day old.
• Connection records. The connection reference (the ID that pairs your Odoo with us), the address of your Odoo, when updates arrived and whether they were accepted. Kept for the life of the connection and deleted with the catalogue.
• AI assistant visits. Zaltric does not record the visits AI assistants make to your shop window, or who the shopper is. The module counts, inside your own Odoo, how many times each AI assistant visited your shop's pages for assistants each day, and shows the counts in its AI Shopping Assistants app. The counts name no person, are kept in your Odoo for 400 days and are not sent to Zaltric.
• Your shop's grade. When you press Check again in the app, your Odoo asks us to check your shop, and our free checker reads your shop's public pages from outside, at the web address we already hold for it, as its own privacy notice describes. We keep the last grade with your account: the score, the letter and what would raise it, with quotations of what the check found on your shop's public pages. Each new grade replaces the last, and it is deleted with your shop's other records.
• Your account. We hold your account's name, the email addresses you bill and sign in with, and when you first signed in, for as long as the account exists. The account's owner can change the name and the billing email under Business details in the account; we make the same change at Stripe, and a new billing email takes effect only when the owner opens the link we send to it. Each request for a sign-in code is recorded with the address it was for and a scrambled form of the network address it came from, and deleted after two hours. When one of us opens your account to help you, we record who did it, when and why, email you, and show the record on your dashboard. We keep that record for the life of the account and for 6 years after the end of our financial year in which the account is deleted.
• Support conversations. Kept for up to 12 months after the last message.

Your account at app.zaltric.com sets three cookies, all for signing in: the session that keeps you signed in after you type the code we email you, a second that signs you out after a week without a visit, and a third that lasts five minutes and exists only while you choose which account to sign in to. They are strictly necessary for pages you asked for, so no consent banner stands in front of them, and signing out deletes the first two.

Sign-in codes are sent by WorkOS, which runs sign-in for your account. For each code it is given the address the code goes to, and the network address and browser of the device that asked for it.

If you check out inside an AI assistant

Some shops that use Zaltric let you check out from inside an AI assistant. When you do, the shop is the controller of your details: it decides what it needs to take your order. Zaltric acts for that shop, as its processor, and only on its instructions.

• What passes through Zaltric. Your name, email address, phone number and delivery address, and what is in your basket. They go from your AI assistant, through Zaltric, to the shop's own system, which keeps them with your order. The shop's answer, with prices, totals and any discount code, comes back the same way.
• Paying. Your card number does not pass through Zaltric. Where the shop takes card payment inside the AI assistant, the assistant sends a single-use Stripe token in its place. The token passes through Zaltric to the shop, which charges it on its own Stripe account. The token itself is never stored. Zaltric keeps nothing of it, and the shop keeps only a one-way fingerprint of it, so that the same payment is not taken twice. Where the shop sells through Stripe, you pay Stripe directly, into the shop's own Stripe account. Stripe's checks on your purchase, with your name, email address and delivery address and your card's brand, last four digits and expiry date, pass through Zaltric to the shop, which keeps your order. If Stripe has your phone number, it goes to the shop as the phone number for your delivery. Zaltric neither stores it nor logs it, and your order goes through without one.
• What Zaltric keeps. None of these details. Zaltric has nowhere to store them and its logs are switched off. Cloudflare, which runs Zaltric's service, carries each request and keeps its own security records, as it does for a visit to this site.
• What the shop keeps. The shop keeps your order in its own system, for as long as its own privacy notice says. To see, correct or delete it, ask the shop.

If you sign a letter with us

Some of the people we work with sign a letter of intent with us: a merchant, or a firm that sets up and looks after other people's shops. If you sign one, we hold your name, your role and your signature to administer that letter, on the basis of our legitimate interest in managing our own commercial correspondence. We keep them for up to three years from the date of the letter. Our professional advisers, and the cloud services we use to hold and sign documents, may see them; some of those services run outside the United Kingdom, under the safeguards UK data protection law requires for such transfers, and the details are available on request. Your rights over them are the ones set out below.

If a partner names you as a client

A firm that signs a partner letter with us may list the clients it expects to propose Zaltric to. What it enters is the columns the letter lists: a reference or a name for each client, the Odoo series and edition that client runs, where that Odoo runs, the plan the firm has in mind, whether monthly or annual, and the published price a month. We hold that list on the basis of our legitimate interest in running the introductions the letter records: to recognise the client if it subscribes, and to pay the firm its share. The firm confirms it is entitled to disclose what it enters. Nothing about a client's own customers is in the list, and no client is bound by it. We keep the list in confidence while the firm's share can still be earned under the letter and for up to 12 months after the last payment to the firm, then delete it; sooner, if the letter lapses with no client having subscribed. It is seen by the same advisers and services as a signature is, and the rights set out below are yours as they are anyone's.

If we meet you or write to you

If we meet you at an event, such as an Odoo conference, or someone introduces you to us, we hold your name and your business contact details, such as your email address and your firm, and a record of what we sent you and whether you replied. We hold them on the basis of our legitimate interest in following up a conversation with businesses that work with Odoo: to continue that conversation and to know whether you replied.

If we write to a firm we have not met, to introduce Zaltric, we take the business contact details the firm publishes for business contact, from its own website, its Odoo partner page, and public event and code listings, and only those. We never use bought lists or guessed addresses. We hold those details, such as your name, your role, your work email address and your firm, with the page we found them on and a record of what we sent you and whether you replied, on the basis of our legitimate interest in contacting businesses that work with Odoo: to make that approach and to know whether you replied.

The rest of this section applies the same way in both cases. Our professional advisers, and the cloud services we use to send and store mail, may see them; some of those services run outside the United Kingdom, under the safeguards UK data protection law requires for such transfers, and the details are available on request. We keep them for up to 12 months after our last contact with you, or until our outreach ends, whichever is sooner.

You can tell us to stop writing to you at any time, by replying to any message from us or through the contact page, and we will stop. We then keep only your email address, your firm and the date you asked, so that we never write to you again. Your other rights over these details, and how to complain, are the ones set out below.

Who processes it for us

Stripe

Payments, the card, invoices and the billing page.

Cloudflare

Serving this site and the service, counting page views for us, Turnstile on the contact and invitation forms, sending our email, and the AI service that reads a search typed on the try page.

Neon

The database that holds accounts, billing records, catalogues and connection records, in Frankfurt.

WorkOS

Signing you in to your account: it holds the email address you sign in with, sends your sign-in codes, and holds your sign-in sessions, with the network address and browser of the device that asked for a code or signed in.

Mailjet

Sending the other emails about your account, such as an invitation to join it, and the emails about deleting it.

Google Workspace

Our mailbox, where your messages and support conversations are held.

Each acts on our instructions under a written contract. Some of them handle data outside the United Kingdom, including in the United States; where they do, the transfer is covered by the safeguards UK data protection law recognises. We also disclose personal data where the law requires us to.

Why we may hold it

To answer you (our legitimate interest in replying to a message you sent us); to run this site and keep it secure (our legitimate interest in doing so); to count page views without identifying anyone (our legitimate interest in knowing which of our posts bring visitors to the site); to provide your account and the subscription you bought (performance of a contract); to keep sign-in safe and to record each time we open your account (our legitimate interest in protecting your account and our service from misuse); to keep tax records (a legal obligation); to refuse a second free trial to an email address whose account was deleted (our legitimate interest in preventing misuse of the trial); to administer a letter you signed or were named in (our legitimate interest in managing our own commercial correspondence and the introductions it records); to follow up a conversation with you after we met or were introduced, and to record whether you replied (our legitimate interest in following up conversations with businesses that work with Odoo); to keep the record that you asked us not to write to you again (our legitimate interest in respecting that request). For the details of your shoppers and customers that pass through the shop window, including at a checkout inside an AI assistant, we act for you, as your processor, on your instructions, and you are the controller. We do not sell personal data and we do not use it for advertising.

Your rights

You can ask for a copy of the personal data we hold about you, have it corrected or deleted, have its use restricted, receive it in a portable form, or object to our holding it. You can also object at any time to our writing to you about Zaltric, and we will stop. Ask through the contact page.

Deleting your data

To ask. Write to us through the contact page, or by post to our registered office. Say who you are and what you want deleted. We may ask you to confirm it is you. We act without undue delay. We answer no later than one month after we receive your request, and we delete what we can sooner.

If you are a subscriber. When you close your connection, your shop window stops serving your catalogue within about a minute, and your catalogue and connection records are deleted from our database within about 91 days. If you ask, we delete them sooner, together with your shop's grade.

Deleting your account. The account's owner can delete it from the account pages. We email a 6-digit code to the address you sign in with; you type it on the same page, with your business name, to confirm. Your shop windows are paused straight away, everyone signed in to the account is signed out, and your subscription stops renewing. We do not refund the rest of a period you have paid for. We email you the date, and 7 days later we delete the account: your shops' catalogues and connection records, your shop's grade, your sign-in at WorkOS, your customer record and card details at Stripe, your address at Mailjet, and your name and email addresses from our records. We email you when it is done. You can also ask us to delete your account by writing to us; we confirm it with the address you sign in with first.

Keeping your account. Until the 7 days are up, the owner can sign in and press Keep my account. Nothing is then deleted. The shops that were live when you asked are served again once your Odoo has sent their catalogues, and your subscription renews as before. We email you which shops will be served again, and which stay off and why.

Your sign-in. WorkOS holds the email address you sign in with, your sign-in sessions, and the network address and browser of the device that signed in. When you are removed from an account, our service ends your access to it and signs out your sessions. When an account is deleted, we delete it at WorkOS, with the sign-in of each person who belongs to no other account; if you belong to another account too, you keep your sign-in there. To have only your own sign-in deleted while the account stays, write to us.

Emails about your account. Mailjet sends them for us and keeps its own record of each email, including your address. When your account is deleted, we delete your address at Mailjet, and Mailjet deletes its records of it within 30 days. If you ask, we do the same while the account stays.

Backups. Data we delete from our database stays in our encrypted backups for up to 14 days and 6 hours, then it is gone. Until then the backups are locked and we do not use them. If we ever had to restore one, we would repeat every deletion made since before reopening our service.

If you wrote to us. We delete the conversation when you ask. Otherwise it goes 12 months after the last message.

If you checked out inside an AI assistant. Zaltric keeps none of your details, so there is nothing for us to delete. Your order is held by the shop where you checked out: ask that shop. If you write to us instead and name the shop, we pass your request to it.

What we keep, and why. We keep invoices and payment records for 6 years after the end of the financial year they relate to, because UK tax law requires it. We delete them after that. When your account is deleted, the other records we keep without your name or email address (the dates and plan of your subscription, when you asked us to delete it, and a record of each time one of us opened your account) are deleted 6 years after the end of our financial year in which the account was deleted. When you close your account, we keep a scrambled code of your email address for 12 months, only to prevent repeat free trials. We tell you what we have kept and why.

What others hold. Stripe keeps its own invoices and payment records under its own obligations. Cloudflare's security records are deleted on Cloudflare's own schedule, which we do not set. If you are unhappy with how we handled your request, you can complain as set out below, including to the ICO.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to us. Use the contact page or write to us at our registered office. We will acknowledge your complaint within 30 days and tell you what we have done about it.

If you are not satisfied with our answer, you can complain to the Information Commission, the UK data protection regulator, whose office is still known as the ICO: ico.org.uk/make-a-complaint.

Changes

When this notice changes, the date at the top changes with it.