Privacy Policy

Last updated: May 18, 2026

We at LAIW PTY LTD (together with our affiliates, "Odella", "we", "our" or "us") respect your privacy and are strongly committed to keeping secure any information we obtain from you or about you. This Privacy Policy describes our practices with respect to Personal Information we collect from or about you when you use our website and services (collectively, "Services").

1. Personal information we collect

We collect information that alone or in combination with other information in our possession could be used to identify you ("Personal Information") as follows:

Personal Information You Provide: We may collect Personal Information if you create an account to use our Services or communicate with us as follows:

• Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment card information, and transaction history, (collectively, "Account Information").
• Phone and Messaging Information: If you provide a phone number, enable phone-based features, or communicate with us by SMS, MMS, or voice, we may collect phone numbers, messaging preferences, SMS/MMS content, call records, delivery status, opt-in and opt-out records, consent records, and related support information.
• Customer Data and Content: When you use our Services, we may collect Personal Information that is included in Customer Data, Input, Output, or other Content. Customer Data, Input, Output, and Content have the meanings given in our Terms of Use.
• Communication Information: If you communicate with us, we may collect your name, contact information, and the contents of any messages you send ("Communication Information").
• Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, Twitter, YouTube and LinkedIn. When you interact with our social media pages, we will collect Personal Information that you elect to provide to us, such as your contact details (collectively, "Social Information"). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity.

Personal Information We Receive Automatically From Your Use of the Services: When you visit, use, and interact with the Services, we may receive the following information about your visit, use, or interactions ("Technical Information"):

• Log Data: Information that your browser automatically sends whenever you use our website ("Log Data"). Log data includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interacted with our website.
• Usage Data: We may automatically collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, computer connection, IP address, and the like.
• Operational Data and AI Agent Traces: We may collect Operational Data, including AI Agent Traces, as those terms are described in our Terms of Use. This may include logs, telemetry, metadata, analytics, measurements, diagnostics, tool calls, tool results metadata, routing decisions, model selections, latency, error logs, success and failure signals, evaluation scores, state transitions, workflow run metadata, security events, and other machine-generated records of how the Services operate.
• Device Information: Includes name of the device, operating system, and browser you are using. Information collected may depend on the type of device you use and its settings.
• Cookies and Similar Technologies: We use local storage, cookies, pixels, tags, and similar technologies. Strictly necessary technologies operate the website, remember privacy choices, maintain security, and support requested features. Analytics technologies help us understand website use and performance. Advertising technologies measure campaigns and create or measure audiences. We do not run optional website analytics in regions where those analytics would require prior consent. We request prior consent for advertising technologies where required and provide an opt-out elsewhere. General information about cookies is available at All About Cookies.
• Analytics and Advertising: Depending on region and your choices, we use a cookieless PostHog configuration for website analytics and performance measurement. Depending on configuration, region, Global Privacy Control, and your advertising choice, we may also use Google Ads, Meta Pixel, LinkedIn Insight Tag, Reddit Pixel, and Apollo website tracking. These providers may receive online identifiers, IP-derived location, device and browser information, referral information, pages viewed, and interactions or conversions. We do not intentionally send Customer Data, message content, or account credentials to advertising platforms.
• Third Party, Public, and Enrichment Information: We may receive information from third party providers, public sources, integrations, or enrichment services, including business contact information or other records that help operate, secure, or improve the Services, subject to applicable law.

Cookie and tracking categories

Provider privacy information is available from PostHog, Google, Meta, LinkedIn, Reddit, and Apollo. Our deployed providers and configurations may change; we review this disclosure when tracking technologies change.

2. How we use personal information

We may use Personal Information for the following purposes:

To provide, administer, maintain, improve and/or analyze the Services;

• To conduct research;
• To communicate with you, including by email, SMS, MMS, voice, in-product messages, and similar channels for transactional, operational, administrative, onboarding, security, support, workflow, notification, and internal team communication purposes;
• To develop new programs and services;
• To prevent fraud, criminal activity, or misuses of our Services, and to ensure the security of our IT systems, architecture, and networks; and
• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties. Aggregated or De-Identified Information. We may aggregate or de-identify Personal Information and use the aggregated information to analyze the effectiveness of our Services, to improve and add features to our Services, to conduct research and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of users of our Services and share aggregated information like general user statistics with third parties, publish such aggregated information or make such aggregated information generally available. We may collect aggregated information through the Services, through cookies, and through other means described in this Privacy Policy. We will maintain and use de-identified information in anonymous or de-identified form and we will not attempt to reidentify the information.

We do not use information sourced from Google Workspace APIs to develop, improve, or train generalized AI and/or ML models.

Service Improvement. We may use Customer Data, Content, and Operational Data, including AI Agent Traces, to provide, maintain, secure, debug, audit, bill for, support, evaluate, test, develop, and improve the Services. When we process Customer Personal Data solely under a business customer's documented instructions, we act as its Processor or Subprocessor. For product-wide analytics and generalized improvements undertaken for our own purposes, we act as an independent Controller and generally rely on our legitimate interests in operating, securing, evaluating, and improving the Services, balanced against the rights and reasonable expectations of affected individuals. Service improvement may include improving model routing, tool selection, workflow reliability, latency, safety systems, evaluations, product features, and AI Employee performance. This use is separate from LLM training. A decision not to opt in to LLM training does not prevent permitted Service-improvement processing, but individuals may object to or request restriction of independent-Controller processing where applicable law provides that right.

Large Language Model Training and Opt-In. A "Large Language Model" or "LLM" is an artificial intelligence model trained on large datasets to understand, generate, or otherwise process language or other content and includes, for purposes of this Policy, multimodal, generative, and other general-purpose artificial intelligence models. We will not use Customer Data, Content, AI Agent Traces, or materially similar operational execution traces to train or fine-tune LLMs developed by or on behalf of Odella unless an authorized organization owner expressly opts in through an available organization or account setting or another written mechanism we provide. We rely on that express authorization for this processing.

An authorized organization owner may withdraw the opt-in prospectively through an available setting or by contacting dsar@odella.ai. After withdrawal is applied, we will stop using information from the account for future LLM training or fine-tuning. Withdrawal does not require deletion or reversal of aggregated or de-identified information, model weights, evaluations, derived learnings, or other improvements created while the opt-in was active. A decision not to opt in, or a later withdrawal, does not limit processing necessary for Service improvement, to provide or administer the Services, comply with law, or enforce our policies.

3. Disclosure of personal information

In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law:

• Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, cloud services, artificial intelligence model providers, API providers, and other information technology services providers, telecommunications carriers, SMS/MMS aggregators, voice providers, messaging platforms, event management services, email communication software and email newsletter services, and web analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us. Third party artificial intelligence models, APIs, and other services may also be subject to their own terms, privacy policies, and data handling practices; customers are responsible for reviewing those downstream terms and policies where they choose or configure such providers.
• SMS opt-in and consent data: We do not share phone numbers, SMS/MMS consent records, or opt-in information with third parties for marketing or promotional purposes. Phone-based information is shared only with our messaging infrastructure providers (such as Telnyx and the underlying mobile carriers) solely for the purpose of delivering the communications you have opted into, and with vendors and service providers acting on our behalf under written confidentiality obligations. We do not sell or rent SMS opt-in or consent data.
• Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively a "Transaction"), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
• Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.
• Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with LAIW PTY LTD. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy.

4. Your rights

Depending on location, individuals in the EEA, the UK, and across the globe may have certain statutory rights in relation to their Personal Information. For example, you may have the right to:

• Access your Personal Information.
• Delete your Personal Information.
• Correct or update your Personal Information.
• Transfer your Personal Information elsewhere.
• Withdraw your consent to the processing of your Personal Information where we rely on consent as the legal basis for processing.
• Object to or restrict the processing of your Personal Information where we rely on legitimate interests as the legal basis for processing.

You can exercise some of these rights through your Odella account. If you are unable to exercise your rights through your account, send your request to dsar@odella.ai. You may also use the Manage advertising consent button in Section 11 to manage advertising technologies. Where we rely on legitimate interests, you may object to that processing; we will stop unless we demonstrate compelling legitimate grounds or the processing is needed for legal claims.

5. Data residency and Australian privacy rights

Organization accounts may allow an administrator to configure a data residency region for that organization. If your organization account is configured for Australia data residency, and otherwise where the Privacy Act 1988 (Cth) applies to our handling of Personal Information, we handle Personal Information, Customer Data, and Operational Data associated with that organization account in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles where they apply to us.

You may request access to, or correction of, Personal Information we hold about you by contacting dsar@odella.ai. You may also contact us to make a privacy complaint. We will take reasonable steps to respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Unless an organization account is configured for Australia data residency, Personal Information, Customer Data, and Operational Data may be processed in Australia, the United States, Ireland, other countries identified in our Subprocessor list, and locations where Customer-selected providers operate. This includes personal accounts and organization accounts configured for United States data residency. Data residency settings do not prevent transfers or access where required to provide support, security, incident response, billing, abuse prevention, legal compliance, or other Services functions, or where you choose to use a third party integration, API, or model provider outside the selected region.

6. U.S. state privacy rights

The following table summarizes categories we may have collected and disclosed during the preceding 12 months. Whether a category applies depends on the Services and features used.

To the extent provided by applicable U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and subject to applicable exceptions, U.S. residents may have the following privacy rights in relation to their Personal Information:

• The right to know or access information about our processing of your Personal Information, including the specific pieces of Personal Information that we have collected about you;
• The right to request deletion of Personal Information;
• The right to correct inaccurate Personal Information;
• The right to obtain a portable copy of Personal Information;
• The right to opt out of certain processing, such as sale, sharing, targeted advertising, or profiling, where those concepts apply under applicable law; and
• The right to be free from discrimination or retaliation for exercising privacy rights.

We do not sell Personal Information for monetary consideration. When optional advertising technologies are enabled, disclosure of identifiers and Internet activity to Google, Meta, LinkedIn, Reddit, Apollo, or similar providers may constitute "sharing" for cross-context behavioral advertising under California law. You may opt out through the Manage advertising consent button in Section 11 or Global Privacy Control in a supported browser. We treat a recognized Global Privacy Control signal as an opt-out for that browser. We do not use or disclose Sensitive Personal Information to infer characteristics about a consumer.

Exercising Your Rights. U.S. residents can exercise applicable state privacy rights by sending a request to dsar@odella.ai or using the Manage advertising consent button in Section 11 to opt out of advertising tracking.

Verification. In order to protect your Personal Information from unauthorized access, change, or deletion, we may require you to verify your credentials before you can submit a request to know, correct, or delete Personal Information. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional Personal Information and proof of residency for verification. If we cannot verify your identity, we will not provide, correct, or delete your Personal Information.

Authorized Agents and Appeals. You may submit a rights request through an authorized agent where permitted by applicable law. If you do so, the agent must present signed written permission to act on your behalf and you may also be required to independently verify your identity and submit proof of your residency with us. If applicable law gives you a right to appeal our decision on a privacy request, you may appeal by replying to our decision or contacting dsar@odella.ai. Authorized agent requests and appeals can be submitted to dsar@odella.ai.

7. Children

Our Services are not directed to people under 18, and people under 18 may not create or operate an Odella account. We do not knowingly collect Personal Information directly from a person under 18 for the purpose of creating or operating their own account. Customers must not provide Personal Information relating to a person under 18 through the Services unless they have a lawful basis, all required authority and consents, and appropriate safeguards. If you believe a person under 18 has created an account or provided Personal Information to us without proper authorization, contact support@odella.ai. We will investigate and take appropriate action.

8. Links to other websites

The Service may contain links to other websites not operated or controlled by Odella, including social media services ("Third Party Sites"). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.

9. Security and Retention

We implement commercially reasonable technical, administrative, and organizational measures to protect Personal Information, Customer Data, and Operational Data both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. We use technical and organizational controls designed to keep Customer Data associated with one customer from being made available to other customers in our multi-tenant application environment, except as directed by the customer, permitted by our Terms of Use, required by law, or necessary to provide and secure the Services. However, no Internet or email transmission is ever fully secure or error free. In particular, email sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or email. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third party websites.

We retain Personal Information only for as long as reasonably necessary for the purposes described in this Policy. Our general retention periods are:

• Customer Data in active systems: for the account term and deleted within 30 days after account deletion or a valid deletion request, subject to legal holds and the exceptions below;
• backups: isolated from ordinary use and deleted through the standard backup-expiry cycle, ordinarily within 90 days after active-system deletion;
• account, contract, billing, and tax records: for the account term and generally seven years afterward where required for legal, tax, audit, or dispute purposes;
• security, access, and operational logs: generally up to 24 months, or longer where needed to investigate an incident, prevent fraud, or establish legal claims;
• support and business communications: generally for the relationship and up to three years afterward, unless a longer period is needed for a dispute or legal obligation;
• consent, opt-out, and suppression records: for as long as needed to honor the preference and generally at least five years after the relevant communication or withdrawal;
• call recordings and transcripts: according to the customer’s configuration or the period disclosed for the feature, and otherwise no longer than reasonably necessary for the requested service; and
• website analytics and advertising information controlled by Odella: generally up to 25 months, subject to provider settings and, for advertising, your privacy choices.

We may retain limited information longer where required by law or reasonably necessary for security, fraud prevention, backup integrity, dispute resolution, or enforcement. When retention is no longer justified, we delete or de-identify the information.

We may also anonymize or de-identify your Personal Information (so that it can no longer be associated with you) for research or statistical purposes, as described above, in which case we may use this information indefinitely without further notice to you.

10. International users

By using our Service, you understand and acknowledge that your Personal Information may be transferred from your location to our facilities, servers, affiliates, and service providers in the United States and other countries, unless your organization account is configured for Australia data residency and the relevant processing is subject to the Australia data residency commitment described above.

For EEA, UK or Swiss users:

Legal Basis for Processing. Our legal bases depend on the purpose:

• contract necessity, when we create and administer an account, provide requested features, process Customer Data under your instructions, deliver communications you request, provide support, and bill for the Services;
• legitimate interests, when we secure the Services, prevent fraud and abuse, maintain operational records, conduct product-wide analytics and Service improvement, manage business relationships, and market business Services, after balancing those interests against individual rights;
• legitimate interests for privacy-preserving website analytics and performance measurement and for business marketing where prior consent is not required, subject to applicable opt-out rights;
• consent for advertising technologies in regions requiring prior consent and for other processing where we request consent; consent may be withdrawn at any time;
• express organization authorization for LLM training, which may be withdrawn prospectively; and
• legal obligations and legal claims, when we comply with law, respond to lawful requests, maintain required records, or establish, exercise, or defend claims.

EEA and UK Representatives. We have appointed VeraSafe as our representative in the EEA and UK for data protection matters. You can contact VeraSafe using its Data Protection Representative contact form. Alternatively:

• For users in the EEA, you can contact VeraSafe at VeraSafe Ireland Ltd, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland.
• For users in the UK, you can contact VeraSafe at VeraSafe United Kingdom Ltd., 37 Albert Embankment, London SE1 7TL, United Kingdom.

If you feel we have not adequately addressed an issue, you have the right to lodge a complaint with your local supervisory authority.

Data Transfers. Where required, we will use appropriate safeguards for transferring Personal Information outside of the EEA, Switzerland, and the UK. We will only transfer Personal Information pursuant to a legally valid transfer mechanism.

Data Controller. For processing governed by the EU GDPR, UK GDPR, Swiss FADP, or Australian Privacy Act where Odella determines the purposes and means, the Controller is LAIW PTY LTD (ACN 667 737 251), trading as Odella, 70 Acanthus Avenue, Burleigh Waters, QLD 4220, Australia; dsar@odella.ai. Where we process Customer Personal Data solely on a business customer's documented instructions, that customer is the Controller and Odella acts as Processor or Subprocessor under our Data Processing Addendum.

11. Your choices

If you choose not to provide Personal Information needed for a feature, you may be unable to use that feature.

We do not run optional website analytics in the EEA, UK, or other regions where those analytics would require prior consent. We request prior consent before loading advertising technologies in those regions. Because advertising is the only optional tracking category offered there, the banner presents a simple, equally accessible Decline or Consent choice and remains visible until one is selected. In regions where prior advertising consent is not required, advertising may be enabled by default, but you can opt out at any time. Use the button below to consent, decline, withdraw, or revisit advertising tracking. Accepted choices are reconfirmed periodically, generally after six months; opt-outs remain in place until you change them. Strictly necessary storage remains active. We honor recognized Global Privacy Control signals as an opt-out of advertising tracking and sharing for the browser sending the signal.

Manage advertising consent

An authorized organization owner may opt in to, or later withdraw from, LLM training as described in Section 2. You may opt out of SMS/MMS messages by replying STOP. You may reply HELP for help or contact support@odella.ai. These choices may limit certain optional features but will not affect unrelated Services.

12. Changes to the privacy policy

We may update this Privacy Policy to reflect changes in law, technology, or our practices. We will post the updated version and, for a material change, provide additional notice where required, such as by email or an in-product message. If applicable law requires consent for a new purpose, we will request it rather than treating continued use as consent.

13. How to contact us

For privacy questions, requests, objections, or complaints, contact dsar@odella.ai. You may also write to LAIW PTY LTD, 70 Acanthus Avenue, Burleigh Waters, QLD 4220, Australia. General product-support requests may be sent to support@odella.ai.

Changelog

• 2026-05-18: Added SMS opt-in and consent data sharing restrictions.
• 2026-05-15: Added phone, SMS/MMS, and voice communications privacy disclosures.
• 2025-01-02: Initial release