Privacy policy
Last updated: 2026-10-18
Who we are
RAG Solutions is a service edited and operated by Innova Advanced Technologies, which is the data controller for the personal data described below. The service provisions and manages hosted Odoo instances for business customers. Our full company details are in the legal notice. If you have any question about this policy or about your data, contact us at mohamed@innova-advancedtech.com.
What we collect
- Account data. Your name and email address, and — if you sign up with a password — that password, stored only as a hash by our identity provider (Keycloak). We never see or store your password in readable form.
- Subscription data. Your plan, trial or subscription end date, how many instances you are allowed, and a history of administrative actions on your account (activation, extension, blocking) so that billing questions can be answered.
- The business details you give us to configure your instance. Company name, country, language, and optionally address, email, phone, VAT number and logo. These are written into your own Odoo database.
- Technical data. Server logs of requests to the service (IP address, time, path, result) kept for security and troubleshooting, and the output of the provisioning commands run for your instance.
- Proof that you accepted our agreements. When you accept our terms of use and data processing agreement we record: your name, email address and account; the company you accepted for and its registration or VAT number; the exact wording you ticked and its language; the version and a cryptographic fingerprint of each document, together with a copy of those documents as you saw them; when you accepted, from which IP address and browser (user agent), and on which screen. If you accept terms on our payment provider's checkout page, we record that too. We keep this because we must be able to show that the contract was concluded, with whom and on what terms (our legitimate interest in establishing, exercising or defending legal claims). It is kept separately from your account, is not deleted when you close your account, and is erased once the statutory limitation period for claims under the contract has run (five years after the contract ends, under French law). Access is restricted to our administrators.
- A record that we deleted your account. After we erase an account we keep a receipt showing the dates, how many instances were removed, and a one-way cryptographic fingerprint of the account name — not the name itself. It holds nothing else about you, and it exists so we can confirm the deletion to you afterwards if you ask.
We do not use tracking cookies, analytics or advertising trackers. The only cookie the application sets is the session cookie that keeps you signed in.
If you sign in with Google
Signing in with Google is optional — a password account does the same thing. If you choose it, Google tells us only your name, email address, and Google account identifier, which we use to create and recognise your account. We request no other permission, we cannot read your Gmail, Drive, contacts, calendar or any other Google data, and we cannot act on your Google account. The information we receive from Google is used solely to provide this service; it is never sold, and never used for advertising or profiling.
Your Odoo instance
For the data inside your instance you are the controller and we are your processor. What we may do with it, how we secure it, who else touches it and what happens to it when you leave are all set out in our data processing agreement, which you accept when you create an account.
The data you or your staff enter into your Odoo instance is yours. We do not mine it, share it, or use it to train anything. We access it only when it is necessary to operate the service — for example to run a backup you asked for, to fix a problem you reported, or to carry out an action you requested through a connected AI assistant (see below).
If you connect your own AI assistant
The service can be operated by an AI assistant you connect yourself (for example Claude), using a credential issued to your account. That is entirely your choice. When you use it, the parts of your instance data that your assistant reads or changes are sent to the AI provider you chose, and that provider's own privacy policy governs what they do with it. We do not select the provider for you and we do not send your data to any AI provider on our own initiative. Revoking the credential ends that access.
Who else sees your data
- Our hosting provider, which operates the servers your instance runs on.
- Google, if and only if you choose to sign in with Google (as described above).
- Stripe (Stripe Payments Europe, Ltd., Ireland), if you subscribe to a paid plan: it receives your name, email address, billing address, VAT number and payment details in order to take payments and issue invoices. Your card details go to Stripe directly and never reach our servers. Stripe may process data outside the EU under its own safeguards; see Stripe's privacy policy.
- An AI provider, if and only if you connect an AI assistant yourself.
We do not sell personal data and we do not share it for advertising. We may disclose it to public authorities where the law requires us to.
Why we may use it (legal bases). Running the service and billing you: performance of our contract. Security logs and the proof that you accepted our agreements: our legitimate interest in protecting the service and in being able to establish, exercise or defend legal claims. Invoices: our legal obligation to keep accounting records (ten years under French law).
Where your data is kept, and for how long
Your account data and your Odoo instance are stored on our servers in the European Union. Credentials we hold in order to operate your instance are encrypted at rest, and all access to the service is over HTTPS. We keep your account and instance data for as long as your account exists. When you delete an instance, its database is dropped. When you close your account it stops serving immediately, your data stays available for you to download for 30 days, and after that we delete your databases and your account data — except the proof that you accepted our agreements, kept as described above; backups may persist for a limited period before being overwritten. You can also ask us to delete everything straight away, from the page you are sent to after closing.
Your rights
You may ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account and its data. You can also export your Odoo database yourself at any time from your dashboard. Contact us and we will respond within one month, as the GDPR requires. If you believe we have mishandled your data, you may complain to your national data protection authority.
Changes
If this policy changes materially we will tell account holders by email. The date at the top always reflects the current version.
Trademarks
Odoo is a trademark of Odoo S.A. We refer to it here and in our service to describe the software our platform runs on. We host the Odoo Community edition, which is published under the LGPLv3 licence.