B2B Privacy Policy

For customer pilot services, we may process personal data on behalf of a business customer. In that case, the customer is usually the controller and we are the processor. Schedule 1 - Data Processing Addendum governs that processing.

We are an independent controller for personal data we process for our own purposes, such as website and OddGameMaker web interface operation, sales, billing, account administration, security, support, legal compliance, analytics, and business communications.

We may collect the following categories of personal data:

• business contact details, such as name, company, role, email address, phone number, and address;
• account and administration data, such as workspace, channel, web app account, project, session, invitation, and permission details;
• Slack data, where the Slack interface is used, such as Slack user IDs, display names, profile details, workspace and channel information, messages, files, commands, interactions, reactions, metadata, and related event data;
• OddGameMaker web interface data, such as account details, project details, uploads, prompts, files, browser and device metadata, session information, UI interactions, generation settings, and related event data;
• Customer Content, such as prompts, briefs, files, messages, instructions, brand materials, campaign materials, feedback, and uploaded assets;
• Outputs and related metadata, such as generated files, delivery status, generation settings, job IDs, queue events, and approval actions;
• usage data, such as feature use, button clicks, commands, generation counts, timestamps, logs, errors, and support interactions;
• billing and commercial data, such as invoices, payment status, tax details, contract contacts, purchase orders, and billing communications;
• website, web app, and analytics data, such as IP address, device information, browser information, pages viewed, referral sources, interactions, and cookie, local storage, session, or similar technology data;
• security data, such as access logs, authentication events, security alerts, abuse signals, and incident records.

Customer Content and Outputs may include personal data if users include it in prompts, files, Slack messages, OddGameMaker uploads, project data, or generated materials.

We collect personal data from:

• you or your employer;
• Slack workspaces, Slack apps, Slack Connect channels, Slack APIs, and Slack interactions;
• www.oddgamemaker.com accounts, project interfaces, uploads, forms, browser sessions, and web app interactions;
• customer administrators and Authorized Users;
• our websites, forms, email, support channels, web interfaces, and sales communications;
• service providers, subprocessors, analytics tools, logging tools, security tools, and payment or billing providers;
• generated outputs and operational logs created through use of the Service.

We use personal data to:

• provide, operate, and administer the Service;
• route prompts, files, messages, uploads, project data, and instructions from Slack, www.oddgamemaker.com, or other interfaces to our backend systems;
• generate and deliver images, videos, prototypes, games, playable ads, code, technical assets, and related outputs;
• manage accounts, users, channels, projects, sessions, permissions, and support;
• store prompts, files, outputs, logs, and metadata for service delivery, support, security, debugging, billing, analytics, and product improvement as permitted by contract;
• monitor usage, enforce limits, prevent abuse, and protect security;
• respond to support requests and business communications;
• invoice customers, process payments, and manage contracts;
• comply with law, accounting, tax, legal, and regulatory obligations;
• improve, debug, and develop our services using permitted operational data.

We will not use Customer Content to train general-purpose AI models unless the relevant customer expressly agrees in writing.

If our Service uses Slack data obtained through Slack APIs, we will not use that Slack data to train a large language model.

Where EU or UK data protection law applies and we act as controller, our legal bases may include:

• performance of a contract;
• legitimate interests, such as providing, securing, supporting, improving, and administering our services;
• compliance with legal obligations;
• consent, where required for specific activities such as certain cookies or marketing communications.

Where we act as processor, we process personal data on the customer's documented instructions under the applicable agreement and Schedule 1 - Data Processing Addendum.

We may share personal data with:

• Slack / Salesforce group companies for Slack workspace, Slack Connect, app, bot, message, file, user, and metadata processing;
• web application hosting, cloud hosting, storage, compute, queue, CDN, logging, monitoring, backup, and security providers;
• hosted AI model, multimodal model, image generation, video generation, code generation, and media generation providers;
• analytics, telemetry, product analytics, and error-monitoring providers;
• payment processors, billing providers, accounting providers, and tax advisers;
• customer support, email, CRM, legal, document management, and business operations providers;
• professional advisers, auditors, insurers, and legal representatives;
• authorities or third parties where required by law, legal process, security, rights protection, or enforcement of our terms;
• counterparties in connection with a merger, acquisition, financing, reorganization, or sale of assets.

Schedule 4 - Subprocessor List provides additional information about service provider categories and named providers.

We are based in Finland. We and our service providers may process personal data in the European Economic Area and other countries.

Unless an Order Form states a specific data-residency commitment, Customer Content, Outputs, logs, and metadata may be stored or processed in the regions used by Provider and its Third-Party Services, as described in Schedule 4 - Subprocessor List and related service documentation.

Where personal data is transferred from the EEA, UK, or Switzerland to a country without an adequacy decision and a transfer mechanism is required, we use appropriate safeguards such as standard contractual clauses, UK addendum, Swiss addendum or adaptation, an adequacy decision, or another lawful mechanism.

We retain personal data for as long as needed for the purposes described in this Privacy Policy, the relevant customer agreement, and applicable law.

Retention periods depend on the data category and context. For example:

• customer account and contract records are retained for the relationship and legal/accounting periods;
• prompts, files, Slack-derived data, OddGameMaker project data, uploads, and Outputs are retained according to the customer agreement, workspace settings, project settings, and service configuration;
• logs are retained for security, support, debugging, abuse prevention, and operational needs;
• backups may remain until overwritten under normal backup cycles;
• legal, tax, accounting, compliance, and dispute records may be retained longer.

Where applicable Slack policy requires deletion after a user deletes the app or we discontinue the app, we will delete associated Slack data from active systems within the required period unless law requires retention. Where an OddGameMaker account, project, or data deletion workflow applies, we will handle associated web app data according to the Agreement, available product settings, and applicable law.

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent where processing is based on consent.

If your personal data is processed by us on behalf of a customer, please contact that customer first. We will assist the customer as required by Schedule 1 - Data Processing Addendum.

You may contact us at info@oddlatent.com to exercise privacy rights relating to our controller processing.

We use technical and organizational measures designed to protect personal data, including access controls, confidentiality obligations, encryption where supported by relevant systems, logging, monitoring, subprocessor review, and incident response procedures.

No system is completely secure. Customers and users are responsible for using appropriate channels, limiting access, managing Slack permissions and OddGameMaker account or project permissions, and avoiding submission of prohibited or sensitive data unless expressly agreed.

Our services are intended for business users and are not directed to children. Customers must not submit children's personal data unless expressly agreed in writing and lawful.

Our websites, web interfaces, and services may use cookies, local storage, session storage, analytics, logs, and similar technologies to operate, secure, analyze, and improve our services.

Odd Latent's pilot service may be provided through Slack, www.oddgamemaker.com, provider-hosted pages, and prototype deployments. Slack-based use may not require website cookies from Provider. OddGameMaker, provider-hosted pages, and prototype deployments may use cookies or similar technologies that are necessary for security, session management, delivery, debugging, fraud and abuse prevention, project operation, and basic operational telemetry. Where non-essential analytics or marketing cookies are introduced, Provider will provide notice and consent controls required by applicable law.

We may update this Privacy Policy from time to time. If changes are material, we will provide notice as required by law or contract.