1. Roles
For Odoo data read through the service, the customer is the controller and UAB "VM Robotika" (LONGRUN) is the processor. We process that data only on the customer's documented instructions, which are the read requests the customer's AI assistant sends.
2. Subject, purpose and duration
Processing is limited to reading the customer's Odoo data and returning it to the AI assistant the customer connected, plus operating the service (authentication, limits, audit). It lasts until the customer disconnects or closes the account.
3. Categories of data
Whatever the chosen Odoo user may read and the AI assistant requests, for example contacts, invoices, orders, stock and projects. We do not store the content of records; we store account data, the encrypted Odoo credential and an audit log of calls (time, tool, model, result, source IP).
4. Sub-processors
Hostinger International Ltd (VPS hosting, data centre in the European Union); Google (transactional email). The AI provider the customer connects is engaged by the customer, not by us. We give notice of new sub-processors by email and allow reasonable objection.
5. Security measures
Odoo credentials encrypted at rest (Fernet/AES); TLS in transit; per-tenant isolation; read-only access enforced in the service; opaque, revocable, hashed access tokens; protection against requests to internal networks; rate limits; audit logging; restricted administrative access.
6. International transfers
The service runs in the EU. Transfers to the AI provider the customer selects are governed by that provider's terms; the customer chooses an appropriate provider and settings.
7. Assistance and breach notification
We assist the controller with data subject requests and notify the controller without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach.
8. Deletion
On disconnection or termination we delete the stored Odoo credentials and revoke access tokens. Audit logs are kept for a limited period for security and then deleted, unless the law requires longer retention.
9. Audits
We make available the information reasonably necessary to demonstrate compliance. To sign this agreement as a separate document, write to info@longrun.lt.