General Data Protection Regulation (GDPR) Policy

This GDPR Policy supplements our Privacy Policy and applies specifically to users located in the European Economic Area (EEA), the United Kingdom, and Switzerland. It outlines how the Odyssey Writing Application ("Odyssey") complies with the EU General Data Protection Regulation (GDPR).

1. Data Controller

Odyssey Writing Application acts as the Data Controller for the personal data collected through the Platform. For inquiries regarding your data, you can contact us at support@odysseywriting.app.

2. Legal Basis for Processing

We process your personal data under the following legal bases:

• Performance of a Contract: To provide the writing platform services you signed up for, including managing your projects and processing payments.
• Consent: Where you have given clear consent for a specific purpose (e.g., marketing communications or tracking cookies).
• Legitimate Interests: For platform security, debugging, analytics, and improving our services, provided these interests do not override your fundamental rights.
• Legal Obligation: To comply with legal requirements, such as tax and accounting rules for subscriptions.

3. Your Rights under GDPR

Under the GDPR, you have the following rights:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data under certain conditions.
• Right to Restriction of Processing: You can request that we limit how we use your data.
• Right to Data Portability: You can request to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: You can object to the processing of your data for specific purposes (e.g., direct marketing).
• Right to Withdraw Consent: If we rely on your consent, you can withdraw it at any time.

3.1 Cookies and Analytics

Optional analytics storage is processed only when you provide consent through our cookie controls. It records first and last campaign details, such as UTM values, selected click identifiers, landing page, referrer, and capture time, using a pseudonymous visitor identifier. We retain anonymous campaign-measurement records for up to 180 days.

You may withdraw this consent through Cookie settings in the marketing-site footer. Withdrawal stops future optional tracking and removes the browser record. This does not affect processing that occurred before withdrawal or data retained for another applicable legal basis.

4. Data Transfers Outside the EEA

We use service providers (e.g., Microsoft Azure, Auth0, Stripe) that may process your data in countries outside the EEA, including the United States. We ensure these transfers are protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

5. Data Retention

We retain your personal data only as long as necessary to provide our services or comply with legal obligations. If you delete your account, we will remove your personal data and User Content within 30 days, unless we are required to keep it for legal, tax, or regulatory reasons.

6. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. Our gamification features (XP, Streaks) are based on objective usage data and do not constitute automated profiling under GDPR.

7. How to Exercise Your Rights

To exercise any of your rights, please submit a request to support@odysseywriting.app. We will respond to your request within 30 days.

You also have the right to lodge a complaint with a data protection authority in your country of residence.