1. Who we are

Odonat AI (“Odonat”, “we”) provides an autonomous AI SRE deployed inside customer infrastructure. For website and deployment enquiries, Odonat is the data controller. For data processed inside a customer’s own VPC, the customer is the controller and Odonat is a processor under the applicable data processing agreement.

2. What we collect from this website

Deployment enquiry details: name, work email, phone number, company, role, and deploy frequency, submitted voluntarily through the request form.
Technical request data: IP address and request timestamps, retained transiently for rate limiting and abuse prevention.
Website analytics: we use Google Analytics 4 on the public marketing pages to count visitors and see which pages are read. It records pages viewed, referrer, approximate location derived from IP, and coarse device and browser information, against a randomly generated identifier rather than your name. Google processes this data as our processor. See our Cookies Policy for the cookies involved and how to opt out. Analytics is not applied to any customer deployment, only to this website.

We do not run advertising, retargeting, or cross-site advertising identifiers on this site, Google Signals and ads personalisation are off, and we do not sell personal data.

3. What we never collect from your infrastructure

This is the part that matters to a security reviewer. The Odonat agent runs inside your VPC and is engineered so that proprietary material does not leave it:

Nothing is sent to a large language model or foundation model. The agent has no model client of any kind: correlation is deterministic code, so there is no prompt, no inference call and no third party receiving your telemetry or source.
Code diffs and telemetry are processed in volatile memory. The only durable record the agent writes is its own decision log, which stores workload names, namespaces, commit SHAs and repository names, not source code.
Outbound requests the agent does make, which today means opening a pull request on your git host, pass through a local egress proxy that strips credentials from the request body: API keys, bearer tokens, private key blocks and passwords inside connection strings are replaced with fixed markers such as [REDACTED_AWS_KEY_ID]. Detection is a fixed set of patterns for known credential shapes. If the filter errors, the request is dropped rather than sent.
The agent requires zero inbound ports by default. Enabling the optional metrics endpoint opens one cluster-internal port for a Prometheus scrape; it is off unless you turn it on.

4. Why we use it

To respond to a deployment enquiry and scope an installation.
To send information about the product where you have consented, which you may withdraw at any time.
To protect the service from abuse, and to meet legal obligations.

5. How long we keep it

Deployment enquiry records are retained for up to 24 months from last contact, then deleted. Rate-limiting records are retained for no more than 15 minutes. Customer code and telemetry processed by the agent are not retained at all.

6. Sharing

We share personal data only with infrastructure and communication providers acting on our instructions, and where required by law. We do not sell or rent it.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to processing, and to withdraw consent. Email contact@odonat.ai and we will respond within 30 days. You may also complain to your local supervisory authority.

8. Security

Traffic to this site is encrypted with TLS 1.2 or better. Sessions are stored server-side and identified by an HttpOnly, Secure cookie. Authentication is delegated to an OpenID Connect provider using authorization code flow with PKCE; we never see your password.

9. Changes

Material changes will be posted here with an updated date, and where required we will ask for consent again.

10. Contact

contact@odonat.ai

Privacy Policy