Privacy policy

Who is responsible

Companion for Odoo is a product of Huma, based in the Dominican Republic. Huma is the controller of the data that reaches the licensing portal (companion.huma.com.do). For anything about this policy, write to the contact address at the end of this page.

The short version

Companion reads, directly from YOUR Odoo server, the tasks, events and activities —and, with the Business plan, the tickets and business documents— your Odoo user can see: your own and, if you turn it on, those of the people you choose to follow. It stores them in a cache on your device. That content never passes through Huma's servers. Huma only receives what is needed to manage the license, and none of it describes your work.

What stays on your device

The app keeps this on your computer or phone, and Huma does not receive it:

• The Odoo records it downloads (titles, dates, stages, Chatter messages) and any actions queued while offline. They travel between the device and your Odoo, with no intermediary.
• Your Odoo address, database name and username.
• Your Odoo API key, stored only in the operating system's secure store: the Keychain on macOS and iOS, Credential Manager on Windows and the Keystore on Android. It is never written to files, databases or logs, and it is only sent to the Odoo server you configured.
• Your matrix classification (important or not). It is not synced between devices today.
• If you turn on follow-up: the open records of the people you choose to follow and the list of who you follow. They are removed from the device when you turn the feature off, and the list is not sent to Huma or to your other devices. Anything you do on someone else's work is noted in your Odoo, under your name, not at Huma.
• With the Business plan, the business documents waiting on you, with what you need to decide without opening Odoo: approval requests, time off and allocation requests, expenses and purchases awaiting approval (who is asking, how much, how many days and how long it has been waiting); documents to sign (name and expiry date); opportunities (expected revenue, probability and stage), quotations and requests for quotation (amount and status); overdue customer invoices; manufacturing orders and maintenance requests; and, only if you turn them on in Settings, vendor bills to validate or pay. For each document, the customer or vendor and the amount in its currency. The type of time off is never read, because it can be health data: you see it when you open the request in Odoo. Notifications about new approvals carry no amounts, because they show on the lock screen. If you follow other people, their business documents are stored without amounts. All of it comes from your Odoo, under the permissions Odoo gives you, and stays on the device like everything else: approving, refusing or winning an opportunity goes straight to your Odoo, not to Huma.
• The text you type into quick capture: it is parsed on the device itself, offline.
• The signed license token issued by the portal.

What Huma does receive, and why

When you activate a license and when it renews (the app tries once a day), to know which devices use each seat and to issue the token:

• The activation code. It is single-use, and the portal stores only a hash of it, not the code.
• A random installation identifier created by the app. It is not derived from hardware: it is not the serial number, the MAC address or an advertising ID, and it changes if you reinstall.
• The device name (for example, “Ana's iPhone”) and its system (macOS, Windows, iOS or Android), so you can recognize your devices when one needs to be released.
• The date each device last connected.
• One fingerprint per connected Odoo: a SHA-256 computed on the device from the instance identity and your username. It is used only to check that the devices on a seat belong to the same person. The portal receives neither your Odoo address nor your username.

When a license is set up: the holder's email and name, the number of seats and the plan of each one (Pro or Business), the email of the person assigned to each seat, and a payment reference.

If you sign up on the home page to be notified, or request Pro or Business for your company: your email and, in the request, the company name and, if you give it, how many people would use it. For a request we also keep, to follow up on it, where the conversation stands and internal notes from the Huma team.

From the admin panel, used only by Huma staff: the email of whoever signs in, a log of actions taken on accounts and seats (creation, expansion, plan change, revocation) and sign-in attempts, to limit abuse.

The desktop app asks the portal whether a new version exists, stating its version, system and architecture. Like any web server, our providers see the IP address of each request in their technical logs.

What is not collected

• No content from your Odoo: no records, messages, attachments, or the server address.
• Neither your API key nor your password.
• Neither who you follow nor anything about those people's work.
• No location, contacts, photos, microphone, or advertising or hardware identifiers.
• There is no analytics, no advertising, no third-party SDK inside the app, and no push notification server.

We do not sell data or share it with anyone for advertising. The public part of the portal uses no tracking cookies; the only cookies are the admin panel's session cookies.

Payments

There is currently no card payment and no payment processor: licenses are contracted per company, invoiced to the company by bank transfer and set up by hand. Billing details are handled in Huma's accounting, outside this portal, which only keeps a payment reference. The phone apps sell nothing.

Where data is stored and who helps us

The portal runs on two providers that process data on Huma's behalf:

• Vercel, which hosts the portal and serves its requests.
• Supabase, which stores the database and the installers, and sends the sign-in link for the admin panel.

Their servers are outside the Dominican Republic, in the Americas. All communication with the portal is encrypted over HTTPS. The connection to your Odoo is encrypted if your server uses HTTPS. If it uses HTTP, the desktop app warns you that the API key would travel unencrypted; the phone apps, under their own system's rules, only allow HTTPS.

How long data is kept

License data is kept for as long as the account exists. A released device is deactivated and remains as part of the account's record until the account is deleted. Waiting-list data is kept until you ask to be removed. Providers' technical logs follow their own retention periods. Anything we must keep for tax purposes, such as invoices, is kept for as long as the law requires.

How to delete your data

On the device, you are in control: “Disconnect” deletes the API key and the data for that Odoo account; “Empty cache” deletes the downloaded Odoo data; and uninstalling the phone app deletes everything it stored.

On the portal, write to us from the holder's or the seat's email address and ask us to delete the account, a seat, a device or your waiting-list entry. We do it within 30 days at most and confirm once it is done. Deleting the account also deletes its seats, devices, codes and tokens. You do not need the app installed to ask.

Your rights

You can ask us to access, correct or delete your data, or object to its processing, under Dominican Republic Law 172-13 on personal data protection and any law that applies where you live. Write to the contact address; we will answer within 30 days at most.

Children

Companion is a work tool and is not directed at anyone under 18. We do not knowingly collect data from minors; if you believe it has happened, write to us and we will delete it.

Changes to this policy

If what the app sends or what the portal stores changes, we update this page and its date. If the change is substantial, we notify license holders by email before it takes effect.

Contact

Huma · República Dominicana · vleger@huma.com.do