Privacy & Cookie Policy

1. Who we are

ODINFLOW is a travel demand estimation software tool developed and operated by ODINFLOW. Our website is odinflow.co.uk and our application is available at app.odinflow.co.uk.

For any privacy-related enquiries, please contact us at Admin@odinflow.co.uk.

2. What information we collect

Information you provide to us

• Account information — your email address and password when you create an account to access the ODINFLOW application
• Interest registration — your email address if you register your interest via our website mailing list
• Project data — transport planning data you enter when using ODINFLOW, including project names, site locations, trip rates, and assessment outputs
• Communications — any messages you send us via email

Information collected automatically

• Usage data — pages visited, features used, and time spent in the application
• Technical data — browser type, operating system, and IP address
• Cookies — small files stored on your device (see the Cookie Policy section below)

Information from third parties

ODINFLOW retrieves publicly available data from the following sources as part of its core functionality:

• Nomis API — Census travel-to-work data (WU03EW dataset) from the Office for National Statistics
• OpenStreetMap — road network data for trip assignment
• ONS Open Geography Portal — Output Area and zone boundary data
• HERE Routing API — road routing for trip assignment
• Mapbox — map tile rendering

We do not receive personal data from any of these sources.

3. How we use your information

• To create and manage your ODINFLOW account
• To provide you with access to the ODINFLOW application and its features
• To save and retrieve your project data
• To send you updates about ODINFLOW if you have registered your interest (you can unsubscribe at any time)
• To respond to your enquiries and support requests
• To improve and develop ODINFLOW based on how it is used
• To comply with our legal obligations

4. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract — processing necessary to provide the ODINFLOW service to registered users
• Legitimate interests — improving and developing ODINFLOW, ensuring security, and understanding how the tool is used
• Consent — for marketing emails, where you have opted in. You may withdraw this consent at any time
• Legal obligation — where we are required to process data to comply with applicable law

5. Who we share your data with

We do not sell your personal data. We may share data with the following categories of third parties only as necessary to provide the service:

• Supabase — our database and authentication provider, used to store user accounts and project data securely
• Railway — our backend hosting provider
• Vercel — our frontend hosting provider
• Mailchimp — used to manage our mailing list for registered interest notifications (email addresses only, with your consent)
• HERE Technologies — routing API calls may include site coordinates as part of the routing request

All third-party providers are required to handle data securely and in accordance with applicable data protection law.

6. How long we keep your data

• Account and project data — retained for as long as your account is active, or until you request deletion
• Mailing list — retained until you unsubscribe or request removal
• Usage and technical data — typically retained for up to 12 months

You may request deletion of your account and associated data at any time by emailing Admin@odinflow.co.uk.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data in certain circumstances
• Right to restrict processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at Admin@odinflow.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

8. Cookie policy

Cookies are small text files stored on your device when you visit a website. ODINFLOW uses the following types of cookies:

Essential cookies

These cookies are necessary for the ODINFLOW application to function. They cannot be disabled.

• Authentication cookies — used by Supabase to keep you logged in to the ODINFLOW application
• Session cookies — used to maintain your session while using the application

Analytics and preference cookies

These cookies help us understand how ODINFLOW is used and remember your preferences. They are only set with your consent.

• odinflow_cookie_consent — stores your cookie consent preference

Third-party cookies

The following third-party services may set cookies when you use ODINFLOW:

• Mapbox — for map tile rendering on the ODINFLOW application

Managing cookies

You can control cookies through the cookie banner displayed when you first visit our website, or through your browser settings. Please note that disabling essential cookies may prevent the ODINFLOW application from functioning correctly.

9. Security

We take the security of your data seriously. ODINFLOW uses industry-standard security measures including:

• HTTPS encryption for all data in transit
• Secure database hosting via Supabase with row-level security
• Password hashing — we never store passwords in plain text
• Access controls limiting who can access user data

No system is completely secure. If you believe your account has been compromised, please contact us immediately at Admin@odinflow.co.uk.

10. Changes to this policy

We may update this Privacy & Cookie Policy from time to time. The date at the top of this page indicates when it was last revised. We will notify registered users of significant changes by email where appropriate.

11. Contact us