Security and data.

The trust model, in one paragraph

The module runs entirely inside your own Odoo, wherever you host it. All analysis of your sales history happens there, on your server. The only network traffic is outbound HTTPS from your Odoo to the coaching service; the service has no inbound access to your database, ever.

What leaves your Odoo

One compact JSON payload per coaching request, a few kilobytes, containing:

• Your admin-written business profile text and industry preset, locale, and currency name.
• About the customer: an opaque reference plus the computed snapshot values (days since last order, cadence, average order value, revenue trend, range coverage, risk class). The customer’s display name is included only while the Send customer names setting is on; turn it off to send opaque references only.
• About the current order: the total, and per line the product name, quantity, unit, unit price, and discount.
• The detected signals: each signal’s type, severity, and estimated value, with internal record identifiers stripped out. Only the figures and names needed to phrase the advice are sent.
• Request metadata: a support fingerprint (a salted one-way SHA-256 hash of the database identifier and company id, truncated, no personal data) and the installed module version, used for support and version tracking.

Coach Chat questions travel the same way: a chat turn carries your typed question, the last 20 messages of that conversation, and the same customer-scoped aggregate context as a coaching request. No new category of data leaves, and no chat transcript is stored by the coaching service.

What never leaves

Raw order history, your full product catalog, price lists, line-by-line margins, emails, documents, and anything about customers who are not on the current quotation. The engine computes locally and sends aggregates.

Transport and the key

HTTPS only. The API key travels in a request header on server-side calls from your Odoo; it is never exposed to browser code, and in Odoo only Administrators can see or edit it.

When the service is unreachable

If the backend is down, the key is missing or invalid, the plan limit is reached, or AI is simply turned off, the panel serves locally computed cards with built-in wording and shows an “offline coaching” badge. Coaching degrades gracefully; stock Odoo is never affected.

Caching and retention

• The 6-hour response cache lives inside your own Odoo database, on your server, and expired entries are vacuumed daily.
• Coaching requests and responses are not stored by the coaching service; they are processed transiently in memory, with zero retention.
• Usage telemetry is metadata only (timestamps, endpoint, model, token counts, latency, status), never request content. Our data policy retains raw events for 12 months and monthly aggregates after that. Questions about your data go to hello@nanti.ai, our one contact address for everything.

The AI provider

AI text is generated by Anthropic’s Claude, which does not train on API data and processes requests transiently under a data processing agreement. The coaching service runs on Google Cloud in the EU (europe-west1, Belgium). Subprocessors: Google Cloud, Anthropic, and Razorpay for billing (no card data is seen or stored by us). We do not train models on your business data; that is a standing commitment, not a plan tier.

Opting things out

Flag	Effect
Customer: “coach opt-out”	The customer generates no coaching cards at all.
Product: “exclude from coaching”	The product never appears in any play.
Setting: Send customer names, off	AI payloads carry opaque customer references only.
Setting: Enable AI, off	Everything runs deterministically inside your Odoo; nothing is sent.

Languages

The panel UI ships in English and Spanish. Card wording follows the Language mode setting: the salesperson’s language (default), the company language, or a fixed language you choose.