Klaviyo for Odoo

Privacy policy

This policy covers the Odoo app Klaviyo for Odoo and the sign-in relay it uses. The website flexigotech.com has its own privacy policy.

Who we are

Flexibles y Accesorios Gobe, S.L., which sells software under the FlexigoTech brand, publishes the Odoo app Klaviyo for Odoo (the core module and the parts that switch on with other Odoo apps) and runs the sign-in relay described below. Tax ID (NIF) B56727993. Calle Roger de Llúria 54, principal 1.ª B, 08009 Barcelona (Spain). Contact: comercial@flexigobe.com.

What the modules do with personal data

The modules run inside your Odoo. They send the data you choose to your own Klaviyo account: contacts (name, email, phone, address and any fields you map), the catalog, orders, consent and the events of the other Odoo apps you use. The data goes directly from your Odoo to Klaviyo, and the email activity that Klaviyo sends back goes directly to your Odoo. FlexigoTech does not receive this data, store it or process it.

With Odoo eCommerce installed and visitor tracking switched on, the pages of your online store load Klaviyo's script once the visitor accepts the optional cookies. The script sends the visitor's product views, cart additions and checkouts from their browser to Klaviyo and, when the visitor is known (signed in, or a guest who submitted their address), their email and name. FlexigoTech does not receive this data either.

You are the controller of that data. Klaviyo processes it for you under your agreement with Klaviyo. You decide what is sent, and you are responsible for having a legal basis for it. The modules never subscribe a person to marketing without explicit consent recorded in Odoo.

What the sign-in relay handles

To keep the Klaviyo client secret out of every installation, sign-in goes through a small service at connect.flexigotech.com.

During sign-in it receives the authorization code from Klaviyo and exchanges it for tokens. It keeps the tokens, encrypted, for up to 10 minutes, until your Odoo collects them once. Then it deletes them.
When your Odoo refreshes its access token, the relay adds the client secret and forwards the request to Klaviyo. It does not store the refresh token.
It does not receive contacts, orders, events or any customer data. It does not write tokens to its logs.
It processes technical data such as the IP address of the request and the address of your Odoo, which it needs to complete the sign-in and to limit abuse.

What stays in your Odoo

The access and refresh tokens and the webhook secret, encrypted, and readable only by system administrators. The key is in the server configuration when the customer sets it, and otherwise derived from the database secret.
A record of the identity of people you asked Klaviyo to erase, kept as a keyed hash and not in clear text, so the address is not sent again by mistake.
The state of each sync job, including the text of errors returned by Klaviyo.

Data protection requests

To erase a person from Klaviyo, a Klaviyo Manager uses the action Erase from Klaviyo (GDPR) on the contact. Odoo asks Klaviyo to delete the profile. Requests from people about data in your Odoo or your Klaviyo account go to you. Requests about the relay go to comercial@flexigobe.com.

Retention

The relay keeps tokens for at most 10 minutes. Your Odoo keeps its data according to your own policy. Uninstalling the module or pressing Disconnect revokes the token at Klaviyo and deletes the webhook that Odoo created.

Transfers

Klaviyo is a US company and operates under its own terms and data transfer mechanisms. The relay is hosted on servers of netcup GmbH in Germany.

Changes and contact

We will post changes on this page. Questions: comercial@flexigobe.com. You may complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Last updated: 3 October 2026.