Legal

Odoo Migrator — Terms of Service

Service: Odoo Migrator ("the Service") at https://migrate-odoo.com
Provider: Last Loop GmbH, Darwingasse 20/29, 1020 Wien, Austria,
registered with the Commercial Register of the Commercial Court of Vienna
(Handelsgericht Wien) under FN 676580x ("we", "us", "Provider")
Effective date: 27 August 2026
Last updated: 27 August 2026

1. What the Service does

Odoo Migrator is an orchestrator that automates the custom-code half of an Odoo version upgrade. When you (an Odoo partner or developer, "you", "Customer") connect a repository — on GitHub, on gitlab.com, or on a GitLab instance you host yourself — and choose a target Odoo version, the Service:

• reads your source code (read-only) to detect modules, dependencies and the source version;
• migrates your own modules to the target Odoo major version in an isolated workspace, iterating until static/server/browser tests pass and a structural parity gate is cleared;
• delivers the result as a new branch and a pull request (a merge request on GitLab) on your own forge — nothing is merged or deployed automatically.

The Service does not migrate your production database, does not deploy code, and does not modify your live Odoo environment. See §7 (Scope & Limitations).

2. Eligibility and accounts

2.1 The Service is offered to businesses only. You may use it only as an entrepreneur (Unternehmer) within the meaning of § 1 of the Austrian Consumer Protection Act (KSchG) — that is, in the course of your trade, business or profession. It is not offered to consumers, and by using it you confirm you are not contracting as one. You must be able to form a binding contract on behalf of the business you represent.

2.2 You sign in with a Lastloop platform account (OIDC). Connecting a source host — GitHub or GitLab — is a separate step. You are responsible for the security of both accounts and for the acts of anyone using them.

2.3 You must install our GitHub App, or grant our GitLab connection, only on repositories you are authorised to grant access to. Where you connect a self-hosted GitLab instance you supply an access token for it; you are responsible for scoping that token appropriately and may revoke it at any time. You represent that you have the right to grant that access and to have the code migrated.

3. Your responsibilities

3.1 Authority over the code. You represent that you own or are licensed to modify, and to have us process, all code in the repositories you connect — including where the end customer of a migration is a third party whose Odoo project you manage as a partner.

3.2 Review before use. Every migration is delivered as a reviewable pull request. You are solely responsible for reviewing, testing, and deciding whether to merge and deploy it. See §7.

3.3 No unlawful content. You will not use the Service to process code that is unlawful, infringes third-party rights, or that you are not permitted to share.

4. Enterprise-source licensing (attestation)

4.1 Some migrations involve Odoo Enterprise modules or source, which are licensed by Odoo S.A. and are not open source.

4.2 Where a migration requires an Enterprise license, you must attest, per migration, that you (or your end customer) hold a valid, current Odoo Enterprise subscription/license covering the code being migrated and the target version. This attestation is recorded on the migration record.

4.3 You are solely responsible for the accuracy of that attestation and for compliance with Odoo's licensing terms. We do not grant, sublicense, or provide Odoo Enterprise licenses, and we do not supply Odoo Enterprise source code as part of the Service.

4.4 We may refuse or halt any migration we reasonably believe is not properly licensed.

5. Fees and credits

5.1 The Service is priced in credits. Each migration consumes credits based on the lines of code migrated, the number of Odoo version jumps, and any translatable terms in the languages you select. The price is estimated and shown to you before you start a run, and the amount charged is the estimate you were shown. The current rates are published in the Service and at GET /api/pricing; 1 credit = EUR 1.

5.2 You buy credits by card through our payment processor (self-serve top-up), or by separate written arrangement. Credits are consumed as migrations run.

5.3 When you are charged, and the absence of automatic refunds. Credits are debited when a migration starts, not when it finishes, because the compute is committed at that point. The Service does not refund credits automatically. It follows that:

• a migration that is blocked is charged. A migration is blocked when it runs but does not clear the parity or test gates, so the result is held for you to review rather than delivered. This is a normal outcome and the credits are consumed;
• a migration you cancel after it has started is not refunded;
• a migration that fails is not refunded either. The run consumed the compute it was sold;
• retrying a blocked or failed migration does not charge you again. Retries are free by design: the charge stays attached to the migration, so restarting it never debits you a second time;
• if we cannot start your migration at all, the credits stay attached to it and it remains startable — you keep what you paid for and are not charged again when you start it.

If a run did not give you what you paid for, contact us (§5.5). We are not obliged to refund, but we would rather hear about it.

5.4 Credits are prepaid, are not a store of monetary value, and are not redeemable for cash. Unused credits remain available while your account exists and are forfeited on account deletion (§12.2).

5.5 If you believe a charge does not reflect the service you received, contact us at support@lastloop.com and we will review it case by case. We are not obliged to refund a charge that arose as described in §5.3, but we may do so at our discretion.

5.6 All prices are stated net of VAT. VAT is added where applicable. For business customers established in another EU member state who supply a valid VAT identification number, the reverse-charge procedure applies (Art. 196 of Council Directive 2006/112/EC); you are responsible for accounting for VAT in your member state. You are responsible for the accuracy of the VAT identification number you supply.

6. Intellectual property

6.1 Your code stays yours. We claim no ownership of your source code or of the migrated output. The migrated code and the pull request are delivered to your repository under your existing rights.

6.2 We retain all rights in the Service itself (software, models, and infrastructure). Nothing here transfers our IP to you.

6.3 You grant us a limited, non-exclusive license to access, copy, transform, and store your code solely to perform the migration and deliver the result, for the duration necessary to do so (see the Data Retention Policy).

7. Scope, limitations and disclaimers

7.1 Code, not data. The Service migrates code only. Your database upgrade remains with Odoo's own upgrade platform. Use Odoo.sh Test Upgrade to rehearse the data upgrade.

7.2 Parity is a signal, not a guarantee. The parity gate measures structural equivalence of models, fields, views, actions and access rules against a baseline of stock Odoo on the target version, and the migrated code must also pass static, server and browser tests. This is a strong signal but not a guarantee of behavioural equivalence. You must review and test the delivered pull request before relying on it.

7.3 The migration is produced by AI. Modules are migrated by AI agents following defined processes and curated Odoo migration knowledge, subject to the gate in §7.2. We do not warrant that the migrated code is correct, complete, or fit for your purpose, and you must not deploy it without review.

7.4 Third-party dependencies. OCA/community submodules are pinned on a best-effort basis; external Python packages are flagged, not installed. Private submodules we cannot read are excluded with a reason.

7.5 No professional advice. The Service does not provide legal, tax, or compliance advice.

7.6 Warranty. The Service is provided "as is" and "as available". To the extent permitted between businesses under Austrian law, we exclude all implied warranties and any warranty of merchantability, fitness for a particular purpose, or non-infringement. In particular we do not warrant that the Service will be uninterrupted or error-free, that a migration will clear the parity gate, or that migrated code will function correctly in your environment. Statutory warranty rights (Gewährleistung, §§ 922 ff ABGB) are limited to the extent legally permissible between entrepreneurs; the presumption of defectiveness under § 924 ABGB is excluded.

8. Availability, changes and suspension

8.1 We aim for high availability but do not commit to a service level unless separately agreed in writing. No service-level agreement forms part of these Terms.

8.2 We may modify, suspend, or discontinue the Service or any feature, and may suspend your access for breach of these Terms or suspected abuse.

9. Limitation of liability

9.1 We are liable without limitation for damage caused intentionally or by gross negligence, for personal injury (death, bodily harm or damage to health), and under the Austrian Product Liability Act (Produkthaftungsgesetz). Nothing in these Terms limits liability that cannot be limited by law.

9.2 Otherwise, and to the extent permitted between businesses, liability for slight negligence (leichte Fahrlässigkeit) is excluded.

9.3 Where we are liable and paragraph 9.1 does not apply, our aggregate liability for all claims arising in any twelve-month period is limited to the fees you paid for the Service in the twelve months preceding the event giving rise to the claim.

9.4 We are not liable for indirect or consequential loss, loss of profit, loss of savings, loss of data, business interruption, or third-party claims, except in the cases described in paragraph 9.1.

9.5 You remain responsible for reviewing and testing every delivered pull request before merging or deploying it (§3.2, §7.2, §7.3). We are not liable for loss arising from migrated code you merged or deployed without adequate review and testing, nor for the state of any environment you deploy it to.

9.6 Claims for damages must be brought within the periods provided by law; we recommend you notify us of any defect without undue delay.

10. Indemnity

You will indemnify and hold us harmless against third-party claims, and reasonable associated legal costs, arising from (a) your breach of these Terms, (b) your lack of rights or licence in the code or repositories you connect, (c) your misrepresentation of an Enterprise-licence attestation under §4, or (d) your use or deployment of migrated output. We will notify you of any such claim without undue delay and will not settle it without your consent, which you will not unreasonably withhold.

11. Data protection

Our processing of personal data is governed by our Data Processing Agreement and Data Retention Policy, which are incorporated into these Terms by reference. Our security controls are described in the Security Overview.

12. Term and termination

12.1 These Terms apply while you use the Service.

12.2 You may stop using the Service and delete your account and data at any time from Account in the app (self-serve erasure). Deleting your account forfeits any remaining credit balance (§5.4).

12.3 We may terminate or suspend your access for material breach of these Terms or suspected abuse, with notice where reasonably practicable.

12.4 On termination, §§5.4, 6, 7, 9, 10, 14 and 15 survive.

13. Changes to these Terms

We may amend these Terms. We will give notice of material changes by email or in the Service at least 30 days before they take effect. If you do not accept a change, your remedy is to stop using the Service and delete your account before the change takes effect; continued use after that date constitutes acceptance.

14. Governing law and disputes

14.1 These Terms are governed by Austrian law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

14.2 The exclusive place of jurisdiction for all disputes arising out of or in connection with these Terms is the court with subject-matter jurisdiction in Vienna, Austria, to the extent such an agreement is permissible.

15. Severability

If any provision of these Terms is or becomes invalid or unenforceable, the validity of the remaining provisions is unaffected. The invalid provision is replaced by a valid one that comes closest to its commercial purpose.

16. Contact

Last Loop GmbH
Darwingasse 20/29, 1020 Wien, Austria
FN 676580x, Handelsgericht Wien
General and billing: support@lastloop.com · Legal and data protection: legal@lastloop.com

Full company disclosure: Imprint.

Odoo Migrator — Data Processing Agreement (DPA)

Parties: Last Loop GmbH, Darwingasse 20/29, 1020 Wien, Austria, FN 676580x
(Handelsgericht Wien) ("Processor", "we") and the Customer ("Controller", "you")
who accepts the Terms of Service.
Applies to: processing of personal data in connection with the Service.
Effective date: 27 August 2026

1. Roles

1.1 For the personal data processed to operate the Service, you are the Controller and we are the Processor (or sub-processor where you act as a processor for your own end customer).

1.2 We process personal data only on your documented instructions, which are constituted by the Terms of Service, this DPA, and your use of the Service.

2. Subject matter, nature and purpose

We process data solely to: authenticate you, read your connected source code, perform the code migration in an isolated workspace, and deliver the result as a pull request — plus the metering and audit needed to run the Service.

3. Categories of data and data subjects

3.1 Personal data we process

• Account/identity: your platform identity (the OIDC subject, email, and display name from the Lastloop identity provider), the platform workspace provisioned for you, and — once you connect GitHub or GitLab — your login and user ID on that forge.
• Forge access tokens: your OAuth access/refresh token for the forge you connect is stored in our database, encrypted at rest with AES-256-GCM, and is used solely to scope repository listings to your own account and to read the repositories you select. If you connect a self-hosted GitLab instance, the access token you supply for it is stored the same way, per instance. Tokens are deleted when you revoke the authorization, remove the connection, or delete your account.
• Operational metadata: repository names, branch names, installation IDs, migration timestamps, credit/usage records, and audit events.

3.2 Source code (may incidentally contain personal data)

Your repository contents are processed transiently to perform the migration. Code may incidentally contain personal data (e.g. author names in comments, test fixtures). We do not target or index personal data within code; we transform it to migrate it.

3.3 What we do NOT process

We do not access your production database, your live Odoo environment, or end-user records held in your systems.

Model training. We do not use your code or the personal data within it to train any model of ours, and we do not sell it or disclose it for advertising. The migration engine transmits your module source to the model provider named in §4; we contractually require that provider not to train on, or retain beyond the duration of the request, the content we send. [BLOCKING BEFORE PUBLICATION: this commitment can only be made once the provider is pinned and its terms confirmed in writing — see the action note in §4. Do not publish this sentence until then.]

3.4 Data subjects

You and your authorised users; incidentally, individuals referenced within connected source code.

4. Sub-processors

4.1 We use the following sub-processors:

Note that GitHub and GitLab are sub-processors only to the extent you choose to connect a repository hosted with them; they are also, independently, your own service providers.

Where you connect a self-hosted GitLab instance, that instance is your infrastructure, not a sub-processor of ours; we connect outbound to it using the access token you supply.

4.2 We impose data-protection obligations on each sub-processor no less protective than this DPA and remain liable for their performance.

4.3 We will give you at least 30 days' notice before adding or replacing a sub-processor, by email to your account address and by updating this page. You may object on reasonable data-protection grounds within that period; if we cannot offer a reasonable alternative, you may terminate the affected part of the Service and we will refund any prepaid, unused credits.

BLOCKING ACTION — DO NOT PUBLISH THIS DPA UNTIL RESOLVED.

The migration engine's phase agents read and transform your module source using a large language model, reached through the platform's llm-proxy-v2 service. That proxy routes by model name and is configured with credentials for Anthropic, OpenAI, Google, z.ai (Zhipu), DeepSeek, Moonshot and MiniMax, plus federated self-hosted runtimes. A request for a auto/tier-resolved model is dispatched dynamically.

Two consequences:

1. We cannot name a sub-processor set until the engine is pinned to a specific provider. Art. 28(2)/(4) requires sub-processors to be identifiable; "an AI model provider" is not a lawful disclosure.
2. Several of the configured providers are established in China, for which there is no adequacy decision. If customer source code can reach them, that transfer needs its own Art. 46 safeguard and a transfer impact assessment — a materially different compliance posture from a US provider under SCCs.

Required before launch: pin the migration engine to one named provider (and region), confirm that provider's retention and no-training terms in writing, then list it in the table above, in the Security Overview, and on the in-app Trust page — all three must agree.

5. Security measures

We implement appropriate technical and organisational measures, including:

• Encryption at rest: your forge OAuth token, any self-hosted GitLab access token, and the one-time working-repository push credentials are all sealed with AES-256-GCM. One-time credentials are deleted when a migration completes, fails or is cancelled; for a blocked migration they are retained so a retry can succeed and are removed with the working repository at the retention sweep.
• Tenant isolation: each customer is a separate platform workspace; every migration, repository, credential, and credit balance is scoped to that workspace, and a partner cannot access another account's data.
• Platform sign-in: authentication is a short-lived OIDC bearer token validated by the platform (no long-lived session cookie or per-service signing key); constant-time webhook signature verification; per-partner rate limiting.
• Transport encryption (HTTPS/TLS) for all external traffic.
• Least-privilege service credentials and secrets delivered via a secrets sidecar (never in source or manifests).

See the Security Overview for detail.

6. Confidentiality

Personnel authorised to process personal data are bound by confidentiality.

7. Assistance to the Controller

We will assist you, taking into account the nature of processing, with: data subject requests, DPIAs, and consultations with supervisory authorities. The Service provides self-serve data export [IF/WHEN AVAILABLE] and erasure (account deletion) to help you meet these obligations.

8. Data subject rights

The Service provides self-serve account deletion (erasure) from the Trust & data page. This cancels any in-flight migrations, revokes your stored forge connection, deletes the mirrored working repositories holding copies of your modules, and purges your sealed tokens, migrations, events, one-time credentials and the account record. See the Data Retention Policy for the exact sequence and its best-effort steps. For access/rectification/portability requests not covered by self-serve tooling, contact legal@lastloop.com. We will respond without undue delay and in any event within the periods required by the GDPR.

9. Personal data breach

We will notify you without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting your data. Notice is sent by email to your account address and to any security contact you have given us, and includes the information available to us at that time: the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed, and a contact point. We will supplement the notice as further information becomes available, and will assist you with your own notification duties under Arts. 33-34 GDPR.

10. International transfers

Primary compute and database hosting is in the EU (Hetzner, Helsinki), and the Last Loop platform runs in the same cluster. No transfer outside the EEA is required to operate the core Service.

Transfers outside the EEA arise only from sub-processors you engage us to work with, or that we name in §4:

• GitHub, Inc. and GitLab Inc. (United States) — only where you choose to connect a repository hosted there. These transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3, processor-to-processor) as incorporated into those providers' data protection terms, together with the supplementary measures described there.
• Stripe — handled under Stripe Payments Europe, Ltd. (Ireland); onward transfer to Stripe, Inc. relies on the Standard Contractual Clauses.
• The model provider named in §4 — transfer basis to be stated once the provider is pinned. [BLOCKING: if the pinned provider is established outside the EEA in a country without an adequacy decision, an Art. 46 safeguard and a transfer impact assessment are required before publication, because the data transferred is customer source code.]

Where we rely on Standard Contractual Clauses we will provide a copy on request to legal@lastloop.com.

11. Retention and deletion

Retention and deletion are governed by the Data Retention Policy. On termination or on your request, we delete or return personal data as set out there, subject to legal retention requirements.

12. Audits

We will make available the information necessary to demonstrate compliance with Art. 28 GDPR. On reasonable written notice, and no more than once in any twelve-month period unless a supervisory authority requires otherwise or a personal data breach has occurred, you may audit that compliance — in the first instance by reviewing our documentation and the Security Overview, and where that is genuinely insufficient by an on-site or remote audit conducted during business hours, without unreasonable disruption, and subject to confidentiality. You bear your own audit costs and those of any third-party auditor, who must not be our competitor.

13. Liability and governing law

Liability and governing law follow the Terms of Service — Austrian law, place of jurisdiction Vienna — unless separately agreed in writing. Nothing in this DPA limits either party's liability under Art. 82 GDPR.

Annex A — Processing summary: see §2–§3.
Annex B — Sub-processors: see §4.
Annex C — Technical & organisational measures: see §5 and the Security
Overview.

Imprint / Impressum

Disclosure pursuant to § 5 of the Austrian E-Commerce Act (ECG), § 14 of the Austrian Commercial Code (UGB) and § 25 of the Austrian Media Act (MedienG).

Media owner and service provider

Last Loop GmbH
Darwingasse 20/29
1020 Wien
Austria

Company details

Contact

General enquiries and billing: support@lastloop.com
Legal and data protection: legal@lastloop.com
Security / responsible disclosure: security@lastloop.com

Trade regulations and supervisory authority

Trade: IT services (Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik), a free trade (freies Gewerbe) under the Austrian Trade Act (Gewerbeordnung 1994), available at https://www.ris.bka.gv.at.

Supervisory / trade authority: Magistratisches Bezirksamt für den 2. Bezirk, City of Vienna.

Chamber membership: Wirtschaftskammer Wien (Austrian Federal Economic Chamber), Division of Information and Consulting (UBIT). [TO CONFIRM BEFORE PUBLICATION: chamber division and any further trade registration, once the company's Gewerbeanmeldung is to hand.]

Purpose of this website

Odoo Migrator (https://migrate-odoo.com) is a commercial software service operated by Last Loop GmbH. This site presents that service, provides its contractual and data-protection documentation, and gives customers access to it.

Online dispute resolution

The Service is offered to businesses only (see the Terms of Service, §2.1) and is not directed at consumers. We are neither obliged nor willing to participate in dispute-resolution proceedings before a consumer arbitration board.

Further documents

• Terms of Service
• Data Processing Agreement
• Data Retention Policy
• Security Overview

Liability for links

This site may contain links to external websites operated by third parties, over whose content we have no control. We accept no liability for third-party content; the respective provider or operator is responsible for it. Should we become aware of a legal infringement, we will remove the link without undue delay.

Copyright

Unless otherwise indicated, the content of this site is protected by copyright and belongs to Last Loop GmbH. Source code you connect to the Service, and the migrated output delivered to you, remain yours — see the Terms of Service, §6.