This Privacy Policy explains how we collect, use, store, and protect your personal data when you use OmniOps. We are committed to protecting your privacy and ensuring transparency about our data practices.
Our Commitment
We take your privacy seriously. This policy describes our practices in accordance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), the EU AI Act, and other applicable privacy laws. We only collect data necessary to provide our services and we never sell your personal information.
Definitions
To help you understand this policy, here are key terms we use:
Personal Data: Any information that relates to an identified or identifiable individual
Processing: Any operation performed on personal data (collecting, storing, using, sharing, deleting)
Data Controller: The entity that determines the purposes and means of processing (us, when we process your data)
Data Processor: An entity that processes data on behalf of the controller (our service providers)
Data Subject: The individual whose personal data is being processed (you)
Data We Collect
Information You Provide
Chat messages and conversations with our AI assistant
Account registration information (email, business name)
Payment information (processed securely by our payment provider)
Support inquiries and feedback
Information Collected Automatically
Session identifiers (anonymous, no personal data required)
Website domain where the chat widget is installed
Basic usage analytics (page views, chat interactions) — only with your analytics consent
Device type, browser type, and operating system — only with your analytics consent
IP address (anonymized for analytics) — only with your analytics consent
Timestamps of interactions
Mobile Application (iOS)
When you use our iOS application, we additionally collect:
Device model and operating system version (for compatibility and support)
App version and build number (for troubleshooting)
Session authentication tokens (stored securely in iOS Keychain)
Conversation history (synced with your account on our servers)
We do not collect location data, contacts, photos, or other device data beyond what is listed above. The iOS app does not use third-party analytics SDKs — all analytics flow through our own server infrastructure.
Information from Third Parties
We may receive information from third-party integrations you connect:
WooCommerce: Product catalogs, order information (when you enable this integration)
Shopify: Store data, product catalogs, customer information, order, fulfilment, return, and refund information (when you enable this integration)
Google Workspace: Calendar events, emails, documents, and contacts (when you enable this integration)
Microsoft 365: Calendar events, emails, and Teams data (when you enable this integration)
WhatsApp, Instagram, and Messenger: Customer messages and conversation history (when you enable these integrations)
Meta Ads: Campaign performance data (when you enable this integration)
Legal Basis for Processing (GDPR Article 6)
We process your personal data only when we have a valid legal basis to do so under GDPR:
Contract Performance (Art. 6(1)(b))
Processing necessary to provide our services to you:
Providing the AI chat widget functionality
Processing and responding to chat conversations
Managing your account and subscription
Providing customer support
Consent (Art. 6(1)(a))
Processing based on your explicit consent:
Marketing communications and newsletters
Non-essential cookies and analytics
Optional product integrations
Withdrawing Consent
You can withdraw consent at any time using our cookie consent banner, the preference center in your dashboard, or by contacting us. When you withdraw analytics consent, all analytics cookies are automatically removed. Withdrawal does not affect lawfulness of processing before withdrawal.
Legitimate Interests (Art. 6(1)(f))
Processing based on our legitimate business interests, balanced against your rights:
Security monitoring and fraud prevention
Service improvement and analytics
Troubleshooting and technical support
Enforcing our terms of service
Legal Obligation (Art. 6(1)(c))
Processing required to comply with legal obligations:
Tax and accounting requirements
Responding to lawful requests from authorities
Data protection compliance and audit trails
AI and Automated Processing
AI Disclosure (EU AI Act Article 50)
Our chat widget uses artificial intelligence to generate responses. When you interact with our chat widget, you are communicating with an AI system, not a human.
Our service processes data in the following ways:
Customer Chat Responses: Website chat messages are processed by commercial AI API providers, primarily OpenAI, to generate contextually relevant support responses
Content Understanding: We crawl and index your website content to build a knowledge base for your specific products and services
Merchant-Facing AI: Authenticated business users may use other commercial AI providers listed in our DPA, such as Anthropic or Google, for business operations and content workflows
No Automated Decision-Making: We do not use AI to make automated decisions that have legal or similarly significant effects on you
Important limitations:
AI responses may not always be accurate - users should verify important information
AI cannot provide medical, legal, or financial advice
AI responses are generated based on training data and may not reflect current information
Human oversight is available through your account dashboard
You have the right to request human review of any AI-generated response or to opt out of AI processing where technically feasible. Contact us to exercise these rights.
Shopify, Customer Data, and AI Support
Minimum necessary use
Our public Shopify App Store app is read-only. It uses product catalogue data and Level 1 order data for the merchant's store assistant. It does not request access to protected customer name, email, phone, or address fields for product features.
Public Shopify App Store App
Product and catalog data, such as product names, variants, prices, availability, and public product descriptions
Level 1 order data needed for merchant questions, such as order number, status, items, totals, and fulfilment status
No Shopify Admin write actions: the public app does not create refunds, cancel orders, update customers, or modify store data
Shopify's mandatory privacy webhooks may include customer, request, shop, order, email, or phone identifiers solely so we can fulfil an access or redaction request; those fields are not requested for the app's product features
Separately Connected Direct or Custom Shopify Integrations
A merchant may separately connect a direct or custom Shopify integration outside the public App Store app. Those integrations can use additional customer, shipping, return, refund, or write permissions only when the merchant enables the relevant connection and workflow. Their granted scopes and approval controls are separate from the public app's read-only permissions.
How AI Handles That Data
The public app assistant receives bounded, read-only product and order projections rather than unrestricted Shopify records
Customer-facing storefront chat in the public app is limited to customer-safe product operations
Where a separate direct or custom integration uses order-specific customer data, verification and application permission checks run before that data is retrieved or an action is executed
Payment details, Shopify access tokens, webhook secrets, customer IP addresses, browser details, and internal Shopify tokens are not sent to the AI
Sensitive write actions are not available to the public app; direct or custom integration actions are checked by application code rather than left to the AI alone
Model Training and Reuse
We use commercial AI API providers as subprocessors to provide the service. We do not opt Shopify customer data, order data, or customer chat transcripts into voluntary model training. We also do not use raw customer transcripts or raw Shopify records to train a general service-wide model by default.
Improvement for one account may use that account's own data where this is included in the service and subject to retention and deletion controls
Global improvement uses aggregate, redacted, synthetic, or explicitly opted-in data
Data subject requests can include Shopify-derived support records held in the service
Meta Platform Data (Facebook, Instagram, WhatsApp, Meta Ads)
Limited Use
To the extent we receive data sourced from the Meta Platform (Facebook, Instagram, WhatsApp, or Meta Ads) as part of an OmniOps customer's connected integration, we use that data solely for the limited purposes stated in this Privacy Policy and our Data Processing Agreement. We do not use Meta Platform data for other purposes, and we do not sell, license, or share it with third parties except as required to operate the service.
What Meta data we may access
Facebook Page identifiers, names, and Page access tokens needed to read and send messages on a connected page's behalf
Inbound Messenger, Instagram DM, and WhatsApp messages sent by end-customers to a connected merchant
Outbound replies generated by our customer-service agent on the merchant's behalf
Instagram Business account identifiers and basic profile metadata
WhatsApp Business Account identifiers and registered phone numbers
Meta ad account identifiers and aggregate campaign performance metrics (spend, impressions, clicks, ROAS) for ad accounts the merchant has explicitly connected
How we use it
Routing inbound customer messages to a focused customer-service agent that answers product, order, return, shipping, and store-policy questions on the merchant's behalf
Sending the merchant-authored reply back to the originating Meta channel within the 24-hour customer-service window
Displaying aggregate ad performance to the merchant inside their OmniOps dashboard
Operational logging needed to debug failures and meet our security obligations
What we do NOT do
We do not use Meta Platform data to train AI or ML models, our own or our subprocessors', without explicit consent
We do not use Meta Platform data for advertising, lookalike-audience building, or audience expansion
We do not transfer Meta Platform data to any party other than the subprocessors listed in our Third-Party Services section
We do not retain Meta-sourced message content beyond the retention periods stated in our Data Storage section
Channel boundaries
Our customer-service agent answering Meta channel messages is bounded to commerce assistance tasks (orders, products, returns, shipping, store policy). It does not have access to business-management tools, Google Workspace, or any other merchant-internal data, and it cannot perform open-ended or general-purpose tasks outside the merchant's store context. This boundary is enforced architecturally — the Meta channels route through a separate engine and tool-set from the business-facing assistant available only to authenticated merchants.
Data deletion
When a Meta user removes the OmniOps app or revokes permissions from their Meta account, Meta sends an automated deletion notification to our callback at https://www.omniops.co.uk/api/meta/data-deletion. We disconnect the affected credentials immediately and complete full data deletion within 30 days, as required by Meta's App Platform policy.
We implement appropriate technical and organizational measures to protect your data:
Encryption at Rest: Our managed storage providers apply their documented at-rest protections. Omniops separately encrypts integration credentials and selected sensitive payloads using AES-256-GCM before storage
Encryption in Transit: Public application traffic and service connections use HTTPS or TLS with the versions negotiated by the connected endpoint
Access Controls: Role-based access using the principle of least privilege
Tenant Isolation: Customer data is logically separated and queried within its organization and, where applicable, exact store scope
API Key Encryption: Customer API keys are encrypted before storage
Regular Audits: Security reviews and vulnerability assessments
Audit Logging: Security-relevant application, authentication, integration, and privacy operations are logged where those controls apply
Infrastructure Monitoring and Recovery
We maintain operational monitoring and recovery capabilities to protect service availability and your data:
Uptime Monitoring: External health checks run every 5 minutes with automated alerting on service degradation
Error Tracking: Application errors are monitored via Sentry with automated triage and alerting
Database Backups: Our managed database provider supplies scheduled backups and recovery controls for the production database
Zero-Downtime Deployments: Code updates are deployed using a warm-standby pattern with rollback controls
Incident Response: Multi-channel alerting (email, messaging) with documented response procedures and post-incident reviews
Disaster Recovery: Documented recovery procedures combine managed database recovery with deployment rollback and server reprovisioning controls
Data Retention
We retain your data for the following periods:
Chat Conversations: 90 days (configurable in your dashboard)
Website Content: Until manually refreshed or account deletion
Analytics Data: 180 days
Account Data: Duration of account plus 2 years for legal compliance
Audit Logs: 24 months as required by regulations
You can configure shorter retention periods in your dashboard privacy settings.
International Data Transfers
Your data may be transferred to and processed in countries outside your country of residence, including to countries that may not provide the same level of data protection.
Transfer Mechanisms
When we transfer data outside the European Economic Area (EEA), we rely on:
Standard Contractual Clauses (SCCs): EU Commission-approved data transfer agreements with our processors
UK International Data Transfer Agreement (IDTA): UK-approved transfer mechanism for data originating from the United Kingdom (post-Brexit requirement)
Adequacy Decisions: Transfers to countries recognized by the EU Commission as providing adequate protection
Supplementary Measures: Additional technical and organizational safeguards where required
Third-Party Processors
The following processors may receive your data:
Anthropic (United States): Primary AI agent (Claude) — protected by SCCs and UK IDTA
OpenAI (United States): AI response generation — protected by SCCs and UK IDTA
Google (United States): AI processing (Gemini) — protected by SCCs and UK IDTA
Supabase (European Union): Primary data storage — EU-based processing
Hetzner Cloud (Germany): Production hosting — EU-based processing
Cloudflare (Global): CDN and DDoS protection — EU Points of Presence, protected by SCCs
Sentry (United States): Error monitoring — protected by SCCs and UK IDTA
Resend (United States): Transactional emails — protected by SCCs and UK IDTA
We will not discriminate against you for exercising your privacy rights. Your rights are subject to certain exemptions, such as where we need to retain data for legal compliance purposes.
Cookies and Tracking
We use cookies and similar technologies to provide and improve our services. You can manage your cookie preferences through our cookie consent banner.
Essential Cookies
These cookies are necessary for the service to function and cannot be disabled:
Session management and authentication
Chat persistence across page reloads
Security and fraud prevention
Load balancing and service delivery
Analytics Cookies (Optional)
With your consent, we use analytics cookies to:
Understand how visitors use our service
Measure the effectiveness of features
Improve user experience based on usage patterns
Cookie Preferences
You can change your cookie preferences at any time. or clear cookies in your browser settings. Note that disabling essential cookies may affect service functionality.
For a complete list of cookies including names and durations, see our Cookie Policy.
Do Not Track
We respect browser "Do Not Track" signals. When enabled, we limit tracking to essential service functionality only.
Third-Party Services
We integrate with the following third-party services to provide our functionality. Each service processes data according to their own privacy policy:
A complete list of sub-processors with locations and purposes is available in our Data Processing Agreement.
Children's Privacy
Age Restriction
Our Service is not directed to children under 16 years of age (or 13 in jurisdictions where that is the applicable age under COPPA or similar laws).
We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.
If we become aware that we have collected personal data from a child without verification of parental consent, we will take steps to delete that information from our servers promptly.
Data Breach Notification
In the event of a personal data breach, we follow strict procedures in accordance with GDPR Articles 33 and 34:
Authority Notification: We will notify the relevant supervisory authority (ICO for UK users) within 72 hours of becoming aware of a breach that poses a risk to individuals' rights and freedoms
User Notification: If a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay
Documentation: We maintain records of all breaches, including their effects and remedial actions taken
What We Will Tell You
If we need to notify you of a breach, we will provide:
A description of the nature of the breach
Categories and approximate number of data subjects affected
Likely consequences of the breach
Measures taken or proposed to address the breach
Contact details for more information
California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:
Your California Rights
Right to Know: Request information about what personal information we collect, use, disclose, and sell
Right to Delete: Request deletion of your personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information
Right to Limit: Limit the use and disclosure of sensitive personal information
Right to Non-Discrimination: Not receive discriminatory treatment for exercising your rights
Do Not Sell or Share My Personal Information
We do not sell your personal information to third parties. We do not "share" your personal information for cross-context behavioral advertising.
Categories of Information Collected
In the past 12 months, we have collected the following categories of personal information:
Identifiers (email address, IP address, session ID)
Commercial information (purchase history via integrations)
Internet activity (chat interactions, browsing behavior)