Privacy policy
What Omni Agent collects, what your bots do with your data, how long it's kept, and how to have it removed.
Who we are
Omni Agent (omniagentapp.co) is run by Linkos, Athens, Greece ("we"). We decide how the personal data on this page is used, so we are its controller.
When your bots handle data about other people for you, such as the emails your customers send you, you decide what happens with it. For that data you are the controller and we process it on your behalf, under the data processing terms in our terms.
To reach us about anything on this page, email contact@omniagentapp.co or use the contact page.
What we collect
- Your account: your name, email address, password (stored only as a one-way hash), business name, website, language and the plan you're on.
- Your team: the names and email addresses of people you invite, and their roles.
- What your bots work with: the data in the tools you connect (for example emails, calendar events, files, receipts and payments), only for the bots you hire and only while they're connected.
- What your bots do: a log of every action, with the time, the bot, what it did, and who approved it.
- Payments: handled by Stripe. We see your billing name, address, VAT ID and the last four digits of your card, never the full card number.
- Forms and free tools: what you send us through the contact form, the AI Act check or a newsletter sign-up.
- Visits to the website: counted without cookies, as described below.
We don't buy data about you, and we don't build a profile of you from other sources.
Why we use it, and on what basis
| What for | Legal basis |
|---|---|
| Running your account and your bots | The contract with you |
| Billing, invoices and tax records | The contract, and our legal duty to keep accounts |
| Answering your messages and support requests | The contract, or our legitimate interest in answering you |
| Emails about your account (receipts, approvals, alerts) | The contract |
| Newsletter and tips | Your consent, which you can withdraw with one click |
| Counting visits and keeping forms free of spam | Our legitimate interest in a working, safe website |
| Google Analytics | Your consent in the cookie banner |
| Ahrefs Web Analytics | Our legitimate interest in a working website |
What your bots do with your data
A bot reads the data in the tools you connect only to do the job you gave it. It works within the limits you set: for each kind of action, Alone, Ask me or Never. Sending, paying and deleting wait for your yes unless you change that.
When you disconnect a tool, the bots stop reading it at once, and the access tokens are deleted. Copies of items a bot already worked on (for example a draft reply) stay in your account until you delete them or close the account.
Access tokens for your tools and any keys you add are stored encrypted (AES-256-GCM) and are never shown in full or written to logs.
How AI is used
To do their jobs, bots send the text they need (for example an email they are answering) to an AI model. These requests go through withConflux, our AI gateway, to model providers such as Anthropic and OpenAI.
Your data is not used to train AI models, by us or by the model providers we use. Each request carries only what the job needs.
We keep a record of each AI request (the bot, the model, the size and the cost) so we can bill fairly and spot problems. We don't keep the text that was sent to the model. What each bot did is in its activity log for 90 days, then deleted.
The free AI Act check
The check reads the public pages of the website you enter. We keep the website address and the result so the report link works, for 90 days. If you give your email address, we first send a link to confirm it, then the report. We don't send you anything else unless you also subscribe.
Counting visits
We count page views and button clicks ourselves, without cookies. For each one we keep the page, the site you came from (its name only), any campaign tags in the link, the kind of device, and the country our network provider reports. We also count page views per city, as daily totals that aren't linked to a visitor or a page.
A visitor is counted with a one-way code made from the date, the network address and the browser type. The network address itself is never stored, the code can't be turned back into it, and it changes every day, so we can't follow anyone from one day to the next. If your browser sends "Do Not Track" or "Global Privacy Control", nothing is counted.
Google Analytics runs only if you accept it in the cookie banner. The cookie policy lists every cookie.
Ahrefs Web Analytics counts visits to the public website, never inside your account. It sets no cookies. If your browser sends "Do Not Track" or "Global Privacy Control", it doesn't run.
Keeping forms free of spam
Forms use Cloudflare Turnstile to check that a person is sending them. It runs only when you send a form. When a form refuses a submission as spam, we keep the form, the reason, the time, the country and a one-way code of the network address. A message that gets through but looks like spam is kept and marked for us to read; it is never deleted on its own.
Who we share data with
We don't sell or rent your data. These services help us run Omni Agent, each under a contract that limits what it may do with the data:
| Service | What for | Where |
|---|---|---|
| Hetzner | Servers and database | EU (Finland) |
| Cloudflare | Delivering the website, Turnstile spam check | Global network |
| withConflux | Our AI gateway (run by the same team) | EU |
| Anthropic, OpenAI | AI models the bots use | USA |
| Stripe | Payments and invoices | EU and USA |
| Resend | Sending email | EU / USA |
| Meta | Approvals and briefs on WhatsApp, if you switch them on | EU / USA |
| Google Analytics | Visit statistics, only after you accept | USA |
| Ahrefs | Visit statistics on the public website, without cookies | Singapore |
The tools you connect (Gmail, Outlook, Google Drive and others) are your own accounts with those companies. Their own privacy policies apply to them.
Omni Agent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Transfers outside the EU
Some of the services above may handle data outside the European Economic Area, mainly in the USA. When they do, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
How long we keep it
| Data | Kept for |
|---|---|
| Your account, bots and their settings | While your account is open |
| Each bot's activity log | 90 days |
| After you close your account | Deleted within 30 days, backups within 90 days |
| Invoices and payment records | As long as Greek tax law requires |
| Record of each email we send | 90 days |
| Addresses that bounced for good or marked our email as spam | Until you ask us to email you again, so we don't email them by mistake |
| Contact messages | 2 years, or less if you ask |
| Newsletter address | Until you unsubscribe; then only the address and the fact you unsubscribed |
| Daily visitor codes | Changed every day; counts kept as totals |
Your rights
You can ask what we hold about you, get a copy, have it corrected or deleted, restrict or object to how we use it, and take it to another service. You can export your account data and delete your account yourself in Settings at any time.
To use any of these rights, email contact@omniagentapp.co. We answer within 30 days.
If you think we've handled your data wrongly, you can complain to the Hellenic Data Protection Authority (dpa.gr) or the data protection authority where you live.
Children
Omni Agent is a service for businesses. It is not meant for anyone under 18.
Changes to this policy
If this policy changes in a way that matters, we'll update the date at the top, say what changed, and email account holders before the change takes effect.