Privacy Policy

1. Introduction

Omni ("we", "our") is operated by Masters Global Inc. This policy explains what personal data we collect, why, and the rights you hold over it. It applies to the Omni web app, PWA, and native applications.

2. Information We Collect

• Account data: username, optional email, date of birth (for age assurance), password (stored as a salted hash).
• Wellbeing data (special category): mood logs, wellness progress, and personal beliefs in your persona — processed only with your explicit consent.
• Conversations: your chats with Omni's AI personas.
• Payment data: transaction references and plan details. Card details never touch our servers — they are handled by Stripe.
• Technical data: device/browser info and security logs for abuse prevention.

3. How We Use Your Information

• To provide and personalize your AI companion experience.
• To power mood insights and goals (with your explicit consent).
• To process subscriptions and send transactional emails.
• To keep the platform safe (rate limiting, abuse detection).

We never sell your data or use it for third-party advertising.

4. Data Protection & Encryption

All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed with bcrypt. Access to production data is restricted and logged.

5. Data Sharing

We share data only with processors necessary to run the service: Stripe (payments), Resend (email), Google Firebase (push notification delivery), and AI model providers (transient processing of prompts, no training on your data). Each is bound by a data processing agreement.

6. Your Rights (GDPR & Global)

• Access: request a copy of all data we hold (Settings → Export My Data).
• Rectification: correct inaccurate personal information.
• Erasure: delete your account and all associated data.
• Portability: export your data as JSON or PDF at any time.
• Restriction & withdrawal: withdraw wellbeing-data consent at any time in Settings.

6a. Jurisdiction-Specific Notices

• United Kingdom (UK GDPR & DPA 2018): you may lodge a complaint with the ICO (ico.org.uk). Special category data is processed only with your explicit consent, which you may withdraw at any time.
• European Union (GDPR): legal bases are contract performance (account & subscriptions), explicit consent (Art. 9 wellbeing data, marketing), and legitimate interest (security). You may complain to your national supervisory authority.
• United States (CCPA/CPRA): we do not sell or share your personal information. You have the right to know, delete, correct, and limit use of sensitive personal information — exercised via Settings or privacy@omnimodules.com.
• Canada (PIPEDA): we obtain meaningful consent for collection, use, and disclosure. You may withdraw consent or complain to the Office of the Privacy Commissioner of Canada.
• Nigeria (NDPA 2023): requests may be sent to privacy@omnimodules.com; complaints may be lodged with the Nigeria Data Protection Commission.

7. Children's Privacy

Omni requires users to be at least 13 years old — date of birth is verified at signup and under-13 registration is blocked. Users aged 13–15 require verified parent/guardian consent via an email confirmation link before their account is activated, and parents receive a Parent Dashboard to review access and revoke consent anytime. All users under 18 automatically receive teen-safe content settings.

8. Data Retention

We retain your data for as long as your account is active. Upon account deletion, all personal data is permanently removed immediately; payment records are anonymized and retained only as required by financial law. Automated retention sweeps purge expired tokens and logs on a fixed schedule.

9. Contact Us

For privacy inquiries: privacy@omnimodules.com
Masters Global Inc. — Global Operations