Omnaly

Omnaly Privacy Policy

Effective date: 8 August 2026

This policy explains what personal information Omnaly (https://omnaly.app) collects, why, where it goes, and what your rights are. It is written to comply with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA), including the notification requirements of section 18.

1. Who Is Responsible for Your Information

The "responsible party" under POPIA is:

Software Solutions Services (sole proprietorship)
Republic of South Africa
Email: [email protected]
Phone: +27 68 659 2320
A physical address is available on request by emailing the address above.

2. What We Collect

Category	Details
Account data	Name, email address, and a hash of your password (we never store your password in plain text).
Chat content	The messages you send, the AI responses you receive, and files you upload for analysis.
Usage and technical data	Approximate usage volumes (for credit limits), device/browser type, IP address, and logs needed to run and secure the Service.
Payment status	Whether you have an active subscription and which plan. Your card and payment details are collected and held by our payment processor, PayFast, never by Omnaly.
BYOK API keys	If you add your own API keys, we store them to send your requests to the provider you chose.

Providing account information is voluntary, but without it we cannot create your account or provide the Service. Chat content is only processed because you choose to submit it.

3. Why We Process It (Purposes)

We process your information to:

Provide the Service: sending your chats and files to AI providers and returning responses;
Create and manage your account, and authenticate you;
Enforce credit limits, rate limits, and our Terms of Service;
Process subscription status (via PayFast);
Secure, debug, and improve the Service;
Communicate with you about your account and important changes;
Comply with legal obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Cross-Border Transfers (POPIA Section 72)

This is important: to work, Omnaly must send your chats and uploaded files outside South Africa.

When you send a message or upload a file, it is transmitted to third-party AI providers whose servers are located in the United States and other countries. Our hosting and infrastructure providers also store data outside South Africa. The third parties (sub-processors) we currently use are:

Provider	Role	Location
Mistral AI	AI model provider	France / United States
Groq Inc.	AI model provider	United States
Cloudflare Inc.	Infrastructure, security, AI services	United States
Hetzner Online GmbH	Server hosting (the servers Omnaly runs on)	Germany
MongoDB Atlas	Database hosting (your account and chat history)	Germany (Frankfurt)
Supabase	Vector storage for documents you upload	United Kingdom (London)
Resend	Sending account emails (verification, password reset)	Ireland

If you use your own API key (BYOK), your requests are also sent to the provider you chose: OpenAI, Anthropic, Google, or OpenRouter — each of which processes data on its own servers, primarily in the United States, under its own privacy policy.

These countries may not offer the same level of legal protection for personal information as POPIA. We rely on your consent for these transfers: when you sign up, you tick a checkbox consenting to your chats and files being processed by third-party AI providers outside South Africa. If you do not consent, you cannot use the Service, because this processing is what the Service is.

5. Training Disclosure — Please Read

Free-tier requests routed to Mistral's free API tier may be used by Mistral to improve (train) its models. In practical terms: content you submit on the free tier may not stay purely transient — it may be retained and used by Mistral for model improvement under Mistral's own terms.

Because of this, do not submit sensitive personal information (such as ID numbers, financial account details, health information, or other people's personal data) in your chats or uploaded files — especially on the free tier. Treat anything you submit as data that leaves your control.

6. How Long We Keep Your Data (Retention)

Chats and uploaded files: kept until you delete them, or until you delete your account. You can delete individual conversations in the app at any time.
Account data: kept while your account exists.
Account deletion: available in-app. When you delete your account, we delete your account data, chats, and files, except for minimal records we must keep for legal, security, or accounting reasons.
Note: data already processed by third-party AI providers is subject to their own retention policies (see Sections 4 and 5).

7. How We Protect Your Data (Security)

We take reasonable, appropriate technical and organisational measures, including:

Encryption in transit (TLS/HTTPS) for all traffic between you, our servers, and providers;
Hashed passwords — passwords are stored only as cryptographic hashes;
Access controls — production data access is restricted and limited to what is needed to operate the Service;
Reputable, security-audited infrastructure providers.

No system is perfectly secure. If a data breach occurs that affects you, we will notify you and the Information Regulator as POPIA requires.

8. Your Rights Under POPIA

You have the right to:

Access — ask what personal information we hold about you and receive a copy;
Correction — ask us to correct inaccurate or outdated information;
Deletion — ask us to delete your personal information (or delete your account yourself in-app);
Objection — object to processing of your personal information on reasonable grounds;
Withdraw consent — withdraw consent at any time (this will mean you can no longer use the Service, since the processing is necessary to provide it).

To exercise any of these rights, email [email protected]. We will respond within a reasonable time and at most within the periods POPIA prescribes.

If you are not satisfied with our response, you have the right to complain to the Information Regulator (South Africa):

Email: [email protected]
Website: https://inforegulator.org.za

9. Children

Omnaly is an 18+ service. We do not knowingly collect personal information from anyone under 18. If we learn that we hold information about a person under 18, we will delete the account and its data. If you believe a minor is using the Service, contact us at [email protected].

10. Cookies and Analytics

We keep tracking to a minimum:

We use only privacy-respecting analytics (Cloudflare Web Analytics), which does not use client-side tracking cookies and does not profile you across sites;
We use essential cookies/local storage needed for login sessions and app functionality;
We do not use advertising trackers, third-party ad cookies, or cross-site tracking.

11. Changes to This Policy

We may update this policy from time to time — for example when we add or change AI providers. If we make material changes, we will notify you by email or in-app notice before they take effect, and update the effective date at the top. The current version will always be available at https://omnaly.app/privacy.

Questions? Email [email protected].

Back to Omnaly