OmnalyOmnalyEffective date: 21 October 2026
This policy explains what personal information Omnaly (https://omnaly.app) collects, why, where it goes, and what your rights are. It is written to comply with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA), including the notification requirements of section 18.
The "responsible party" under POPIA is:
Contact us at this address for any privacy question or request.
| Category | Details |
|---|---|
| Account data | Name, username, email address, and a hash of your password (we never store your password in plain text). |
| Chat content | The messages you send, the AI responses you receive, and files you upload for analysis. |
| Usage and technical data | Approximate usage volumes (for credit limits), device/browser type, IP address, and logs needed to run and secure the Service. |
| Payment status | Whether you have an active subscription and which plan. Your card and payment details are collected and held by our payment processor, PayFast, never by Omnaly. |
| BYOK API keys | If you add your own API keys, we store them to send your requests to the provider you chose. |
Providing account information is voluntary, but without it we cannot create your account or provide the Service. Chat content is only processed because you choose to submit it.
We process your information to:
We do not sell your personal information, and we do not use it for third-party advertising.
This is important: to work, Omnaly must send your chats and uploaded files outside South Africa.
When you send a message or upload a file, it is transmitted to third-party AI providers whose servers are located in the United States and other countries. Our hosting and infrastructure providers also store data outside South Africa. The third parties (sub-processors) we currently use are:
| Provider | Role | Location |
|---|---|---|
| Mistral AI | AI model provider | France / United States |
| Groq Inc. | AI model provider | United States |
| OpenRouter, Inc. | AI model provider (additional models, when offered) | United States |
| Pollinations.AI | Image creation (receives the description of the picture you ask for) | Germany |
| Tavily (AlphaAI Technologies Inc.) | Web search (receives your search queries) | United States |
| Firecrawl (SideGuide Technologies, Inc.) | Reading web pages for web search | United States |
| Cloudflare Inc. | Infrastructure, security, AI services | United States |
| Hetzner Online GmbH | Server hosting (the servers Omnaly runs on) | Germany |
| MongoDB Atlas | Database hosting (your account and chat history) | Germany (Frankfurt) |
| Supabase | Vector storage for documents you upload | United Kingdom (London) |
| Resend | Sending account emails (verification, password reset) | Ireland |
| GitHub, Inc. | Encrypted backup copies, which cannot be read without our key | United States |
If you use your own API key (BYOK), your requests are also sent to the provider you chose: OpenAI, Anthropic, Google, or OpenRouter — each of which processes data on its own servers, primarily in the United States, under its own privacy policy.
If you add a connector (an MCP server), the parts of your chats that the AI sends to it, and any login details you give it, go to whoever runs that connector, wherever they are located and under their own privacy policy. You choose these services; they are not our sub-processors. We store the connector's address, and any key or login secret you enter for it in encrypted form, on your account so that it keeps working in later chats.
These countries may not offer the same level of legal protection for personal information as POPIA. We rely on your consent for these transfers: the first time you sign in, a notice explains that your chats and files are processed by third-party AI providers outside South Africa, and you must accept it before you can use the Service. If you do not consent, you cannot use the Service, because this processing is what the Service is.
Content you submit may be used by the AI providers that process it to improve (train) their models. In practical terms: what you send in a chat or upload may not stay purely transient — it may be retained and used for model improvement by the provider that handles your request, under that provider's own terms. The providers are listed in section 4.
Because of this, do not submit sensitive personal information (such as ID numbers, financial account details, health information, or other people's personal data) in your chats or uploaded files. Treat anything you submit as data that leaves your control.
We take reasonable, appropriate technical and organisational measures, including:
No system is perfectly secure. If a data breach occurs that affects you, we will notify you and the Information Regulator as POPIA requires.
You have the right to:
To exercise any of these rights, email [email protected]. We will respond within a reasonable time and at most within the periods POPIA prescribes.
If you are not satisfied with our response, you have the right to complain to the Information Regulator (South Africa):
Omnaly is an 18+ service. We do not knowingly collect personal information from anyone under 18. If we learn that we hold information about a person under 18, we will delete the account and its data. If you believe a minor is using the Service, contact us at [email protected].
We keep tracking to a minimum:
We may update this policy from time to time — for example when we add or change AI providers. If we make material changes, we will notify you by email or in-app notice before they take effect, and update the effective date at the top. The current version will always be available at https://omnaly.app/privacy.
Questions? Email [email protected].