Privacy Policy

OmniBrand is a social media management service operated by ALANHAR ALKHAMSA COMPANY LTD (شركة الأنهار الخمسة المحدودة), Riyadh, Saudi Arabia. This policy explains what we collect when you use www.omnibrand.app and the OmniBrand API, why we collect it, and how you can control it.

What we collect

• Account data: your name, e-mail address, password hash, workspace and role, and the date and version of the Terms and Privacy Policy you agreed to.
• Connected accounts: when you connect a social or messaging account (Facebook Page, Instagram, WhatsApp Business, LinkedIn, X, and others) we store the access tokens the platform issues, the account id and display name, and the audience numbers the platform reports. Tokens are encrypted at rest.
• Content you create: drafts, media you upload, scheduled and published posts, approvals and comments inside the workspace.
• Inbox data: messages, comments and mentions that platforms deliver to us for your connected accounts, including the sender's platform id and name and any attachments, so your team can reply.
• Billing and payments: your company's billing details (name, address, VAT and commercial registration numbers), the plan you pay for and your invoices. Card details are entered on Moyasar's payment form and go straight to Moyasar; we receive a token for a saved card and the last digits, never the card number.
• Phone number: if you add a phone number to your account, we store it and whether you verified it. The code is sent to you by WhatsApp from OmniBrand's own number.
• Your customers' data: the contacts, leads, conversations, bookings, orders and support tickets in your workspace, and what visitors type into your website chat. You control this data; we process it on your behalf, only to run the features you use (see the PDPL section below).
• Bot check: the sign-up, log-in and password-reset pages run Cloudflare Turnstile, which receives your IP address and browser details to tell people from automated sign-ups. It sets no advertising cookie.
• Status updates: if you ask to be told when we have an incident, we store the e-mail address you entered and the language you asked for. You confirm the address before anything else is sent, and unsubscribing deletes it. You do not need an account for this and we use it for nothing else.
• Usage data: server logs (IP address, browser, timestamps) kept for security and debugging for up to 90 days.
• Signed-in devices: for each sign-in we keep the browser and system, the IP address and a rough place (city and country, looked up from that address on our own servers against a bundled database - DB-IP; nothing is sent anywhere), so you can see under Your account where you are signed in and log out a device you do not recognise. This is deleted one day after the session ends (at most 15 days after the sign-in), or 30 days after you log out of it.
• Website visits: we measure visits to www.omnibrand.app ourselves, without cookies, without any identifier stored in your browser and without a third-party analytics account. For each day we record the pages opened, the site that referred you, your device type and language, and your country only - looked up from your IP address on our own servers against a bundled database (DB-IP); the address is never sent anywhere or stored. We also measure engaged time (how long a page was on screen while you were active on it), scroll depth (a quarter, half, three quarters or all of the page) and the pages a visit started and ended on. All of this is tied to a one-way hash of your IP address, browser and the date, combined with a secret key kept on our servers. Because the date is part of it, the hash is different every day, and because the address is not kept, today's visit cannot be linked to tomorrow's or traced back to your address. If you arrived through an ad (Google or Meta) or a campaign link, its identifiers are recorded the same way, and once, on your account, if you sign up - together with the page you landed on, the site that referred you, the country of the sign-up request and the device type - so we know which ad or link brought in a customer. If you came from a Google ad and then sign up, connect your first channel or pay, we tell Google Ads so we can measure our ad results. We send the ad's click ID, the time, for a payment its amount, and a hashed (SHA-256) copy of the email address you signed up with (or of your confirmed mobile number, if you signed up with one). Hashing is one-way: the address itself is not sent, and Google Ads uses the hashed copy only to match the click to the result. In Europe (the EU and EEA), the UK and Switzerland this happens only if you chose "Allow measurement"; elsewhere it also happens if you made no choice. If you chose Essential only, nothing is sent. Where you have granted marketing consent (see the cookie banner) Google Analytics also measures the site; that is separate from this first-party measurement and covered by Google's own privacy terms. Until you choose "Allow measurement", no Google Analytics or Google Ads code is loaded and your browser sends no measurement to Google.
• Speed of the site and the app: we measure how fast pages load and respond (Core Web Vitals) and how long signing in and opening the Inbox or Create take, without cookies, identifiers or the full address: only the page pattern (such as /app/inbox), the time, the device type and the connection type are sent; the country is looked up from your IP address on our servers and the address is not kept. We keep daily totals only, for 90 days.
• Microsoft Clarity (when enabled): we may use Microsoft Clarity to understand how the public pages are used, through heatmaps and recordings of mouse movement, clicks and scrolling. It loads only if you accept marketing cookies, masks what you type into form fields, and never runs inside the app itself. Microsoft processes this data under its privacy statement; you can withdraw consent at any time from the cookie banner.
• The website assistant: Maroja, the chat bubble on the public site, sends your questions to our AI provider to answer from the help manual and public pages; it never sees your account or workspace data. Conversations are not stored - only an anonymous count of how many people chatted - unless you use "Talk to sales" to leave your name and contact details, which we keep as a sales lead the same way as any other contact form on this site.
• Help videos: a help-centre article that has a video tutorial shows its thumbnail picture, loaded from YouTube's image server (i.ytimg.com, run by Google), even if you chose "Essential only" in the cookie banner. Loading it sends Google your IP address and browser details, as any web image does; it sets no cookie. The YouTube player (youtube-nocookie.com) loads only when you press play. Google handles this under its privacy policy.

How we use it

• To publish, schedule and analyse content on the channels you connected.
• To show your team incoming messages and let them reply from one inbox.
• To generate text, images, video and suggestions with AI models, as described under "AI providers" below; we do not use your content to train models.
• To operate, secure and improve the service, and to contact you about your account.

AI providers

When you use an AI feature, what you ask for and the content that request needs (the text, pictures, drafts or message you choose) are sent to the AI provider that does the work, which returns the result to us. These providers may process that content outside the Kingdom of Saudi Arabia. They may keep it for a limited time under their own terms, for example to detect abuse. We do not use your content to train models.

Some AI features run without a person asking each time. When automatic AI features are on, incoming messages, comments, reviews and questions are sent to AI providers as they arrive, to sort them or, where a bot is set to answer with AI, to answer them. Scheduled work sends what it needs in the same way: the figures and post captions of a scheduled report with an AI summary, and what a scheduled Market Watch scan and its automatic drafts work from. YouTube and Google Business Profile data is the exception: it is not sent to AI providers automatically, including in scheduled reports. Messages you send to our support team may also be sorted by AI.

If your workspace connects its own key from a provider, what is sent through that key goes to that provider under your agreement with it.

Platform data

Data received from Meta (Facebook, Instagram, WhatsApp, Messenger), LinkedIn, X, Google, TikTok and the other platforms is used only to provide the features you asked for, in line with each platform's terms, including the Meta Platform Terms and Developer Policies. We never sell platform data and never share it with third parties except the sub-processors below.

Google user data (Google Business Profile and YouTube)

When you connect a Google Business Profile or a YouTube channel, you sign in with Google and grant OmniBrand the permissions shown on Google's consent screen:

• Google Business Profile (business.manage): we read the locations your Google account manages, publish and delete the posts you create in OmniBrand, and read reviews and questions so your team can answer them from the inbox.
• YouTube (youtube.upload, youtube.readonly, youtube.force-ssl): we upload and schedule the videos you create in OmniBrand, delete a video you published through OmniBrand when you ask, read your channel's name and statistics for your reports, and read and reply to comments on your videos from the inbox.

We store the access tokens Google issues, encrypted, and keep the data above only as long as needed to provide these features. We do not use Google user data for advertising, do not sell it, and do not use it to train AI models. We share it only with the sub-processors below that run the service. These include an AI provider when a person in your workspace asks for an AI feature, for example an AI reply suggestion or an AI summary of a report, which includes your YouTube figures and video captions. Automatic AI features and scheduled reports do not send YouTube or Google Business Profile data to AI providers. People at OmniBrand read it only with your permission for support, to investigate security or abuse, or where the law requires.

OmniBrand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

OmniBrand uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of your data is described in the Google Privacy Policy.

You can disconnect a Google account at any time on the Accounts page in OmniBrand, which deletes its tokens immediately, or revoke OmniBrand's access in your Google Account at myaccount.google.com/permissions (also reachable from the Google security settings page).

Sub-processors

• Hosting: Microsoft Azure (West Europe) - hosting, database and media storage.
• AI models: the providers behind the AI features included with OmniBrand and, where a workspace connects its own key, the provider of that key - text, image and video generation.
• E-mail: Microsoft (Azure Communication Services, Europe) - delivery of account and notification e-mails.
• Messaging: Meta (WhatsApp) - delivery of verification codes to your phone number.
• Payments: Moyasar (Saudi Arabia) - card payments: the card holder's name, the card and the amount, entered on Moyasar's own form.
• Network and bot check: Cloudflare - DNS, the Turnstile bot check on sign-up and log-in, and the delivery of e-mail sent to your workspace's forwarding address.
• Site analytics: Microsoft (Clarity) - heatmaps and recordings of the public site, only when enabled and only with your consent.
• Measurement and ads: Google (Analytics and Ads), Meta, LinkedIn and TikTok - measurement of the public site and of ads, only after you choose "Allow measurement" in the cookie banner. Google Ads also receives the click ID, time, (for a payment) amount and a hashed (SHA-256) copy of the sign-up email (for an account created with a mobile number, a hashed copy of that confirmed number instead) when a Google ad led to a sign-up, a first connected channel or a payment, as described under "Website visits" above.

Retention and deletion

Workspace data is kept while your account is active. Disconnecting a channel deletes its tokens immediately and removes its inbox data within 30 days. Deleting your account or workspace removes all associated data within 30 days, except records we must keep for legal or accounting reasons. Deleted data leaves our backups within 35 days. A Free account that has never paid, has never published or scheduled a post, and has not been signed in to for 30 days is removed automatically: after 16 days without a sign-in the owner gets an e-mail giving the last day to sign in, at least 14 days ahead, and a reminder at least 3 days before that day ends; it is never removed before the end of that day, in any time zone, and signing in, or publishing or scheduling a post, keeps the account. An account that has ever paid is never removed for inactivity (see the Terms of Service). A status-update address is deleted the moment you unsubscribe, using the link in any message we send you. See Data deletion for the steps.

Saudi Personal Data Protection Law (PDPL)

ALANHAR ALKHAMSA COMPANY LTD is the controller of the personal data of people who register for OmniBrand, and the processor of the personal data our customers bring into their workspaces (their audiences, contacts and inbox conversations). We apply the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA).

• Legal basis. We process account data to perform the contract with you; platform and inbox data on your instructions as our customer; usage and security logs on our legitimate interest in keeping the service safe; marketing only with your consent, which you can withdraw at any time.
• Data minimisation. We collect only what the features you use require, and we never sell personal data.
• Cross-border transfer. The service is hosted on Microsoft Azure in the West Europe region, so personal data is transferred outside the Kingdom. The transfer is covered by Microsoft's Data Protection Addendum and standard contractual safeguards, is limited to what providing the service requires, and is assessed under SDAIA's transfer regulation and risk-assessment guideline. Content sent to AI providers may also be processed outside the Kingdom (see "AI providers"). We plan to move hosting to Microsoft's Saudi Arabia East region once it is generally available, and will update this policy when we do.
• Your rights. You have the right to be informed, to access your data, to obtain a copy, to correct it, to have it destroyed when it is no longer needed, and to withdraw consent. Requests go to privacy@omnibrand.app and are answered within 30 days, free of charge.
• Breach notification. If a breach affects your data we notify SDAIA within 72 hours of learning of it, and you without undue delay where the breach may harm you.
• Data protection contact. privacy@omnibrand.app, ALANHAR ALKHAMSA COMPANY LTD, Riyadh. You may also complain to SDAIA's Personal Data Protection office.

Europe and the UK (GDPR)

Where the GDPR or the UK GDPR applies to you, ALANHAR ALKHAMSA COMPANY LTD is the controller and the processor as set out above.

• Legal bases. Performing our contract with you (account data and running the features); legitimate interests (security, debugging and improving the service); consent (marketing cookies and measurement where consent is asked for); and legal obligation (tax and accounting records).
• Your rights. Access, rectification, erasure, restriction, portability, objecting to processing based on legitimate interests, and withdrawing consent at any time. Requests go to privacy@omnibrand.app and are answered within one month. You may complain to the data protection authority in your country.
• International transfers. Where data leaves the EEA or the UK, we rely on contractual safeguards where the law requires them.

Your rights

You can access, correct, export or delete your data from the app or by e-mailing privacy@omnibrand.app. Residents of the EU/EEA, UK and Saudi Arabia (PDPL) may also lodge a complaint with their supervisory authority.

Children

OmniBrand is for people aged 18 or the age of majority where they live, whichever is higher. We do not knowingly collect children's data to create accounts for them. If you learn that a child has created an account, write to privacy@omnibrand.app and we will delete it.

Security

All traffic is encrypted in transit (TLS). Platform tokens are encrypted at rest, access is role-based and tenant-isolated at the database level, and administrative access is logged. To help with a request you made, OmniBrand support may open a read-only view of your account for at most one hour: nothing can be changed from it, a banner shows while it is open, and every view is recorded with its reason and listed for the account owner under Settings > Company details > Support access.

Changes to this policy

We may change this policy. We then update the date at the top of this page and tell account holders about significant changes in the app or by e-mail.

Contact

ALANHAR ALKHAMSA COMPANY LTD, Riyadh, Kingdom of Saudi Arabia · privacy@omnibrand.app