OmniBrand is a social media management service operated by Five Rivers Limited Co. (Riyadh, Saudi Arabia). This policy explains what we collect when you use www.omnibrand.app and the OmniBrand API, why we collect it, and how you can control it.

What we collect

• Account data: your name, e-mail address, password hash, workspace and role.
• Connected channels: when you connect a social or messaging account (Facebook Page, Instagram, WhatsApp Business, LinkedIn, X, and others) we store the access tokens the platform issues, the account id and display name, and the audience numbers the platform reports. Tokens are encrypted at rest.
• Content you create: drafts, media you upload, scheduled and published posts, approvals and comments inside the workspace.
• Inbox data: messages, comments and mentions that platforms deliver to us for your connected accounts, including the sender's platform id and name and any attachments, so your team can reply.
• Usage data: server logs (IP address, browser, timestamps) kept for security and debugging for up to 90 days.

How we use it

• To publish, schedule and analyse content on the channels you connected.
• To show your team incoming messages and let them reply from one inbox.
• To generate drafts, captions and suggestions with AI models. Prompts and the content you approve may be sent to the AI providers configured for your workspace; we do not use your content to train models.
• To operate, secure and improve the service, and to contact you about your account.

Platform data

Data received from Meta (Facebook, Instagram, WhatsApp, Messenger), LinkedIn, X, Google, TikTok and the other platforms is used only to provide the features you asked for, in line with each platform's terms, including the Meta Platform Terms and Developer Policies. We never sell platform data and never share it with third parties except the sub-processors below.

Sub-processors

• Microsoft Azure (West Europe) - hosting, database and media storage.
• AI providers selected by your workspace administrator (for example OpenAI, Anthropic, xAI, Google) - text and image generation.
• E-mail delivery provider - account and notification e-mails.

Retention and deletion

Workspace data is kept while your account is active. Disconnecting a channel deletes its tokens immediately and removes its inbox data within 30 days. Deleting your account or workspace removes all associated data within 30 days, except records we must keep for legal or accounting reasons. See Data deletion for the steps.

Saudi Personal Data Protection Law (PDPL)

Five Rivers Limited Liability Company is the controller of the personal data of people who register for OmniBrand, and the processor of the personal data our customers bring into their workspaces (their audiences, contacts and inbox conversations). We apply the Personal Data Protection Law of the Kingdom of Saudi Arabia (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations, under the supervision of the Saudi Data & AI Authority (SDAIA).

• Legal basis. We process account data to perform the contract with you; platform and inbox data on your instructions as our customer; usage and security logs on our legitimate interest in keeping the service safe; marketing only with your consent, which you can withdraw at any time.
• Data minimisation. We collect only what the features you use require, and we never sell personal data.
• Cross-border transfer. The service is hosted on Microsoft Azure in the West Europe region, so personal data is transferred outside the Kingdom. The transfer is covered by Microsoft's Data Protection Addendum and standard contractual safeguards, is limited to what providing the service requires, and is assessed under SDAIA's transfer regulation and risk-assessment guideline. We plan to move hosting to Microsoft's Saudi Arabia East region once it is generally available, and will update this policy when we do.
• Your rights. You have the right to be informed, to access your data, to obtain a copy, to correct it, to have it destroyed when it is no longer needed, and to withdraw consent. Requests go to privacy@omnibrand.app and are answered within 30 days, free of charge.
• Breach notification. If a breach affects your data we notify SDAIA within 72 hours of learning of it, and you without undue delay where the breach may harm you.
• Data protection contact. privacy@omnibrand.app, Five Rivers Limited Liability Company, Riyadh. You may also complain to SDAIA's Personal Data Protection office.

Your rights

You can access, correct, export or delete your data from the app or by e-mailing privacy@omnibrand.app. Residents of the EU/EEA, UK and Saudi Arabia (PDPL) may also lodge a complaint with their supervisory authority.

Security

All traffic is encrypted in transit (TLS). Platform tokens are encrypted at rest, access is role-based and tenant-isolated at the database level, and administrative access is logged.

Contact

Five Rivers Limited Co., Riyadh, Kingdom of Saudi Arabia · privacy@omnibrand.app