Version 1.7 — e update and take effect from 28 October 2026.
1. Controller and contacts
Di controller na Francesco Paparo, operator of di Omnipal project, for Via Giovanni della Rocca 279, 80041 Boscoreale (Naples), Italy. Omnipal na di project name, and na private individual dey run am.
For personal data and rights requests: privacy@omnipal.app. For support: support@omnipal.app. Website: omnipal.app. Di controller dey handle dis contacts directly; dem never appoint data protection officer.
Dis policy cover di website, extension, desktop/mobile clients and services wey connect to dem. Di Legal notice, Terms of Service and Cookie Policy give related information.
2. Data we process
- Account and sign-in: email, name if you provide am, language, account identifiers and, if you choose Google, profile identifier and basic information wey Google return. Google sign-in alone no authorize us to read Gmail.
- Verification and security: hashes of email codes and tokens, attempts, expiry, sessions, linked devices and last use. Omnipal password dey optional: if you set one, na only fingerprint wey scrypt derive with one random value wey belong only to your account we dey store; we no dey store or log de password itself and we no fit recover am. We dey record how each session start (code, Google, password or extension), and we keep count of wrong attempts wey connect to de address for memory for at most one hour. We go email you anytime you set, change or remove your password.
- Selected content: text, context, documents and media wey features use; cloud documents, synced chat history and publications only when you request those operations.
- Support: messages and information sent to de contact addresses.
- Technical data: operation and security logs. Di proxy fit log IP addresses, paths and times; application logs dey limit details, and normally no record chat bodies, API keys or tokens.
- Administration and recovery: admin identifier, type of action, reference to de feature, account or job wey e affect, result and time. Dese records no carry backup content, decryption keys or Google credentials.
- Optional measurement: combined counters and preset error categories wey separate choices dey enable. Dis tools no collect free text from emails, chats or documents.
After separate diagnostic consent, di client dey send categories wey dem don set beforehand go Omnipal API; na only di API dey forward dem go Sentry, inside di EU project omnipal-diagnostics. Di event get error category, product surface, time and event identifier; e no carry user content, identity, email or browser IP address. Sentry dey see di server IP address through di connection and add technical metadata, including approximate location wey dem derive from di server IP, no be di visitor own. Dem disable storage of IP addresses inside events. Di website no load Sentry SDK or session replay.
We no sell your data or use content to train Omnipal models. How your chosen AI provider process data depend on that service terms.
3. How content dey move and API keys
BYOK and local features
With BYOK, you dey use your own credentials: di browser or app dey send necessary content directly to di provider wey you choose, without using Omnipal AI gateway. Local endpoint dey follow your configuration; we no guarantee say every feature go work offline.
Di extension fit read content for enabled sites according to di permissions and features wey you use. Text, documents, images, recordings and selected context fit reach AI, search, translation, transcription or voice providers. To index Memo with remote provider also dey send selected fragments. Browser voice features fit depend on remote services from di browser or operating system.
Web chat dey keep API key and text wey you never send only for page memory: if you reload or close de page, dem go lost, and if you change provider, de key go clear. Conversations (messages, attached file text and images, title, date, provider and model) dey save for your browser local database (IndexedDB) to show your history: dem dey stay for your device and never reach Omnipal servers. You fit skip saving one chat, delete one or all, or clear site data for your browser.
PDF OCR fit run completely inside your browser, with language data wey come with de extension: for dat case, pages no dey go to your provider or any third party.
Previews of HTML, SVG, diagrams and charts for responses dey show only for your browser, inside isolated frame wey no fit access de extension or site and wey block network requests; preview scripts go run only if you choose “Run scripts”. No content dey go to Omnipal or third parties to generate de preview.
Site recipes wey you create or import dey stay for dis browser and no dey sync. When you choose recipe or video action, de extension go read only de text wey e specify for de open page (for YouTube, de transcript, and e go open im panel when you request am) and send am to de AI provider wey you choose; your name, memories and personal rules no dey go.
If template updates dey on (you fit turn dem off for Library), de extension go download de public catalogue from omnipal.app at most once per day. De request no carry account, cookies or text; de server go receive IP address and de technical data wey every web request dey carry.
Memo local semantic index and local background removal dey use models wey run inside your browser. Model go download only when you ask for am from im card, wey show im name, licence, size and source. De request go to Hugging Face (huggingface.co and im CDN), wey go receive your IP address, technical request data and file name, never any text, image or account data. De file go remain for browser local storage until you delete am; processing dey happen for your device, and texts and images no dey go to Omnipal, de AI provider or third parties.
Di extension fit keep keys and content for local browser storage, without extra application-level encryption for keys. Automatic sync no include API keys. JSON export fit include dem only if you select di option, wey dey off by default.
Sync and sharing
Cloud sync dey optional and separate from having account: you fit use am by hand or turn on automatic sync for each kind of item, and e go stay off until you do am. E dey store items wey you choose, like settings, profile context, prompts, bots, glossary and Memo metadata; for automatic mode, de extension go upload dem after changes and download dem when e start and from time to time. E no include API keys, consents or full Memo text. No put secrets inside synced text fields.
Chat history sync na another choice, and e dey off by default. If you turn am on, Omnipal go store de text of your conversations for im server, linked to your account: messages, answers, titles, attached text and de model wey you use. Images go stay for your browser. Chats wey contain API keys wey their format make us recognize dem no dey accepted; key wey no get format wey we recognize and wey you paste into message no fit detect, so no paste keys inside chats. Na only to show history across your devices e dey used. Limits: 512 KB for each chat and 8 MB for each account.
To publish chat or bot need separate confirmation: we dey store di content for di server, and anybody wey get di link fit access am. To list bot for di catalogue na another choice. Revocation dey block later access through di Service, but e no delete copies wey other people don already get.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| To create and manage accounts, sign-in, licence and features wey user request, including sync or sharing wey user select | To carry out contract or take steps before contract, GDPR Article 6(1)(b). |
| Answering requests about the Service | To carry out contract or take steps before contract; for other enquiries, legitimate interests for managing correspondence. |
| To prevent abuse, protect accounts, find operational faults and defend rights | Legitimate interests for Service security and continuity, Article 6(1)(f), with only data wey necessary and right to object where e apply. |
| Optional statistics and diagnostics | Separate, withdrawable consents, Article 6(1)(a). |
| To handle requests about rights or obligations wey apply | Legal obligation, Article 6(1)(c). |
You need sign-in data for those features; without am, you no fit create or use account. If you reject optional measurement, you still fit use di Service. Promotional marketing no dey active.
Users need proper legal basis and authorisations for other people data. For professional processing wey require Omnipal to act as processor, dem must first agree instructions and agreement under GDPR Article 28: subscription alone no replace that agreement.
5. Providers, recipients and transfers
Di controller and providers wey di features you actually use need fit access di data:
| Provider or recipient | Service and relevant data |
|---|---|
| Contabo GmbH, Germany | VPS infrastructure, database and encrypted Service backups. Where di provider dey registered no guarantee say every external service dey localised inside di EU. |
| Resend / Plus Five Five, Inc. | Sign-in emails: recipient, message content and delivery data. |
| Cloudflare | DNS and Email Routing for di domain and public contact addresses. Di current website no dey use Cloudflare analytics. |
| Mail service for correspondence wey dem forward; Google Sign-In only after you choose that method, and profile data if you complete am. When dem enable am, di external encrypted backup copy on Drive wey dem describe below. | |
| Sentry | Na only di API dey forward optional diagnostics go di EU project omnipal-diagnostics; section 2 explain di data and technical metadata. |
| AI, search, translation, voice or media providers wey you use | Material wey di selected feature need, under di relevant account and provider terms. |
| Hugging Face, Inc. (USA) | Downloads of local models wey you request: IP address, technical request data and file name; no text, image or account data. |
| Public link recipients | Content you choose to publish. |
| Authorities and authorised advisers where dem necessary | Data wey obligations or defence of rights need. |
For Service security and recovery, when di external copy dey enabled, we dey encrypt database backups with age before we transfer dem to dedicated private folder inside di controller Google Drive. We dey hold di decryption key separately and we no upload am to Drive. Google dey receive di encrypted files and technical metadata, like file names, sizes and timestamps, and e fit see di IP address of di server wey do di transfer. Encryption dey protect content, but e no make di data anonymous.
Dis copy dey use authorisation granted by controller for backup administration, with only drive.file scope and bound backup folder. Connection separate from Google Sign-In and no need for Drive authorisations from service users; it no access their personal Drives.
Di role depend on di service: technical providers fit process data on another person behalf; Google for im own purposes, and other people wey receive data, fit act as independent controllers. BYOK provider no automatically get one role for all im products.
Some processing dey happen outside di European Economic Area, including for di United States. Resend talk say data wey e store dey for di US: to choose European sending region no change where data dey reside. Im DPA include EU Standard Contractual Clauses for transfers. Cloudflare describe roles and safeguards for im DPA; Google for im Privacy Policy.
You fit ask for di list of providers, infrastructure location and information about agreements and safeguards for each data route at privacy@omnipal.app. We no promise storage only inside di EU; you must also assess processing by di provider wey you select under dat provider contract.
6. Retention and deletion
These rules dey distinguish how long credentials valid, how long records stay and periodic cleanup:
| Date | Rule |
|---|---|
| Account and cloud documents | While account still dey open or dem still dey request content. Once closure complete, e delete linked operational data; you fit also ask for deletion by email. |
| Chat history wey dey sync | Until you delete am: by deleting chat, turning off sync and deleting server copy, or closing your account. Backups go keep am until dem expire. |
| Local models | For browser local storage until you delete dem from their card or de browser free space. |
| Web BYOK key and chat | Key and text wey you never send: page memory. Web chat history: for de browser until you delete am or clear site data; closing account no dey remove am from de device. |
| Local extension archives and files wey you export | Until di user or browser remove dem. If you close account, e no delete dem from di device. |
| Email and extension handoff codes | Validity get limit; hourly cleanup dey remove records once 24 hours don pass after dem expire. Email codes fit work for 10 minutes. |
| Password fingerprint | As long as you keep de password or account; e go comot from backups when dem expire. Attempt counters go stay for memory for at most one hour. |
| Web and refresh sessions | E valid for up to 60 days. Hourly cleanup dey remove expired records after 24 hours, and normally remove revoked records after 30 days. Records of refresh tokens wey dem replace dey remain until their original expiry, at most 60 days from when dem issue dem, to detect reuse and revoke di device; periodic cleanup go remove dem. Extension access tokens dey last 15 minutes. |
| Devices | E dey linked while active; hourly cleanup dey remove revoked records after 30 days. |
| Measurement choice | E valid for 180 days. Local record wey don expire fit remain until dem replace or remove am, but e no enable any further submissions. |
| Aggregate statistics | 400-day threshold; hourly cleanup and new submissions dey remove older data. No visitor or session identifiers dey included. |
| Sentry diagnostic events | 90 days during di current free Business trial; 30 days for di free Developer plan after trial if no upgrade happen. |
| Publications | Person fit access am for 1–30 days or until you revoke am; hourly cleanup dey remove di content after 24 hours from when e expire or you revoke am. |
| Invitations and temporary linked-service codes | Until expiry and di next hourly cleanup; persistent links remain until revocation or closure happen. |
| Operational logs | Rotation according to size: up to five 10 MB files for each container, and dem dey remove when dem replace di container too. Request bodies no join; proxy logs fit contain IP addresses and paths. |
| Ordinary support | Up to 12 months after di request close; person go review and delete correspondence wey dem no need again. |
| Rights requests, disputes and obligations | Minimum data to document how dem handle matter or defend rights, up to five years after closure unless another obligation or ongoing proceedings apply. |
| Service backups | Dem encrypt am, with 30-day threshold and removal for di next daily cycle; rotation fit remove am before then. Dem no use am for normal purposes. |
| Data held by external providers | As di relevant service and contract provide. For example, Resend say normal email and log retention na 30 days for standard plans. |
De platform administration log get 180-day threshold, with cleanup every hour. Backup jobs and de backup service technical log get 30-day threshold, with cleanup every minute and when e restart. Dem dey record identifiers and categories, without content or keys. Restore verification dey create temporary plaintext database for server, wey only authorised services fit access, for up to 30 minutes; after restore, de previous database go remain for recovery for 24 hours. Dem dey clean up dese databases every minute. De key wey you supply for verification and de temporary dump dey stay for de service temporary memory and dem go remove when de job finish. Neither dis plaintext data nor de key dey go to Drive.
No custom Sentry retention dey set: how long events stay dey follow di plan, and issue aggregates fit stay longer than individual events.
When di external copy for Google Drive dey enabled, di same 30-day retention limit apply to those copies too. For di next daily cycle, after dem verify di backup copy, na only expired copies and their related checksums inside di dedicated folder dem go remove permanently, without moving dem to trash. Dis operation no dey empty di general Google Drive trash.
Cleanup need service wey dey work, and e go continue when service restart after downtime. Expiry no dey delete every copy at de same time. Online restore dey keep de current account, revocation and entitlement records, and e no include accounts and cloud documents wey dem don delete already; e also dey invalidate sessions and temporary links before normal use start again. Manual disaster recovery need make dem apply deletion requests and revocations again before data return to use.
Account export concern platform data; e no automatically cover local archives. Contact us if automatic closure fail: error no confirm say deletion don happen, and e no limit rights wey you exercise by email. Data wey obligation or dispute need dey separate from normal use, and dem fit use am only for that purpose.
7. Rights and security
Where GDPR provide for am, you fit request access, correction, erasure, restriction and portability, and object to processing wey rely on legitimate interests. You fit withdraw consent without affecting whether earlier processing dey lawful.
Email privacy@omnipal.app. We fit request identity checks wey proportionate. We dey respond within one month; where di law allow am, we fit extend am by two more months and notify you within di first month. You fit complain to di Italian data protection authority or di authority wey get jurisdiction.
We dey use HTTPS, access controls and hashes of codes/tokens. Hashes no be encryption wey person fit reverse; security also depend on protecting your device, credentials and exported files. We no guarantee say any system fit remove every risk.
8. Age, future features and updates
Di Service na for people wey don reach 18 years or more. AI features dey help di user; dem no be for automated decisions wey get legal or similarly serious effects on people.
For di current version, purchases, included-AI gateway and server channels no dey active. Code or configured webhook no activate dem. Sentry diagnostics dey available only with di separate consent wey we describe above. Before we introduce new data routes, we go update dis policy and get any consent wey necessary.
We go highlight major updates on di website or through relevant messages. Di Italian version dey for Informativa sulla privacy. Reference: Regulation (EU) 2016/679.