Privacy Policy

1. Introduction

OMTME (https://omtme.com/) ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI-powered workflow automation platform.

2. Information We Collect

Account Information

When you create an account, we collect your email address, name, and profile picture (if provided through OAuth). This information is necessary to provide and manage your account.

Usage Data

We collect information about how you use the Service, including workflow creation and execution data, feature usage, plan utilization metrics, and interaction patterns. This helps us improve the Service and enforce plan limits.

Content Data

We process content you create or upload through the Service, including workflow configurations, generated text, images, audio files, thumbnails, and PDF documents. This data is necessary to provide the Service.

Payment & Billing Data

When you subscribe to a paid plan, payment is processed securely by Stripe. We do not store your complete credit card details. We store your Stripe customer ID, subscription ID, billing cycle, plan information, and payment event history (including invoice status, amounts, and failure counts) to manage your subscription and provide invoice history.

Third-Party Account Data

If you connect social media accounts (e.g., YouTube, TikTok), we collect and store authentication tokens and basic profile information from those platforms. These tokens are securely encrypted at rest.

Scheduling Data

If you create scheduled workflows, we store your schedule configurations (timing, frequency, time zone) and execution logs to run workflows on your behalf.

3. How We Use Your Information

• To provide, maintain, and improve the Service
• To process your workflows and generate AI content using multiple providers
• To manage your account, subscriptions, and billing
• To process payments, generate invoices, and handle failed payment recovery
• To connect and interact with your social media accounts
• To execute scheduled workflows on your behalf
• To provide analytics and insights about your content performance
• To enforce subscription plan limits and usage quotas
• To send important service notifications (payment failures, grace period warnings)
• To detect and prevent fraud, abuse, or security incidents
• To reconcile subscription status and maintain billing accuracy
• To comply with legal obligations

4. Data Storage & Security

Your data is stored securely using Supabase (PostgreSQL with Row Level Security) and Vercel infrastructure. We implement industry-standard security measures including:

• AES-256-GCM encryption for sensitive data (API keys, authentication tokens)
• Row Level Security (RLS) policies ensuring users can only access their own data
• TLS encryption for all data in transit
• Secure HTTP-only cookies and session management for authentication
• Server-side validation for all API requests
• Rate limiting via Redis to prevent abuse
• Webhook signature verification for payment events
• CRON secret protection for automated background jobs

5. Third-Party Services

We use trusted third-party providers to operate our platform:

• Supabase — database, authentication, and cloud data storage
• Stripe — secure payment processing, invoicing, and subscription management (we do not store your complete card details)
• AI Providers — Google Gemini, Anthropic Claude, OpenAI, DeepSeek, Grok, Qwen, and OpenRouter for content generation (only necessary workflow data is sent)
• Vercel — cloud hosting, serverless functions, and scheduled job execution
• Upstash — Redis-based rate limiting and abuse prevention
• Social Platforms — YouTube, TikTok for content publishing and analytics (only with your explicit consent)

Each third-party service operates under its own privacy policy and strict security standards. We only share the minimum data necessary to provide each service.

6. API Keys

If you provide your own API keys for external services, they are strongly encrypted before storage. Keys are only decrypted securely when needed for requests and are never exposed to the client interface.

7. Cookies

We use essential cookies for authentication and session management to keep your account secure. We do not use third-party tracking cookies or advertising cookies.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Specific retention periods:

• Uploaded files (audio, images, thumbnails) in temporary storage are automatically cleaned up after 24 hours
• Payment event records are retained for accounting and legal compliance purposes
• Workflow execution logs are retained while your account is active
• Stripe retains its own copy of payment and invoice data per its data retention policy

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict the processing of your data
• Request a portable copy of your data
• Withdraw consent for optional data processing

To exercise any of these rights, please contact us at the email below.

10. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Automated Processing

We use automated systems to process your data in certain cases: scheduled workflow execution runs on your behalf at configured times; subscription reconciliation periodically verifies billing status with Stripe; and failed payment grace period enforcement may automatically adjust your plan if payment issues are not resolved. You can manage your schedules and billing preferences at any time through the dashboard.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service or sending an email. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].