OMVY Privacy Policy

1. Who we are and when this policy applies

OMVY LLC ("OMVY", "we", "us") provides AI products and services. This policy describes personal data handled through omvy.ai, our services and our business relationships. It is not an employee or recruitment privacy notice.

European Union representative

For matters concerning our obligations under the GDPR, you may also contact our representative in the European Union under Article 27:

OMVY acts as a controller where it determines why and how personal data is used, including for its own customer relationships, account administration, billing and service security. Where a business customer determines the purposes of processing its service content and OMVY acts on that customer's instructions, OMVY acts as a processor. That customer's privacy notice explains its use of the information.

omvy.ai currently provides information about OMVY and its work; it is not a signed-in product service. Product-related descriptions in this policy apply when you use the relevant service. Before a product collects your information, its specific notice will explain the data sources, features, sharing settings and retention arrangements that apply. A description of a category here does not mean that every service collects it.

2. Information we process and where it comes from

• Customer and relationship information: names, email addresses, organizations, contact details, billing details and correspondence received when you contact us or use a service.
• Service content: information users choose to submit to our AI services, and information stored or retrieved to perform the requested service.
• Technical and usage information: information needed to deliver, operate and protect our website and services, such as IP addresses, requested pages, timestamps, browser information and relevant service activity.

We receive information directly from you and, depending on the service, from a business customer, an authorized workspace participant or a source connected to the service at a user's or customer's direction. Shared content may include information about people who do not hold an OMVY account.

If you provide information about another person, you must have the authority and lawful basis required to do so. This does not remove OMVY's own transparency or other obligations. Where we act as a processor, we assist the customer responsible for responding to requests about its content.

3. Why we process information and our legal bases

Where the GDPR applies and OMVY acts as controller, the legal basis depends on the specific purpose. Processing on a business customer's behalf follows that customer's instructions and applicable data-processing arrangements; it is not automatically based on a contract between OMVY and every person mentioned in the customer's content.

Where an optional activity requires your consent, we ask for it separately, explain its purpose and provide a way to withdraw it. Merely visiting the website or submitting content does not constitute consent to unrelated uses. We do not rely on consent simply because no other lawful basis has been identified.

Information objectively necessary to deliver a service or enter a contract must be provided for us to perform that request. We explain any mandatory fields and relevant consequences in the applicable service. Optional information is identified as such.

4. AI processing, not model training

OMVY does not use your personal data or user-provided content to train or fine-tune AI models. We process content to provide the services you request. Storing and retrieving information as part of a requested memory feature is distinct from training or fine-tuning a model.

Content may be processed by AI model and data-processing providers acting on OMVY's behalf to deliver the requested service. The applicable product notice explains the processing involved. A no-training commitment does not mean that information is never stored or that necessary security and operational records do not exist.

5. Who receives information

We disclose relevant information to service providers acting on our behalf where needed for the purposes described above:

• Cloud hosting and infrastructure providers to operate, maintain and protect our services.
• AI model and data-processing providers to perform requested AI processing.
• Payment processors to administer billing and payments.
• Communication tools to manage correspondence and support.
• Analytics providers, where used by the applicable service, to understand usage and maintain and improve that service, subject to applicable choices and consent requirements.

Where a service supports sharing, information is made available according to the sharing actions and permissions associated with that service. The relevant product notice explains who can access personal or organizational content.

We may be required to disclose information in response to lawful requests from public authorities, including national-security or law-enforcement requests. Such disclosures remain subject to applicable data-protection requirements.

6. Security and retention

We use reasonable and appropriate safeguards against loss, misuse, unauthorized access, disclosure, alteration and destruction, taking account of the information and the risks involved. We limit processing to information relevant to its stated purpose.

We retain personal data only for as long as needed for the purposes described in this policy, and then delete or anonymize it:

• Website hosting logs: rotated daily and kept for no more than 30 days.
• Network and security processing by our content delivery provider (Cloudflare): handled under the provider's standard service; OMVY does not export or store these request logs.
• Enquiries and correspondence: kept while we handle your enquiry and for up to 24 months after our last exchange, unless an ongoing business relationship or a legal obligation requires longer. We review and delete correspondence at least once a year.
• Contracts and billing records: kept for 7 years from the end of the fiscal year to which they relate, to meet accounting and tax requirements. These records are not deleted on account closure.
• Backups: taken daily and kept on a rolling 30-day basis, after which they are deleted. If we restore from a backup, we re-apply any deletions made in the meantime before the data returns to use.
• Accounts and content stored in our products: kept for the duration of the service and according to the storage or memory features you use. Each product's notice sets out its specific retention periods, which apply in addition to this policy.

7. International processing

OMVY LLC is based in the United States. Personal data processed through our services is hosted on infrastructure located in the European Union, primarily in Frankfurt (Germany) and Ireland. We do not currently host this data in the United States.

Personal data may nevertheless be accessed from the United States by OMVY for operating, supporting and securing the services, and some AI model and data-processing providers acting on our behalf may process requests outside the European Union. We configure available provider controls to disable training on submitted content and, where the provider offers this option, to prevent its retention. No-training and zero-retention settings serve different purposes; not every provider offers zero retention.

For transfers requiring safeguards under EU or UK data-protection law, we use the contractual safeguards applicable to the relevant transfer. These include the European Commission's Standard Contractual Clauses in our agreements with providers and, where applicable, business customers, together with the UK Addendum for relevant UK transfers. The applicable mechanism depends on the parties' roles and the processing concerned.

You can request information about the safeguards applicable to your data, or a copy of them, by contacting privacy@omvy.ai.

8. Your privacy rights

Where the GDPR applies, you have the following rights, subject to the conditions and exceptions established by law:

• Access: request confirmation of processing, access to your personal data and relevant information about its use.
• Rectification: ask for inaccurate information to be corrected or incomplete information to be completed.
• Erasure: request deletion where the legal conditions are met.
• Restriction: request limits on processing in the circumstances provided by law.
• Portability: where applicable, receive data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Objection: object on grounds relating to your situation to processing based on legitimate interests. You may object at any time to processing for direct marketing, including related profiling.
• Withdrawal of consent: withdraw consent where processing relies on it, without affecting the lawfulness of earlier processing.
• Automated decisions: exercise applicable protections concerning decisions based solely on automated processing that produce legal or similarly significant effects, including the relevant rights to human intervention and to contest a decision where provided by law.

Send requests to privacy@omvy.ai. We may ask for information reasonably necessary to verify your identity, without seeking unnecessary personal data. If the information is controlled by one of our business customers, identify that organization so we can coordinate appropriately; this does not remove any obligations OMVY has in its own capacity.

We respond to GDPR rights requests without undue delay and normally within one month of receipt. If a request's complexity or number justifies extending that period by up to two further months, we inform you within the first month and explain why. Requests are normally free of charge, subject to the law's limited exceptions.

You may complain directly to a competent data-protection authority, particularly in the EU Member State of your habitual residence, place of work or the alleged infringement. You do not have to use our complaints process first. See the EU/EEA authority directory; in Italy, the authority is the Garante per la protezione dei dati personali. Where UK data-protection law applies, you can contact the Information Commissioner's Office.

9. This website, cookies and similar technologies

Technical visitor information is processed to deliver and protect omvy.ai. The public website does not itself provide a signed-in product service or collect your AI conversation history. Email links open your email application; if you contact us, we receive the information you include and use it to respond and follow up.

The current website does not include advertising trackers or a marketing analytics script. Necessary hosting and security processing is distinct from optional tracking. Before introducing technology requiring consent, we will provide the appropriate information and obtain the required choice before it is activated.

10. Additional service and regional information

When a service is made available, its specific notice explains how this policy applies to the features you use and identifies additional information required for that service. Applicable laws may provide further rights or protections; nothing in this policy limits rights that cannot lawfully be excluded.

11. Updates and contact

We update this policy when our practices or applicable requirements change. The published notice identifies its effective date and last-updated date. Where required, we provide additional notice of material changes and obtain any necessary consent before making a new use of information.

For questions or privacy requests, contact privacy@omvy.ai or write to OMVY LLC at the address in section 1.