Omneky Privacy Policy

Summary of key points

Omneky Inc. (“Omneky”, “we”, “us”) is an AI advertising platform headquartered in San Francisco, California. This policy explains what personal information we collect through our website, the Omneky platform and API, and our integrations with AI assistants, why we collect it, who receives it, how long we keep it, and the choices you have. The sections below give the full detail.

1. Who we are and what this policy covers

This policy is issued by Omneky Inc., 3357 26th Street, San Francisco, CA 94110, and covers the following (together, the “Services”):

• our website at omneky.com and related marketing pages, event registrations, and communications;
• the Omneky platform, including the AI Growth Agent, creative generation, campaign launch and management, analytics and reporting, and landing pages we generate and host for you;
• the Omneky API; and
• Omneky integrations with third-party AI assistants, currently the Omneky connector for Claude and the Omneky plugin for Grok (the “Connectors”), and the Omneky app for Slack (Section 2.6).

Our roles. For information about our customers’ personnel, prospects, and website visitors (for example, your account, billing, and usage data), Omneky decides how and why the information is used and acts as a “controller” (GDPR) or “business” (CCPA). For content and data our customers place into the platform, such as brand assets, product catalogs, creative inputs, connected ad-account data, and any information about our customers’ own customers or audiences (“Customer Content”), we act on the customer’s instructions as a “processor” or “service provider.” Customer Content is governed by our customer agreement and, where applicable, a Data Processing Addendum (“DPA”). If one of our customers submitted your personal information to Omneky, contact that customer to exercise your rights; we will help them respond.

Business use. The Services are designed for businesses and are not intended for personal, family, or household use. We treat personal information covered by this policy as relating to individuals acting as business representatives, not in their personal capacity.

Not covered. The advertising platforms, AI assistants, and other third-party services you connect to Omneky have their own privacy policies, and links to third-party sites or services are not endorsements. Ads and landing pages created with Omneky are published by the advertiser, who is responsible for them and for its own privacy notices. If you visit a landing page we host for an advertiser, the advertiser decides how your information is used and we process it on the advertiser’s behalf.

Japan. Services in Japan are provided by our Japanese affiliate 合同会社Omneky (Omneky G.K.), Tokyo, under Japanese terms of use. This policy also describes that entity’s handling of personal information under Japan’s Act on the Protection of Personal Information (APPI); see Section 6.

2. Information we collect

We collect information in six ways: you give it to us, you connect accounts to us, we collect it automatically, we receive it from other sources, the Services generate it, and tools you run through our API or Connectors send it to us.

2.1 Information you give us

2.2 Information from accounts you connect

When you connect an advertising account, we use the permissions you grant to read and write data in that account. Platforms currently supported: Meta (Facebook and Instagram), Google Ads (including Performance Max and Demand Gen on YouTube), TikTok, LinkedIn, Reddit, and OpenAI (ChatGPT) ads. Data we receive includes:

• account identifiers, account names, and access tokens;
• campaigns, ad sets or ad groups, ads, creatives, and their settings, budgets, and status;
• performance metrics, including spend, impressions, reach, clicks, video views, conversions, revenue, and return on ad spend;
• aggregated breakdowns as the platform provides them, such as by age band, gender, placement, device, and region; and
• audience, targeting, and conversion configurations, and product catalogs or feeds linked to the account.

Aggregated reports do not identify individuals. We do not receive the names or contact details of people who see or click your ads through these connections.

2.3 Information we collect automatically

• Usage data: features and tools used, actions taken, prompts submitted, content generated, timestamps, and workspace activity.
• Device data: IP address, browser type, operating system and version, device type and model, screen resolution, language settings, unique identifiers (including advertising identifiers), network and carrier information, and general location (city, state, or region) derived from your IP address.
• Online activity data: pages or screens viewed, time spent, navigation paths, access times, and whether you opened our marketing emails or clicked links in them. Our emails may contain pixels that record your email address, IP address, and the date and time you opened a message or clicked a link.
• Error and crash reports.
• Cookies, local storage, and web beacons on our website and platform (Section 7).

2.4 Information from other sources

• Public web pages you ask us to read: when you give us a product URL or your website, we retrieve its publicly available content (names, descriptions, images, prices, brand details) for brand research and catalog import.
• Public sources used for brand and market research, such as public ad libraries and websites.
• Social media platforms: we maintain pages on platforms such as Facebook, X, Instagram, and LinkedIn. The platform’s privacy policy governs your interactions there; information you or the platform share with us is handled under this policy.
• Marketing partners, resellers and referral partners, publicly available sources, and data providers that help us enrich company and lead records.
• The AI assistant or workplace tool that calls Omneky (Section 2.6).

2.5 Information the Services generate

Generated creatives (images, video, copy, scripts, voiceovers, landing pages), strategies and recommendations, performance predictions, reports, and metadata about how each item was produced (prompt, model, version, editor). When you use Chat with Data or the AI Growth Agent, the questions you ask and the answers returned are stored with your workspace.

2.6 Tool inputs and outputs from the API and Connectors

Developers can call Omneky through our API, and you can use Omneky from AI assistants through our Connectors (currently the Omneky connector for Claude and the Omneky plugin for Grok). In each case, the calling application sends our tools the inputs needed to act on your request and receives our outputs.

• What we receive (inputs). The text of your request as relayed by the assistant or application; identifiers for your workspace, brand, products, campaigns, and ads; product and website URLs; creative prompts and reference media; campaign parameters (objective, budget, schedule, targeting, destination URL, conversion event); date ranges, dimensions, and filters for reports; and an authentication token for your Omneky account, which identifies your user ID and the workspaces you may access.
• What we return (outputs). Generated creatives and previews; brand and catalog records; campaign, ad group, and ad status and identifiers; targeting options and reach estimates; performance metrics, breakdowns, trends, and recommendations; and error messages.
• What we do not receive. We receive only what the calling application sends to our tools. We do not receive your full conversation with an AI assistant unless the assistant includes part of it in a request. The assistant provider processes your conversation, including our outputs, under its own privacy policy.
• Slack. If you add the Omneky app to your Slack workspace, it can read the messages and files in the channels it is added to, along with messages and commands directed to it and the channel and user IDs needed to reply, and it posts outputs to the channels you choose. It does not read channels it has not been added to; remove the app from a channel to stop this.

The table below lists the current tool families and their data flows. We update it when tools change.

3. How we use information

We use information for the purposes below and for no other purpose without telling you first.

Model training and improvement. We use aggregated and de-identified creative and performance data, including which creative elements drove results, to train, fine-tune, and evaluate the models that power Omneky. We do not use your brand assets, product content, or prompts to train models that generate content for other customers except in de-identified form, and we do not train on your data at all where your agreement with us prohibits it. Enterprise customers can exclude their data from model training through their agreement with us.

Third-party AI models. We route requests to third-party AI models (Section 4). Our agreements with these providers prohibit them from using your prompts, content, or outputs to train their models, and we do not send them your account credentials or billing information.

Google Workspace APIs. Google Workspace APIs are not used to develop, improve, or train generalized/non-personalized AI and/or ML models.

No sensitive inferences. We do not use your information to infer characteristics protected by law. We use account credentials only to sign you in, and voice and likeness samples only for the feature you requested.

4. Who we share information with

We share information only as described here. We do not sell personal information and have not sold it in the past 12 months.

Aggregated data. We may publish aggregated statistics, such as creative performance benchmarks, that do not identify any customer or person, and we may share such de-identified data with third parties for lawful business purposes, including to promote our business.

Website advertising cookies. Our website uses cookies and pixels for interest-based advertising and to measure our own campaigns (the Meta Pixel, the Google Ads tag, and the LinkedIn Insight Tag). Under California law this is “sharing” of personal information; you can opt out as described in Sections 6 and 7.

5. Data retention

We keep information for as long as needed for the purposes in Section 3, then delete or de-identify it. We set each period by how long the data is needed to provide the Services, meet contractual and legal obligations, resolve disputes, and keep the Services secure. The schedule below applies unless your agreement with us sets a different period or the law requires longer retention.

Where deletion is not possible within these periods (for example, data under a legal hold), we isolate the data from further use until it can be deleted.

6. Your rights and choices

You control your information in three places: inside Omneky, at the platforms and tools you connect, and by contacting us.

Inside Omneky.

• View and edit your account, brand, product, and campaign information at any time.
• Delete products, creatives, campaigns, landing pages, and voice or likeness samples from the platform; to export your data, email support@omneky.com.
• Disconnect an ad account in Settings > Integrations; we delete the access token immediately.
• Revoke API keys and Connector access in Settings > Integrations.
• Turn off automated campaign actions and require approval before anything is published.
• Close your account from Settings or by emailing support@omneky.com; Section 5 gives the deletion timeline.

Model training. There is no self-serve opt-out. Enterprise customers can exclude their data from model training through their agreement with us (Section 3).

At connected platforms and tools. You can also remove Omneky’s access directly: Meta (Business Integrations settings), Google (third-party apps with account access), TikTok (app permissions), LinkedIn (permitted services), Reddit (app authorizations), and the connector or plugin settings of your AI assistant or Slack workspace. Removing access there stops new data flowing to us; email us to delete data already synced.

Marketing and cookies. Unsubscribe from marketing email using the link in any message or by emailing us; you will still receive service notices. Manage cookies as described in Section 7.

Rights under privacy laws. Depending on where you live, you may have the right to:

• know what personal information we hold and receive a copy in a portable format;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing, including direct marketing, and direct us not to share your information with non-affiliated third parties;
• withdraw consent where processing is based on consent;
• opt out of “sale,” “sharing,” or targeted advertising, and limit the use of sensitive personal information (US states): email us with “Do Not Sell or Share” in the subject line;
• not be discriminated against for exercising your rights; and
• complain to a supervisory authority (EEA and UK) or appeal a decision we make on your request (US states that provide appeal rights).

EEA, UK, and Switzerland. Omneky Inc. is the controller for the data described in Section 1 where we act as controller.

California. The categories of personal information we collect, their sources, purposes, and recipients are set out in Sections 2 to 4. In CCPA terms, we collect identifiers, customer records, commercial information, internet activity, coarse geolocation (from IP address), professional information, audio and visual information (when you upload voice or likeness samples), and inferences used only to recommend campaign improvements. Account credentials and voice recordings are sensitive personal information, used only to provide the feature you requested.

Japan. 合同会社Omneky handles personal information for the purposes of use in Section 3 and provides it to third parties only as described in Section 4, including recipients outside Japan (such as Omneky Inc. in the United States and the providers listed in Section 4) under appropriate safeguards. Contact us to request disclosure, correction, suspension of use, or deletion.

How to exercise your rights. Email support@omneky.com or write to the address in Section 13. We will verify your identity using your account email or other information we hold, and respond within 30 days (45 days for California requests), extending once where the law allows. An authorized agent may submit a request on your behalf; we will ask the agent to confirm their identity and authority. If we deny a request, we will explain why and how to appeal. If we hold your information on behalf of one of our customers, we will refer you to that customer and help them respond.

7. Cookies and tracking technologies

We use cookies, pixels, local storage, web beacons, and similar technologies on omneky.com, in the platform, and in our marketing emails. Session cookies expire when you close your browser; persistent cookies expire within 13 months.

You can limit tracking in several ways. These settings are specific to each browser and device, so repeat them on every browser and device you use.

• Cookie banner: where shown, decline non-essential cookies.
• Browser settings: most browsers let you remove or reject cookies; see www.allaboutcookies.org for instructions.
• Privacy tools: browsers and extensions with tracker blocking, such as Privacy Badger, Ghostery, uBlock Origin, or DuckDuckGo, can block interest-based advertising cookies.
• Google Analytics: opt out with Google’s browser add-on at tools.google.com/dlpage/gaoptout.
• Do Not Sell or Share: California and other US state residents can opt out of advertising cookies by emailing us with “Do Not Sell or Share” in the subject line. We do not respond to “Do Not Track” signals, which have no common standard; see www.allaboutdnt.com.

8. Security

Omneky is SOC 2 Type II certified. We protect information with encryption in transit (TLS) and at rest, role-based access controls, least-privilege access for staff, logging and monitoring, vendor security reviews, and regular testing. Access tokens for connected accounts are encrypted and used only for the actions you authorize. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you, by email or telephone where the law permits, and the relevant authorities as the law and your agreement require. Report security concerns to support@omneky.com.

9. International data transfers

We are based in the United States and process information there, through our support team in India, and in the countries where our service providers and AI model providers operate, which may include countries outside the United States and the European Economic Area. Where we transfer personal information from the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss equivalents, with supplementary measures where needed. Enterprise customers can request a copy of the transfer terms in our DPA, and can choose on-premises or region-restricted deployment of Omneky’s models under a separate agreement.

10. Automated decision-making and AI-generated content

Omneky uses AI and automated systems to generate creatives, propose strategies, and manage campaigns. These systems act on business advertising data within the objectives, budgets, targeting rules, and approval settings you set. They may, for example, pause an underperforming ad, shift budget between ads, or suggest new variants; they do not make decisions with legal or similarly significant effects on individuals. You can review generated content before it is published and turn off automated actions. AI-generated content can be inaccurate or infringe third-party rights, so you are responsible for reviewing ads, landing pages, and claims before publication. Where the law requires, we label AI-generated content, and before you clone a voice or likeness you must confirm in the product that the person has consented.

11. Children

The Services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18, and if we learn we have collected it without verified parental consent, we delete it. If you believe we have information from or about a child, contact us using the details in Section 13. Advertisers are responsible for complying with platform rules on advertising to minors.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top, post the new version on our Services, and, where we have your contact details, notify you by email or in the platform. Changes take effect when posted unless we state otherwise, and continued use of the Services after posting means you accept the updated policy. This version replaces the policy dated August 28, 2023. It adds the descriptions of the API and Connectors and their tool inputs and outputs (Section 2.6), the purposes table and model-training statement (Section 3), the recipients table (Section 4), the retention schedule (Section 5), and the expanded rights and controls (Section 6).

13. Contact us