Privacy policy

This privacy policy describes how Omnesly (“Omnesly,” “we,” “us,” or “our”) collects, uses, shares, stores, and protects information when you visit our website, use the Omnesly desktop application or web application (together, “the app”), or otherwise interact with us (collectively, “the services”). It also explains the choices and rights available to you. It’s written to be read, not just filed. If anything here is unclear, email us at info@omnesly.com.

By using the services, you acknowledge that you have read this policy. If you do not agree with it, please do not use the services. This policy should be read together with our Terms of service.

The short version

Omnesly is a workspace for the AI models you already have access to. You bring your own API keys, and those keys are encrypted and kept only on the device or server that runs Omnesly for you; they are never stored in our cloud database and never shown back to anyone. Your workspace (your projects, chats, files, documents, and settings) is stored in our cloud database so it is available whenever you sign in and on each of your devices. When you run a model, the prompt and any context you choose to include are sent to the AI provider you selected, and that provider’s own terms and privacy policy apply. Local Host models run entirely on your own computer.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your prompts, responses, files, or documents to train any AI model.

Information you provide to us

When you create an account, join a waitlist, or update your profile, we collect information such as your name, display name, email address, password (which is handled by our authentication provider and stored only in hashed form), profile photo, and any optional details you choose to add, such as your organization or industry. If you enable two-factor authentication, our authentication provider stores the information needed to verify your second factor.

When you use the app, we store the content you create or add to your workspace so that the app can work: projects, chats and messages, model responses, attachments, files you upload to File Rooms, notes, documents and spreadsheets in Work, their revision history, agent and Cohort configurations, run results, prompt templates, project memory, and your settings and preferences. If you invite coworkers or share a chat, we also store their email addresses and the connection between your accounts.

If you contact us by email, through a contact form, or for support, we collect the information you include in your message, such as your name, email address, company, and the content of your request, and we keep a record of that correspondence so we can help you.

Information we collect automatically

When you use the app, we record operational information about how it is used, such as which features you use, the models and providers you run, token counts, request counts, success rates, response times, and any cost a provider reports. Much of this powers the usage statistics shown to you in the app. We also collect technical information needed to keep the services running and secure, such as your device type, operating system, app version, browser type, IP address, time zone, error logs, and crash diagnostics.

On our website, we and our analytics provider may collect information about your visit, such as the pages you view, the links you click, the referring page, your approximate location derived from your IP address, and your browser and device type, using cookies and similar technologies described below. When you sign up or sign in, a security check provided by Cloudflare Turnstile may evaluate signals from your browser to help us tell people apart from automated abuse.

Information from third parties

If you choose to sign in with a third-party account, such as Google or Microsoft, we receive the basic profile information that service shares with us, such as your name, email address, and profile photo, in accordance with your settings on that service. If you subscribe to a paid plan, our payment processor tells us whether a payment succeeded and may share limited billing details, such as the last digits and expiry date of your card and your billing country; we never receive or store full payment card numbers. If you connect third-party apps, we receive the information described in the “Connected apps” section below.

Your API keys and credentials

The API keys you add for AI providers are encrypted with AES-256-GCM and stored only in a private directory on the device or server that runs Omnesly for you. They are never written to our cloud database, never included in backups of it, never returned to your browser after you save them, and never logged. Each key is used only to make the requests you initiate with that provider. If you use the app on another device, you may need to enter your keys again there. You are responsible for the keys you add and for any charges a provider bills to your account for their use.

When you share a chat with a coworker, the coworker can prompt the chat’s selected model, and those requests are made with your provider connection on the server that runs the shared chat. Your key itself is never sent to or shown to the coworker.

AI providers and Local Host models

When you send a prompt to a connected provider, such as Anthropic, OpenAI, Google, Qwen, Mistral AI, or any other supported or custom endpoint, Omnesly sends the prompt, the conversation history and context needed for that request, and any files, File Room content, or connected-app results you chose to include to that provider using your key. In the desktop app, these requests are made from your own device; in the web app, they are made from our servers on your behalf. The provider receives and processes that data under its own terms and privacy policy, which may include its own retention, abuse monitoring, or training practices. Omnesly does not control how a provider handles data, so we encourage you to review each provider’s policies and settings before you connect it.

Local Host models run on your own computer. Prompts and responses for a Local Host model are processed on your device and are not sent to any AI provider, although the resulting chat is saved to your workspace like any other chat. When you download a Local Host model, the download comes from the model’s distribution source, which may receive standard request information such as your IP address.

Connected apps

The Tools area lets you connect third-party apps, such as email, calendars, documents, and project management tools, through our integration partner Composio. When you connect an app, you authorize the connection directly with that app and Composio, and Composio holds the resulting access on your behalf; we receive and store a reference to the connected account and its status. Only the connected accounts you select for a particular chat are made available to the model for that run. Every action the model proposes in a connected app is shown to you first, and nothing is executed until you approve it. When you approve an action, the request and its result pass between our servers, Composio, and the app, and the result is returned to the model and saved in your chat. Your use of each connected app is also governed by that app’s own terms and privacy policy, and you can disconnect an app at any time.

Web search and web access

If you allow a model to search the web or read web pages, the search queries and page addresses involved are sent to the search or content service that fulfills them, which may include Brave Search, Tavily, Wikipedia, or Open-Meteo for weather information, depending on your settings. Those services receive the query and standard request information but not your account details. You control web access through the permission settings in the app.

Coworkers and shared content

Omnesly includes optional collaboration features. When you send a coworker request, the recipient sees your name and email address. When you share a chat, everyone you invite and who accepts can read the chat’s messages and send prompts to its model, and the content they add becomes part of that chat. Please only share content you have the right to share, and remember that the people you share with may copy or retain it. Adding a coworker’s name to a chat or File Room as a label does not give that person access; access is granted only through the invitation flow.

How we use information

We use the information described above to provide, operate, maintain, and secure the services; to create and manage your account and authenticate you; to store and sync your workspace; to run the features you request, including model runs, Cohorts, agents, File Rooms, Work, Developer, and connected apps; to show you your usage statistics; to process payments and manage subscriptions; to respond to your requests and provide support; to send you service messages such as security alerts, receipts, and important changes; to detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms; to understand which features are useful so we can improve them; to comply with legal obligations; and for any other purpose we describe to you when we collect the information or with your consent. With your permission, we may also send you product updates and announcements, and you can unsubscribe from these at any time.

We do not use your prompts, responses, files, documents, or other workspace content to train AI models, and we do not access the content of your workspace except as needed to provide the services you request, to provide support you ask for, to investigate abuse or security issues, or where required by law.

Legal bases for processing

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information on the following legal bases: to perform our contract with you and provide the services you request; for our legitimate interests in operating, securing, and improving the services, where those interests are not overridden by your rights; to comply with our legal obligations; and with your consent, such as for non-essential cookies or marketing messages, which you can withdraw at any time without affecting processing that happened before.

How we share information

We do not sell your personal information. We share it only as described in this policy. We share information with service providers that process it on our behalf and under our instructions, including Supabase for our database, authentication, and file storage; Cloudflare for security and abuse prevention; Composio for connected apps; our hosting, email, and payment providers; and analytics providers for our website, such as Google Analytics. These providers are permitted to use your information only to provide their services to us.

We also share information with the AI providers, connected apps, and web services you choose to use, as described above; with coworkers you choose to share content with; when we believe in good faith that disclosure is necessary to comply with a law, regulation, legal process, or enforceable governmental request, to enforce our terms, or to protect the rights, property, or safety of Omnesly, our users, or the public; in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, in which case the information would remain subject to the commitments in this policy or we would notify you; and with your consent or at your direction. We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

Cookies and similar technologies

Our website and web app use cookies, local storage, and similar technologies. Strictly necessary technologies keep you signed in, record your cookie choices, and protect the services against abuse; the services do not work properly without them. With your consent, preference technologies remember settings such as your theme, and analytics technologies, such as Google Analytics, help us understand how visitors use our website so we can improve it. We do not use marketing cookies on our website. You can change your choices at any time using the “Cookie settings” link in the website footer. You can also control or delete cookies through your browser settings, and you can opt out of Google Analytics by using Google’s browser add-on; blocking strictly necessary technologies may prevent you from signing in.

Some browsers offer a “Do Not Track” signal. Because there is no common standard for how to respond to it, our website does not currently change its behavior in response to Do Not Track. Where applicable law requires it, we treat a Global Privacy Control signal as a valid request to opt out of the sale or sharing of personal information for the browser that sends it.

Data security

We use administrative, technical, and physical safeguards designed to protect your information. Data sent between the app and our servers is encrypted in transit using TLS; API keys are encrypted at rest and kept out of our database; access to workspace records is restricted by row-level security so that each signed-in user can reach only their own data and data explicitly shared with them; and you can protect your account with two-factor authentication. Approval steps for tool calls, commands, and connected-app actions add a further layer of control. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password, devices, and API keys secure, and for telling us promptly at info@omnesly.com if you believe your account has been compromised. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

Data retention and deletion

We keep your account information and workspace content for as long as your account is active or as needed to provide the services to you. Some operational records, such as detailed run activity logs, are kept only for a limited period, currently about 30 days, before being removed. You can delete individual chats, files, documents, projects, and other content from within the app at any time, and you can export your data from Settings. Credentials stored on your device remain there until you remove them in the app or delete the app’s local data.

If you delete your account, or ask us to, we will delete or anonymize your personal information within a reasonable time, except where we need to keep certain information to comply with legal, tax, or accounting obligations, resolve disputes, prevent fraud or abuse, or enforce our agreements. Residual copies may remain in backups for a limited period until they are overwritten in the normal course of operations. Content you shared with coworkers may remain visible to them as part of a shared chat where that is necessary for the chat to keep working for its other participants.

International data transfers

We and our service providers may process and store information in countries other than the one where you live, including the United States, whose data protection laws may differ from those of your country. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, or another lawful transfer mechanism.

Your privacy rights

Depending on where you live, you may have the right to know what personal information we hold about you and how we use it; to access and receive a copy of it, including in a portable format; to correct inaccurate information; to have your information deleted; to restrict or object to certain processing, including processing based on our legitimate interests and processing for direct marketing; to withdraw consent where processing is based on consent; and to opt out of the sale or sharing of personal information or targeted advertising, even though we do not engage in those practices. Many of these controls are available directly in the app, where you can edit your profile, export your data, and delete content or your account.

To exercise any of these rights, email us at info@omnesly.com. We will respond within the time required by applicable law, and we may need to verify your identity before acting on a request, usually by confirming it from the email address associated with your account. You may use an authorized agent to make a request on your behalf where the law allows, in which case we may ask for proof of the agent’s authority. We will not discriminate against you for exercising your rights. If we decline your request, you may appeal by replying to our decision, and if you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

California and other U.S. state residents

If you are a resident of California or another U.S. state with a comprehensive privacy law, this section supplements the rest of this policy. In the past twelve months, we have collected the categories of personal information described above, which correspond to identifiers (such as your name, email address, and IP address), customer records, commercial information (such as your subscription), internet and network activity, approximate geolocation, the content of your communications and workspace, and inferences about which features you use. We collect this information from the sources and for the business purposes described in this policy, and we disclose it to the categories of recipients described in “How we share information.” We do not sell personal information or share it for cross-context behavioral advertising, we have not done so in the past twelve months, and we do not knowingly sell or share the personal information of consumers under 16. We use sensitive personal information, such as your account login credentials, only to provide the services and as otherwise permitted by law. You may exercise your rights as described above.

Children’s privacy

The services are not directed to children under 13, or under the minimum age required to consent to the processing of personal information in your country, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us at info@omnesly.com and we will take steps to delete it.

Third-party websites and services

The services contain links to, and integrations with, websites and services that we do not own or control, including AI providers, connected apps, and the websites of companies whose logos appear on our site. This policy does not apply to them, and we are not responsible for their privacy practices. We encourage you to read the privacy policies of any third-party service before you use it or share information with it.

Changes to this policy

We may update this policy from time to time as our services, practices, or legal requirements change. When we do, we will update the date at the top of this page, and if the changes are material, we will make a reasonable effort to notify active users in advance, for example by email or through a notice in the app. Your continued use of the services after an update takes effect means you accept the updated policy.

Contact

If you have any questions about this policy or how we handle your information, or if you would like to exercise any of your rights, please contact us at info@omnesly.com. We will do our best to respond promptly.