Privacy Policy
Effective August 7, 2026. Last updated August 7, 2026.
Loki is a software platform built for social media marketing agencies. It gives an agency one private workspace to run its clients’ video production pipeline, collect client approvals through a client portal, plan content ideas, track social performance, and deliver monthly reports. Loki is developed and operated by Omni Capital ehf., a private limited company registered in Iceland (“Omni,” “we,” “us,” or “our”). This policy explains what personal data Loki processes, why, who it is shared with, how long it is kept, and the rights available to you.
Loki is invite-only: there is no public self-service signup. Every person with a Loki account, whether agency staff or a client’s portal user, is invited by an agency already using the product. This policy applies to everyone whose personal data Loki processes: agency staff accounts, the agency’s clients whose information an agency enters into Loki, and the individual people at those clients who are given portal access.
1. Who we are
Omni Capital ehf., a private limited company registered in Iceland, company ID (kennitala) 5712241860, registered address Birkigrund 47, 200 Kópavogur, Iceland. Omni Capital ehf. builds and operates Loki.
Privacy contact, monitored: thor@omni-systems.ai. Postal enquiries can be sent to the registered address above.
Omni Capital ehf. has not appointed a Data Protection Officer, as it is not required to do so under Article 37 GDPR. Privacy enquiries are handled by the contact above.
2. Our two roles: controller and processor
Loki is multi-tenant, so our role depends on whose data is involved.
- We are the controller for agency account holder identity and authentication data, billing records, support correspondence, security and error logs, in-product usage metering, and the authentication and security records we generate about client portal accounts, namely credential hashes, session records, and rate-limit records.
- We are a processor for the client workspace content an agency enters or connects about its own clients, for client portal user account records, and for any social platform data an agency connects on a client’s behalf once such a connection is available. The agency is the controller of that data and determines the purposes and the legal basis for it. We act only on that agency’s documented instructions.
The processing we carry out as a processor is governed by the Article 28 GDPR data processing terms embedded in our Terms of Service, Section 8, which are incorporated into this policy by reference and are accepted when an agency accepts those Terms.
3. Information we collect
Some of the categories below are provided directly (by you, or by the agency that invited you); some are generated automatically as Loki is used.
Account data
Name, email address, and password (stored as a salted hash by our authentication provider, Supabase, never in plain text) for every agency staff account, plus optional profile details a user can add (phone, pronouns, bio, expertise, LinkedIn URL, avatar, theme and language preference). Role and agency membership, which determine what you can see and do inside your workspace. If you enable two-factor authentication, a record that a time-based one-time-password factor is configured for your account.
Client workspace content
The agency using Loki controls what it enters about its own clients: client and contact details (name, email, phone, notes), onboarding forms and briefs, prospect records and contact logs, video production items and their stage history, comments in review threads, internal notes, shoot day details including location, time entries, files and links attached to a production item, idea sheets, revenue and retainer figures, and monthly reports. This content belongs to the agency’s relationship with its client. If you are a client of one of our agency customers, most of what we hold about you was entered by that agency rather than collected by us directly, and you should also ask that agency how it uses Loki.
Internal team chat
Where internal team chat is available in your version of Loki, a conversation is one of three kinds and each kind has its own visibility. A public channel, including the client channels Loki creates alongside each of an agency’s clients, is visible to all staff of that agency workspace. A private channel is visible only to the staff members invited to it, and for anyone else it does not appear at all: not in their channel list, not in the channel browser, and not in search. A direct message is visible only to the people taking part in it. Messages, their attachments, and thread replies carry the visibility of the conversation they sit in.
Omni staff cannot read the content, name, topic, or membership of any private channel or direct message. That holds for our administrative tooling and for the “view as” session described in Section 5 alike. The only route in is a support access grant issued by the agency’s own owner, and only for a conversation that owner is part of themselves. A direct message can only be opened to Omni support by someone taking part in that conversation. Nobody, including the agency owner, can hand us a conversation they are not in. A grant names one Omni staff member and one conversation, records the reason it was issued, lasts at most 7 days, and expires on its own. The agency owner can see every grant that is currently live and revoke any of them, at any moment, from the workspace settings. Issuing a grant and revoking it are recorded in our log of administrative access by Omni staff, covered in Section 9. Omni cannot issue a grant to itself: the switch is held by the agency, not by us.
Without a grant, what our support tooling can establish about a private conversation is limited to whether it exists, whether it is a private channel or a direct message, whether it has been archived, and when it was created. There is one narrow exception to the line above, and we would rather state it than let it sit unsaid: for a private channel, that tooling can also see how many people are in it, though never who they are and never anything anyone wrote. For a direct message not even that count is available, because who is in a direct message is the whole of what it is. Every one of these lookups is recorded in our log of administrative access by Omni staff, whether or not it returns anything.
Where a remove option is offered, removing a message erases its text and its list of attachments for everyone, immediately and by whichever route the change reaches our database. What stays behind is a record that a message was removed, with who sent it and when, and that record is retained. To have that record erased too, use the process on our Data Deletion Instructions page.
Client portal access
When an agency gives a client’s team members access to the client portal, we create a portal account for each invited person (name, email, optional phone, avatar, and bio). The invited person claims the account through a single-use link that is valid for 7 days and sets their own password. Portal passwords are stored as scrypt hashes in a service-only database table that agency staff, other tenants, and ordinary application code can never read. Signing in issues a session token stored in an httpOnly cookie scoped to that client workspace; the session slides forward with use for up to a year. Password reset links are valid for 1 hour. We record the time of a portal user’s last sign-in.
Portal access is scoped to that client’s own data. A portal user can review work, comment, request changes, approve, message the agency, respond to idea sheets, and edit their own profile. A portal user holding the primary contact role can also manage which of their own colleagues have portal access: inviting a colleague means that portal user gives us that colleague’s name and email, so some portal account records reach us on a portal user’s initiative rather than the agency’s. Those records are still held for the agency as controller.
Uploaded files and images
Uploaded video files and message attachments are held in private storage readable only inside the owning agency; portal viewers reach them through short-lived signed links. Logos and profile pictures are stored in a public image bucket, which means anyone who has the exact file address can fetch them without signing in. Please do not upload an avatar or logo you would not want to be publicly reachable.
Social media account information
An agency can record a client’s social media handles and performance figures inside Loki (for example views, reach, followers, or engagement for an account or a piece of content) so the agency can report on them. This data can reach Loki two ways: an agency can type it in by hand, or an agency owner can connect a client’s account on a supported platform so Loki reads those figures automatically. Every such connection is read-only, is optional and off by default, and covers one client account at a time. Connections are available today for TikTok and for YouTube; Loki does not pull data automatically from Meta, Instagram, or LinkedIn. Section 10 sets out the additional commitments that apply to each connected platform, including the exact permissions requested.
Google Drive and Google Calendar
Loki offers two separate, optional Google connections. Both are off by default, and each one’s OAuth refresh token is stored in a service-only database table that ordinary application code and other agencies can never read.
- Agency Drive connection, made by an agency admin in Settings. The consent screen for this connection requests
drive.file,calendar.events,openid,userinfo.email, anduserinfo.profile. Loki creates client folders and uploads files, anddrive.filemeans Loki can see only the files and folders it created itself, never the connected account’s existing Drive content.calendar.eventsis requested here for the calendar sync feature; in the current version the events themselves are written through the personal Calendar connection below, never through this one. An agency admin can disconnect it in Settings, which deletes the stored token. - Personal Calendar connection, made by an individual staff member for their own calendar. The consent screen for this connection requests
calendar.events,openid,userinfo.email, anduserinfo.profile. Loki creates, updates, and removes only the events it manages for production due dates and shoot days. Loki does not read your existing calendar entries and never lists your calendar. Because this connection is personal, only that member can disconnect it, from their own profile; an agency admin cannot disconnect it for them.
Either connection can also be revoked directly at https://myaccount.google.com/permissions.
Content sent to our AI features
Loki includes AI-assisted features (report insight summaries, content idea generation, chat about a client, and email draft generation), built on the Anthropic Claude API. When an agency uses an AI feature for one of its clients, the prompt context can include that client’s profile as entered by the agency (including the client’s primary contact name and any free-text notes), the client’s video pipeline including comments left in review threads, shoot day details, report figures, and social metrics. AI conversations are stored in the agency’s workspace. Content sent to Anthropic is used to generate that response; we do not use it for advertising and we do not use it to train any model. These features only ever see data belonging to your own agency and its own client, never another agency’s or client’s data, and are never connected to Omni’s own internal tools or records.
Communications
We send transactional email (agency and portal invitations, welcome emails, password and access links, monthly report emails, and production notifications such as “a video is ready for review”) through our email provider, Resend. Where a send fails and needs retrying, a copy of that message, including the recipient address, subject, and rendered body, is held in our own delivery system so the send can be retried and diagnosed. We do not send marketing email through Loki. If you email us for support, we keep that correspondence to respond to you.
Technical, log, and usage data
Loki’s own application code does not read or store your IP address, user agent, or any device fingerprint. Our hosting provider (Vercel) and error-monitoring provider (Sentry, EU region) automatically log standard request data and application errors so we can run, secure, and debug the service. Sentry is configured with sendDefaultPii: false and session replay disabled: it does not record your screen or keystrokes and does not receive request payloads by default. Inside Loki we keep an audit log of sensitive administrative actions and a first-party usage counter (which feature was used, by which account, how many AI tokens were consumed) used to run the service within agreed limits.
4. Legal bases for processing
Iceland is part of the European Economic Area, so Omni Capital ehf. processes personal data under the General Data Protection Regulation (GDPR). Where we rely on legitimate interests, the specific interest is named.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, work email, password hash, authentication identifiers, two-factor factor record | Create and secure the agency account | Article 6(1)(b), performance of a contract |
| Agency name, workspace configuration, role and membership | Provide the multi-tenant service and enforce tenant isolation | Article 6(1)(b), performance of a contract |
| Client workspace content, portal user account records, and connected platform data | Provide the workspace to the agency that entered or connected it | Processed as a processor on the agency's documented instructions; the agency determines the legal basis |
| Portal credential hashes, portal session records, anti-abuse rate-limit counters | Authenticate portal users and protect portal accounts against abuse | Article 6(1)(f), legitimate interest in keeping portal accounts secure |
| Billing and invoice records | Take payment and meet Icelandic accounting law | Article 6(1)(b) and Article 6(1)(c), legal obligation |
| Support correspondence | Answer support and data requests | Article 6(1)(b) where you are an account holder, Article 6(1)(c) where we are answering a data protection request, otherwise Article 6(1)(f), legitimate interest in answering people who contact us |
| Server and platform request logs, error reports, audit log | Keep the service secure, available, and debuggable, and investigate abuse | Article 6(1)(f), legitimate interest in keeping Loki secure and available |
| In-product usage metering | Understand which features are used and keep AI usage within agreed limits | Article 6(1)(f), legitimate interest in operating the service within its agreed limits |
| Optional Google Calendar and Drive connection made by a user for their own Google account | Provide the specific connected feature that was asked for | Article 6(1)(a), consent, withdrawable at any time by disconnecting |
| Disclosure to comply with law, enforce our Terms, or protect rights and safety | Meet legal obligations and defend legal claims | Article 6(1)(c) where a law requires it, otherwise Article 6(1)(f), legitimate interest in enforcing our agreements and defending legal claims |
Providing a name and work email is necessary to create a Loki account and to give a client portal access; without it we cannot provide the service. Everything else in a profile is optional.
5. Cookies
Loki sets only strictly necessary cookies. There is no advertising, marketing, or analytics cookie, no tracking pixel, and no third-party tracking or ad-tech script anywhere in the product, so no consent banner is required. The portal session cookie, the OAuth state cookie, and the two administrative cookies below are set server-side and are httpOnly. If we ever add a cookie that is not strictly necessary, we will ask for your prior consent first.
- Authentication session cookie for agency staff, set by the Supabase authentication library so you stay signed in between requests. Unlike the others in this list it is not httpOnly: it is readable by Loki’s own front-end code in your browser, which is how the browser maintains your session. It is never sent to a third party. Its default lifetime is set by that library, currently 400 days.
- Portal session cookie for client portal users, one per client workspace, holding the portal session token. It slides forward with use for up to a year.
- A short-lived OAuth state cookie, set only while you are in the middle of connecting a Google account, used to prevent cross-site request forgery during that flow, and discarded immediately after.
- A signed, read-only “view as” cookie, used by Omni support staff to troubleshoot a specific named account on request. It is cryptographically signed, valid for at most 2 hours, allows no changes to be made, and starting and ending the session is recorded in that agency’s audit log.
- An internal administration cookie, used by Omni staff to manage a specific agency workspace for support purposes. To be plain about what it allows: this session lets Omni staff act inside that agency workspace with the same powers as the agency’s own administrators, including making changes. It is limited to 8 hours and is used only to run, support, or secure the service.
Neither of the last two cookies is ever used for tracking. More generally, Omni operations staff can access workspace data through administrative tooling where that is needed to run, support, or secure the service, with the exception of private channels and direct messages in internal team chat, which Section 3 describes; access to a named user’s view is signed, time-limited, and audit-logged as described above.
6. How we use information
- To provide, operate, and maintain Loki, including authenticating you and enforcing that each agency only ever sees its own data.
- To power the AI features described above, at your or your agency’s request.
- To send the transactional emails your agency’s workflow triggers.
- To monitor for errors, abuse, and security issues, and to keep the service reliable.
- To respond to support requests and to data protection requests.
- To comply with legal obligations such as accounting and tax record keeping.
We do not sell, rent, or license personal data. We do not sell or license data obtained from any social platform. We do not use client workspace content or connected platform data to serve advertising, to target ads, or to build advertising profiles. We do not use it for eligibility decisions in credit, lending, employment, insurance, or housing. We do not use it for surveillance purposes, and we do not derive or infer sensitive attributes such as race, ethnicity, political opinions, religion, health, or sexual orientation from it.
7. Who we share information with
We share data with the subprocessors that run Loki’s infrastructure, and only to the extent needed for them to provide that infrastructure to us. We will notify the workspace owner by email at least 30 days before any new or replacement subprocessor begins processing personal data, and you may object on reasonable data protection grounds within that period.
| Subprocessor | Role | Location | Transfer basis |
|---|---|---|---|
| Supabase | Application database, authentication, file storage | AWS eu-west-1, Ireland, EU | No transfer outside the EEA for primary data storage |
| Vercel | Application hosting, edge network, platform request logs | Global edge network, US-headquartered operator | Under the provider’s data processing terms, which incorporate the European Commission’s Standard Contractual Clauses |
| Resend | Transactional email delivery | US-headquartered | Under the provider’s data processing terms, which incorporate the European Commission’s Standard Contractual Clauses |
| Anthropic | AI features, processes the prompt context described in Section 3 | US-headquartered | Under the provider’s data processing terms, which incorporate the European Commission’s Standard Contractual Clauses |
| Sentry | Error monitoring | Sentry EU region | Processed in the EU |
| Only where an agency connects the optional Calendar or Drive integration | EEA and US | Google's own terms, plus Standard Contractual Clauses or the Data Privacy Framework |
Last change to this list: July 25, 2026, initial publication.
If and once a social platform connection becomes available and an agency connects an account, the source platform for that connection (Meta Platforms Ireland Ltd., TikTok, Google Ireland Ltd., or LinkedIn Ireland Unlimited Company, as applicable) is also a recipient, under that platform’s own terms plus Standard Contractual Clauses or the Data Privacy Framework where applicable.
We may also disclose information where required by law, to enforce our Terms, or to protect the rights, property, or safety of Omni Capital ehf., our customers, or others.
8. International data transfers
Loki’s database and file storage run in the European Union (AWS eu-west-1, Ireland, through Supabase). Error monitoring runs in Sentry’s EU region. Some providers, specifically Vercel, Resend, Anthropic, and Google where an integration is connected, may process data in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses, as incorporated into each provider’s data processing terms, on the EU-US Data Privacy Framework where the recipient is certified, or on an adequacy decision where one applies. We do not rely on any other transfer mechanism.
You can see the clauses we rely on in each provider’s published data processing terms, linked in the table in Section 7, and a copy of the Standard Contractual Clauses that apply to a given provider is available on request from thor@omni-systems.ai.
9. How long we keep data
Every category has a period or a stated criterion. Deletion requests are handled through our Data Deletion Instructions.
| Data | Retention |
|---|---|
| Agency account and workspace content | Life of the agency workspace. Deleted within 30 days of a valid deletion request or of the workspace being closed. |
| Portal user accounts and portal session tokens | Deleted immediately when the agency removes that portal user. Otherwise the life of the client record. A portal session token expires 1 year after its last use. |
| Invite, claim, and reset links | Agency invite and portal claim links expire after 7 days. Password reset links expire after 1 hour. |
| Billing, invoice, and accounting records | 7 years from the end of the relevant financial year, as required by Icelandic bookkeeping law. |
| Audit log and in-product usage metering | 12 months, then deleted automatically. Removed sooner when the workspace is deleted. |
| Records of administrative access by Omni staff | 6 months, then deleted automatically. These record which staff account opened which record and when. They identify the record by internal reference, not by name or email address, so they do not keep your details after your account is deleted. |
| Rate limiting records | A short-lived anti-abuse counter tied to a sign-in or reset attempt, which includes the email address used. It is cleared the next time that same counter is checked, and we remove any remaining counters for an address on request. |
| Support and data request correspondence | Kept while it is relevant to the request and for up to 24 months after the request is resolved, or longer where it evidences how a data protection request was handled. |
| Uploaded files and images (videos, message attachments, logos, avatars) | Held in storage until they are removed on request. Deleting a single production item removes its uploaded video file. Deleting a client or a workspace does not sweep stored files, so those are removed through the request process on the Data Deletion page. A logo or avatar in the public image bucket stops being shown in the product, but the file address keeps working until the file is removed on request. |
| Copies of transactional email | A copy is written only when a send fails and needs retrying. Once written it is retained, whether the retry later succeeds or is abandoned, until the agency workspace is deleted or you ask us to remove it. |
| Error monitoring events (Sentry, EU) | The provider's standard retention for our plan, which we do not extend. We do not export these events into our own systems. |
| Hosting request logs (Vercel) | The platform's own log retention. We do not configure log drains or long-term log storage. |
| Google Drive and Calendar tokens | Until the connection is disconnected (by an agency admin for Drive, by the individual member for Calendar) or access is revoked at Google, which deletes the stored token. |
| Meta Platform Data, once a connection is available and an account is connected | Life of the connection. Deleted within 7 calendar days of a deletion request or of the connection being disconnected in Loki, and within 30 days of Meta access being revoked at the platform. |
| TikTok data, once a connection is available and an account is connected | Life of the connection, with at most 12 months of trend history. Deleted within 7 calendar days of a deletion request or of disconnection in Loki, and within 30 days of revocation at the platform. |
| YouTube API data, for a connected channel | At most 30 calendar days before it is deleted or refreshed from the YouTube API. Disconnecting a channel in Loki deletes every figure pulled through that connection immediately; figures the agency typed in by hand are its own records and are kept. |
| Google Ads reporting data, once a connection is available and an account is connected | Life of the connection. Deleted within 7 calendar days of a deletion request, and within 30 days of revocation at Google. |
| LinkedIn data, once a connection is available and an account is connected | Never longer than the LinkedIn ceilings in Section 10. |
10. Platform-specific terms
Loki has no live social platform connection today. The commitments in this section apply to data obtained through the named platform if and once a connection is available and an account has actually been connected, and they are binding on us from that moment. They never widen what we do; they only constrain it.
Meta: Facebook and Instagram
Loki is applying to Meta for Facebook Login for Business, the Instagram platform, and the Marketing API for read-only ad performance reporting. Once a business connects an account, Meta Platform Data obtained through the Facebook Graph API and the Instagram Platform APIs would consist of: the connected Page and Instagram Business Account ID and name, the account’s profile picture, media objects and their metadata (caption, timestamp, permalink, media type), and insights metrics (impressions, reach, engagement, profile views, follower counts, and aggregate audience figures). Where the connecting business also connects an ad account, the Marketing API additionally provides read-only ad performance reporting: the ad account identifier, campaign, ad set and ad names, spend, impressions, clicks, and results. Loki reads that reporting to show it back to the business; it does not create, edit, or run ads, and it does not use it to target advertising of its own.
The purpose is exactly the one filed with Meta in App Review: to render the client reporting dashboard the connecting business has asked its agency to produce, for that business’s own accounts. Nothing else. Loki does not sell or license Meta Platform Data, does not build profiles of people beyond what that dashboard requires, does not use it for eligibility determinations in credit, employment, insurance, or housing, does not use it for surveillance, and does not reverse-engineer it. Raw Meta Platform Data is never sold or transferred: only aggregated reporting and derived insights are delivered to the connecting business and its agency. Retention and deletion follow Section 9 and our Data Deletion Instructions: we delete Meta Platform Data when retention is no longer necessary for a legitimate business purpose, when the product or feature is discontinued, when Meta requests deletion, when the user requests deletion or disconnects, or where law requires it, except for data that has already been aggregated or de-identified.
TikTok
Loki is applying to TikTok for three read-only scopes and no others: user.info.basic (open ID, avatar, display name), user.info.stats (follower, following, likes, and video counts), and video.list (the connected account’s own list of published videos and their metrics). An agency user connects a client’s TikTok account through OAuth for read-only analytics: user.info.basic identifies the connected account, user.info.stats feeds the account dashboard, and video.list builds per-post reports. Loki does not post to TikTok, does not run advertising, and does not resell data.
TikTok Developer Services Data is processed only for the limited purpose of enabling and using the TikTok Developer Services described above. It is not repurposed for advertising, profiling, model training, or resale, and it is not used for cross-context behavioural advertising. Loki’s use of TikTok data adheres to the TikTok Developer Terms of Service. Retention is the life of the connection with at most 12 months of trend history, and deletion follows Section 9.
Google APIs, including YouTube API Services
The policy referred to above is the Google API Services User Data Policy.
Specifically, information received from Google APIs is never sold or transferred to data brokers or information resellers; is never used for advertising, ad targeting, or retargeting; is never used for credit or lending decisions; and is never used to train, fine-tune, or improve generalized artificial intelligence or machine learning models. Where an agency uses an AI feature on a production item whose schedule is synced with a connected Google Calendar, that content is processed only to generate the output the agency asked for and is never used for model training.
Beyond the two optional Drive and Calendar connections described in Section 3, Loki offers an optional YouTube channel connection, made by an agency owner for one of that agency’s own clients. It uses YouTube API Services and requests exactly one read-only scope and no others: https://www.googleapis.com/auth/youtube.readonly. That scope is used to read the connected channel’s own public profile and subscriber count, and the title, publication date, view count, like count, and comment count of that channel’s own videos, so Loki can build the performance reports the agency asked for. Loki does not upload, publish, edit, comment on, or delete anything on YouTube, and no write scope exists anywhere in the product. If Loki later offers a Google Ads integration it would collect read-only campaign, ad group, keyword, and creative performance metrics, and this policy would be updated first. That use is governed by the YouTube API Services Terms of Service, and you can review how Google itself handles your data in the Google Privacy Policy. Authorized and non-authorized YouTube API data is stored for a maximum of 30 calendar days before it is deleted or refreshed from the API; aggregate statistics such as view or subscriber counts persist longer only where they are re-validated against a live authorization at least every 30 days.
You can revoke Loki’s access to your Google account at any time at https://myaccount.google.com/permissions. If Loki later needs a type or scope of Google user data not already disclosed here, we will update this policy first and re-prompt already-connected users for consent before that data is accessed.
If and once a LinkedIn connection is available and a member connects an account, Loki would access organization Page profile and admin data, organization social activity such as posts and their engagement, and ad account reporting data through the Marketing Developer Platform. Collection happens only while a connection is live, and only at the frequency needed to refresh the reporting the agency has asked for. LinkedIn member data is never sold, rented, disclosed, or shared with third parties or data brokers; it is not used for advertising, sales, or recruiting; and it is never used to derive sensitive attributes such as race, ethnicity, or political opinions. A member withdraws consent by disconnecting in Loki or by revoking the application in LinkedIn Settings, Data Privacy, Permitted Services, and requests deletion through our Data Deletion Instructions. Consent is re-obtained when a member’s OAuth access token or member token expires, and members are notified of any material change in the scope of profile data use or disclosure. Loki never retains LinkedIn data beyond LinkedIn’s Data Storage Requirements ceilings:
| LinkedIn data category | Maximum retention |
|---|---|
| Other members' profile data | 24 hour cache, never stored |
| Member social activity (posts, likes, comments) | 48 hours |
| Organization social activity | 6 weeks, or 6 months where the organization itself authenticated |
| Organization profile data | 8 weeks, or 30 days for name and logo only |
| Organization Page admin and reporting data | 1 year |
| Ad account admin and reporting data | 1 year |
11. Security
Data is encrypted in transit with TLS and encrypted at rest by our database and storage provider. Tenant isolation is enforced at the database layer with row level security, not only in application code, so one agency’s workspace cannot read another’s. Access inside a workspace is role-based. Portal passwords are scrypt hashed and kept in a service-only table. OAuth refresh tokens are held in service-only tables that application code and other tenants cannot read. Two-factor authentication is available to agency staff. Administrative access by Omni staff is time-limited and, for access to a named user’s view, signed and audit-logged. We monitor errors and platform logs, patch dependencies, and investigate and respond to security incidents. If a personal data breach affects your data we will notify the relevant controller without undue delay and, where the law requires it, the supervisory authority and affected individuals.
12. Your rights
Subject to applicable law, and free of charge, you have the right to:
- Access the personal data we hold about you.
- Have inaccurate or incomplete data corrected.
- Request erasure of your data (see Data Deletion Instructions).
- Restrict processing, or object to processing based on our legitimate interests.
- Receive a copy of your data in a portable, machine-readable format.
- Withdraw consent at any time, for processing that relies on consent, without affecting processing already carried out.
- Lodge a complaint with a supervisory authority (see Section 13).
To exercise any of these rights, email thor@omni-systems.ai. We respond within 30 days of a valid request, and within 7 calendar days for a request to delete data obtained from a connected platform. If a request is complex, or we receive several from you, we may take up to a further two months as the GDPR allows, and we will tell you within the first 30 days if that happens. This extension applies to the 30 day period only; the 7 calendar day commitment for data obtained from a connected platform is not extended. Where a request concerns client workspace content, portal user account records, or connected platform data for which we act as a processor, we forward the request to the agency that controls it and assist that agency in responding, and we will tell you that we have done so.
13. Complaints to Persónuvernd
You have the right to lodge a complaint with the Icelandic Data Protection Authority, Persónuvernd, Laugavegur 166, 4. hæð, 105 Reykjavík, Iceland. Telephone +354 510 9600. Email postur@personuvernd.is. Website https://www.personuvernd.is. You can also complain to the supervisory authority where you live or work.
14. Automated decision-making
Loki does not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR. Loki’s AI features generate drafts and summaries for a human to review; they do not decide anything about a person.
15. Children’s privacy
Loki is a business-to-business service. It is not intended for and not directed at individuals under 16, and we do not knowingly collect their personal data.
16. Changes to this policy
We may update this policy as Loki changes, and we keep it current as our data practices and API scopes change. We will update the effective date above when we do, and for material changes we will notify account holders by email. Where a change means we would access a new type of platform data, we update this policy and ask already-connected users to consent before that data is accessed.
17. Contact us
Omni Capital ehf., Birkigrund 47, 200 Kópavogur, Iceland. Company ID (kennitala) 5712241860. Questions about this policy, or about how your data is handled, can be sent to thor@omni-systems.ai, which is a monitored channel.