Terms of Service

Effective July 25, 2026. Last updated July 25, 2026.

These Terms of Service (“Terms”) govern access to and use of Loki, a software platform for social media marketing agencies, provided by Omni Capital ehf., a private limited company registered in Iceland (company ID 5712241860), with registered address at Birkigrund 47, 200 Kópavogur, Iceland (“Omni,” “we,” “us,” or “our”). The other party is the agency that holds the Loki workspace (“Customer,” “you,” or “your agency”).

By accessing or using Loki, or by clicking to accept, you agree to these Terms. If you are using Loki on behalf of an agency, you are agreeing on that agency’s behalf and you confirm you have authority to do so. Accepting these Terms also constitutes acceptance of the data processing terms in Section 8, which are the Article 28 GDPR terms between the agency as controller and Omni as processor.

1. The service

Loki lets a social media marketing agency run its clients’ video production pipeline, collect client approvals, plan content ideas, track social performance, and produce reporting, in a private multi-tenant workspace, and optionally share a client portal with each client. Loki is invite-only: accounts are created by an agency already using the product, not through open self-service signup.

Where Loki offers a connection to a third-party platform, Loki accesses that platform’s account only on the Customer’s behalf and only through the platform’s own authorization flow. An authorized person connects the account through that platform’s OAuth consent screen, the platform issues Loki a token limited to the scopes shown on that screen, Loki uses it to read reporting data for that account only, and the connection can be revoked at any time in Loki or at the platform. Loki never asks for or stores platform passwords, never posts or publishes on a connected account, and never uses a connected account for any purpose other than the reporting the Customer asked for. Today no social platform connection is live in Loki, and all social figures are entered manually by the agency.

2. Accounts, workspaces, and authorized users

You must provide accurate information when an account is created, and keep credentials confidential.
You are responsible for everything done under your account and by your authorized users, and for removing users who leave your agency.
Loki is intended for business use by adults acting for an agency or one of its clients, not for personal or consumer use.
An agency owner or admin can add and remove team members, and can grant or revoke a client’s portal access, for their own agency’s workspace. A portal user holding the primary contact role can also invite, re-role, and remove their own colleagues’ portal accounts for that client.
You and each of your authorized users must accept these Terms and our Privacy Policy before connecting any Google account, or any other platform account, and before using any feature built on data obtained from it.

3. Agency responsibilities for client data

You are responsible for the data you enter about your own clients and for the accounts you connect. You warrant that you have authority from each end client to enter that client’s data into Loki and to connect that client’s social or advertising accounts, and that you have a lawful basis and any necessary consents under the GDPR for the resulting processing. You are the controller of your end clients’ personal data; Omni Capital ehf. is your processor for it, on the terms in Section 8.

4. Client portal access

Where an agency grants a client portal access to Loki, that access is scoped to that client’s own data. It lets the client review work, comment, request changes, approve, message the agency, respond to idea sheets, and manage their own profile, and it lets a portal user holding the primary contact role manage which of their own colleagues have portal access. Portal access is controlled by the inviting agency; Omni does not independently vet or manage individual portal users. The inviting agency is responsible for telling its portal users how their data is handled and for removing access when a person no longer needs it.

5. Acceptable use

You agree not to:

Access or attempt to access another agency’s workspace or another client’s data without authorization.
Resell, sublicense, redistribute, or bulk-export raw data obtained from any connected platform, or transfer it to a data broker or information reseller.
Use platform data for advertising targeting, retargeting, recruiting, lead generation, or sales prospecting.
Use platform data for eligibility decisions in credit, lending, employment, insurance, or housing, or for surveillance purposes.
Derive or infer sensitive attributes such as race, ethnicity, political opinions, religion, health, or sexual orientation from platform data.
Use Loki to store or process data you do not have the right to hold.
Scrape, reverse engineer, circumvent rate limits, or disrupt the integrity or performance of Loki.
Upload unlawful content, or use Loki for any unlawful purpose.
Use Loki in any way inconsistent with the terms of the source platform the data came from.

6. AI-assisted features

Loki includes AI-assisted features, built on the Anthropic Claude API, that generate suggestions such as report summaries, content idea prompts, and draft emails. These outputs are generated automatically and can be inaccurate, incomplete, or unsuitable for a given situation. You are responsible for reviewing any AI-generated content before relying on or sending it. AI outputs are not professional, legal, or financial advice. What is sent to the AI provider is described in our Privacy Policy.

7. Third-party integrations and platform terms

Loki offers an optional Google Calendar and Drive integration today, and may offer integrations with social media and advertising platforms as they become available. Connecting a third-party account is optional and can be disconnected at any time. We are not responsible for the availability or behaviour of third-party platforms.

When you connect a platform account you also agree to comply with that platform’s own applicable terms, including the Meta Platform Terms, TikTok’s Terms of Service and Developer Terms, the Google APIs Terms of Service and the YouTube Terms of Service, and the LinkedIn User Agreement, as applicable. Specifically:

Meta. You and each connecting business acknowledge that you remain separately bound by Meta’s Terms of Service, Platform Terms, Developer Policies, and, where applicable, Advertising Standards. Connecting an account through Loki does not displace those obligations.
TikTok. You will not use TikTok-sourced data for any purpose other than the one disclosed in our Privacy Policy, and will not remove user protections such as watermarks. TikTok data is made available on a personal, non-exclusive, non-sublicensable, non-transferable basis, so Loki grants you no right of resale, sublicense, bulk export, or transfer of raw TikTok data, and Loki will not share TikTok user data with third parties without consent.
Google. You acknowledge that use of Google-derived and YouTube-derived features is subject to the YouTube Terms of Service and the Google Privacy Policy, and that you can revoke Loki’s access at any time at https://myaccount.google.com/permissions.
LinkedIn. LinkedIn-sourced data you present to your own clients must be identifiable as coming from LinkedIn and distinguishable from other platforms’ data. Any markup or fee you add on top of LinkedIn’s own costs must be disclosed to your client separately rather than bundled. Raw LinkedIn member data is not exported or redistributed to your clients beyond aggregated or derived reporting.

8. Data processing terms (Article 28 GDPR)

This section is the data processing agreement between you as controller and Omni Capital ehf. as processor, for personal data that you or your authorized users enter into, generate in, or connect to Loki and for which you determine the purposes, including personal data of your own clients, their contacts, and your own staff. It takes effect when you accept these Terms. Where you and Omni have signed a separate data processing agreement, that agreement prevails over this section to the extent of any conflict.

(a) Subject matter, duration, nature, and purpose

Subject matter: provision of the Loki production, approval, and client reporting workspace. Duration: the subscription term, plus the deletion window in clause (j). Nature and purpose: collection or retrieval, storage, organization, aggregation, and presentation of client production content and social performance data so that the agency can produce content and report on it to its client, and transmission of transactional notifications about that work.

(b) Types of personal data

End client contact details (name, work email, phone, role), portal user account details, free-text notes and briefs, comments and approvals authored in review threads, shoot day details including location, uploaded video and document files, social account identifiers and handles, profile names and avatars, published content and its metadata, engagement and audience metrics, and ad account performance data.

(c) Categories of data subjects

Your own staff and authorized users, your end clients and their staff, the authorized administrators of those clients’ social accounts, people appearing in or named in content and briefs you upload, and, in aggregate and non-identifying form only, the audiences of those social accounts.

(d) Documented instructions

Omni processes that personal data only on your documented instructions, which consist of these Terms, your configuration of the product, and the actions your authorized users take in it, including as regards transfers to a third country. If EEA or Icelandic law requires Omni to process the data otherwise, Omni will inform you before processing unless that law forbids it. Omni will tell you if, in its opinion, an instruction infringes the GDPR.

(e) Confidentiality

Every Omni person authorized to process that personal data is bound by a contractual duty of confidentiality, and access is granted on a least-privilege basis only where it is needed to run, support, or secure the service.

(f) Security

Omni implements the technical and organizational measures required by Article 32 GDPR, including tenant isolation enforced at the database layer with row level security, encryption in transit and at rest, scrypt hashing of portal passwords, service-only storage of authorization tokens and credentials, role-based access control, optional two-factor authentication, time-limited and audit-logged administrative access, and error and platform monitoring. These measures are described in more detail in the Security section of the Privacy Policy.

(g) Subprocessors

You give Omni general written authorization to engage the subprocessors listed in the Privacy Policy. Omni will notify the workspace owner by email at least 30 days before any new or replacement subprocessor begins processing personal data, and you may object on reasonable data protection grounds within that period, in which case Omni will work with you on an alternative or you may terminate the affected service. Omni imposes data protection obligations on each subprocessor that are equivalent to those in this section, and remains fully liable to you for a subprocessor’s performance.

(h) Assistance with data subject rights

Taking into account the nature of the processing, Omni assists you with appropriate technical and organizational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise rights of access, rectification, erasure, restriction, portability, and objection. Where a data subject contacts Omni directly about data you control, Omni forwards the request to you rather than answering it itself, and tells the data subject that it has done so.

(i) Breach notification and assistance with Articles 32 to 36

Omni notifies you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties, and assists you with your obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to Omni.

(j) Deletion or return at the end of the engagement

At the end of the provision of services, and at your election, Omni deletes or returns all personal data processed on your behalf and deletes existing copies, unless EEA or Icelandic law requires it to be stored. Timing, the channel, and what is covered are set out on our Data Deletion Instructions page.

(k) Audit

Omni makes available to you the information necessary to demonstrate compliance with this section, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable advance notice, no more than once a year unless a breach or a supervisory authority requires otherwise, during normal business hours, and subject to confidentiality.

9. Intellectual property

Omni Capital ehf. owns Loki and the software, design, and branding that make it up. You and your agency retain ownership of the content you upload or enter into Loki, and your end clients retain ownership of theirs. Data obtained from a source platform remains subject to that platform’s own terms. Omni grants you a limited, revocable, non-transferable, non-exclusive licence to use Loki during your subscription term, and you grant Omni the limited right to host, process, and display your content solely to provide the service to you.

10. Fees and term

Fees for Loki, the billing cycle, and the subscription term are as agreed directly between your agency and Omni Capital ehf.; this page does not itself set pricing. Invoices are payable by the due date stated on them. We may suspend access for non-payment after giving you notice and a reasonable opportunity to pay.

11. Suspension and termination

Either party may terminate for convenience on the notice agreed between the agency and Omni, and either party may terminate immediately for material breach that is not cured within 30 days of notice. We may suspend or terminate access that violates these Terms, poses a security risk, is unlawful, or that a source platform requires us to suspend. On termination, personal data is returned or deleted under Section 8(j), and remaining data is handled as described in our Privacy Policy and Data Deletion Instructions.

12. Warranties and disclaimers

Beyond the express commitments in these Terms, Loki is provided “as is” and “as available,” and to the extent permitted by law Omni disclaims all other warranties, express or implied. We give no warranty as to the accuracy, availability, or continuity of any third-party platform API. Meta, TikTok, Google, and LinkedIn may change, restrict, or withdraw access to their APIs at any time, and a feature that depends on such an API may change or stop working as a result.

13. Limitation of liability

To the extent permitted by law, neither party is liable for indirect, incidental, special, or consequential loss, loss of profits, loss of business, or loss of data beyond the cost of restoring it from backup. Omni’s total aggregate liability arising from these Terms or your use of Loki is limited to the amount you or your agency paid Omni for the service in the twelve months before the event giving rise to the claim. Nothing in these Terms limits liability for fraud, wilful misconduct, death or personal injury caused by negligence, or any other liability that cannot be limited under Icelandic law. Nothing in these Terms limits or excludes a data subject’s statutory rights or remedies under the GDPR.

14. Indemnity

You will indemnify Omni Capital ehf. against claims, losses, and reasonable costs arising from your lack of authority or lawful basis to enter an end client’s data into Loki or to connect an end client’s accounts, and from your breach of a source platform’s terms.

15. Governing law and venue

These Terms are governed by the laws of Iceland, without regard to conflict-of-law principles, except where mandatory local consumer or data protection law provides otherwise. The courts of Iceland have exclusive jurisdiction, with Héraðsdómur Reykjavíkur (Reykjavík District Court) as the court of first instance.

16. Changes and general terms

Changes. We may update these Terms as Loki changes. We will update the effective date above, and for material changes we will make a reasonable effort to notify affected agencies directly.
Assignment. Neither party may assign these Terms without the other’s written consent, except to a successor in connection with a merger or a sale of substantially all assets.
Severability. If a provision is held unenforceable, the rest remains in force and the provision is applied to the greatest extent permitted.
Entire agreement. These Terms, the Privacy Policy, and any signed order form or data processing agreement are the entire agreement between the parties about Loki.
Notices. Notices to Omni go to thor@omni-systems.ai or to Omni Capital ehf., Birkigrund 47, 200 Kópavogur, Iceland. Notices to you go to the email address on your account.

17. Contact us

Questions about these Terms can be sent to thor@omni-systems.ai.