Privacy Policy

1. Information We Collect

When you use the Platform, we collect:

1. Account information: your name, email address, assigned role, and account activation date;
2. Authentication data: encrypted password hash, login timestamps, IP addresses, and device/browser information for security purposes;
3. Session data: session tokens, duration, and activity indicators;
4. Audit data: records of actions performed within the Platform;
5. Notifications: messages the platform shows you about work in your organization (for example, a question asked of you or a decision awaiting your sign-off), whether you have read them, and your choice of how often to be emailed about them;
6. Usage data: page views, feature interactions, and error logs.

2. How We Use Your Information

We use your information to:

1. authenticate and authorise your access to the Platform;
2. maintain the security and integrity of the platform;
3. provide audit trail functionality as required by your organisation;
4. diagnose and resolve technical issues;
5. tell you, in the platform and by email if you choose, when something in your organization needs you, with a one-click unsubscribe in every notification email;
6. comply with legal obligations.

3. Data Sharing — We Do Not Sell Your Data

We do not sell, rent, or share your personal information with third parties for marketing, advertising, or commercial purposes. Your data may be shared with:

1. your Client organisation, as the authorising entity, for account management and audit purposes;
2. infrastructure and processing providers, under data processing agreements and solely to operate the platform: Vercel (hosting), Neon (database), Cloudflare R2 (file storage), Inngest (workflow execution), Upstash (rate limiting), Resend (email delivery), OpenRouter together with Anthropic and OpenAI (AI model processing), Stripe (payment processing), Amazon Web Services (assessment infrastructure, and self-hosted AI observability where enabled), and Perplexity, Firecrawl and Apify (vendor research);
3. law enforcement or regulatory authorities where required by law.

4. Data Retention

Account information is retained for the duration of your active access and for 90 days after your account is deleted, and is then anonymised; if you ask us to erase your personal data, we do so without waiting for that period to end. Audit logs are retained for 2 years and then deleted. Session records are deleted 30 days after the session expires. In-app notifications are deleted 180 days after they are closed or read; a notification that still asks you to act is kept until that task is done. Contact privacy@omniaxis.ai to request deletion of your personal data.

Deleting your workspace. When your organisation asks us to delete its OmniAxis workspace, we archive it immediately rather than at the end of your subscription term. While it is archived, the platform lets nobody reach the data in it — not your own administrators, and not OmniAxis staff, including staff who hold platform-wide administrative access, for whom the platform makes no exception. Only OmniAxis can restore an archived workspace, and only within the first 90 days; you cannot restore it yourself. Ninety days after the archive we permanently delete the workspace and the data in it, including the database schema holding it and the files stored for it, keeping only the record that it existed, when it was archived, and when it was deleted. We hold no backup from which deleted data could be reconstituted. Archiving does not end your subscription or your payment obligations: where an annual term is paid in monthly instalments, the remaining instalments continue to fall due until that term concludes.

Evidence supporting a published rating. Where your organisation uploads a document and elects to have OmniAxis rely on it to adjust a rating in the shared platform library, we retain that document as the audit record for that rating. It is never visible to other customers or to general platform users, and within OCS it is reachable only by personnel authorised for that purpose. Like any other material you submit, it is held and processed by the providers listed in section 3, on our instructions and for no other purpose. We destroy it within 30 days of the point at which evidence from our own independent research supports that rating at the same level or higher, keeping only the record of what was held, when, and why it was released. Where no such evidence arises, we retain it for as long as the rating it substantiates remains published. This retention continues after your account closes and after your workspace is deleted, and is the one exception both to the deletion of an archived workspace described above and to the deletion right described in section 6.

5. Security

We implement industry-standard security measures including salted password hashing (scrypt), HTTPS-only access, httpOnly and secure session cookies, and session expiry controls.

6. Your Rights

You have the right to access, correct, or request deletion of your personal information. Contact privacy@omniaxis.ai to exercise these rights.

One exception applies. Where a document your organisation uploaded substantiates a rating we have published to other customers, we retain that document on the basis described in section 4, because it is the record that supports a figure others rely on. It is not disclosed to any other customer of the Service, and outside OCS it is disclosed only to the providers listed in section 3, on the terms described there. It is released on the terms stated in section 4.

7. Cookies

The Platform uses a single session cookie (httpOnly, secure) for authentication only. No third-party tracking or advertising cookies are used.

8. Contact

privacy@omniaxis.ai — Omni Cyber Solutions LLC, Casper, Wyoming, USA.

9. Changes to This Privacy Policy

OCS may update this Privacy Policy from time to time to reflect changes in our practices, in the Platform, in applicable law, or in the categories of processor we rely on. When we make a material change, we will revise the “Last updated” date above and give notice through the Platform or by email to the account administrator before the change takes effect. A change required by law, or one that addresses a security risk, may take effect immediately.

We encourage you to review this policy periodically. Continued use of the Platform after a revised policy takes effect constitutes acceptance of it. A change to this policy does not reduce the protections that already applied to personal information collected before it, and evidence retained under section 4 continues to be held on the basis stated there.