Privacy Policy

1. Who we are and when this applies

This policy explains how OmnigentAI ("OmnigentAI", "we", "us") handles personal information through the OmnigentAI platform: accounts and workspaces, AI agents and avatars, embedded conversations, lead forms and bookings, conferencing and Event Studio, Virtual Academy, and related support and agency services.

We determine how account, billing, security and service-administration information is used. When a business, agency, event host or course provider uses our tools to collect information from its visitors, attendees or students, that customer generally determines the purposes of that processing and we process it to provide the service. The customer's own privacy notice also applies. Contact that business first about its customer records; we can help identify the relevant account and assist with requests.

2. Information we collect

• Account and workspace details: name, email, username, password hash, city and country supplied at registration, organization, team roles, invitations, preferences and support correspondence.
• Conversations and customer responses: typed messages, available speech transcripts, agent replies, handoff history, contact details, form and survey answers, consent choices, appointments and related outcomes. What is collected depends on the features the business enables and what you submit.
• Content and media: uploaded documents, website sources, questions and answers, knowledge collections and search representations (embeddings); photographs, voice samples, training and consent videos; presentations, meeting recordings, transcripts, captions, translations, course materials, quiz answers and learning progress.
• Connected services: authorization tokens or API credentials you provide, selected calendars and booking resources, integration settings, delivery status and provider reference IDs.
• Payment and usage records: plan, purchases, subscriptions, credits or minutes, invoices, transaction references, amounts and payment status. Payment information entered at checkout is handled through the payment provider used for that purchase.
• Technical information: IP address, browser/device information, request and security logs, timestamps, session identifiers, feature usage and diagnostic errors. Embedded tools can attach website origin and page path to an interaction. Media calls also require network and connection information.

Information comes from you, authorized account administrators, the business whose agent or form you use, invited participants, uploaded or imported sources, connected providers and your browser. Required fields support the requested service; without them, we may be unable to create an account, respond, book an appointment or complete a payment. Optional permissions and marketing choices are separate.

3. How and why we use information

We use information to authenticate users, manage accounts and permissions, deliver agent responses and knowledge search, operate calls and media features, process forms and bookings, provide courses, fulfill purchases, measure usage, send service messages, resolve support requests, secure the platform and meet legal obligations.

Where data-protection law requires a legal basis, these activities rely on performing our contract with you; legitimate interests in running, protecting and improving the service, subject to your rights; compliance with legal duties; and consent where required, including optional permissions, cloning authorization and marketing. Customers are responsible for establishing a lawful basis for their own collection and use of visitor, attendee and student information.

AI replies and recommendations are automated outputs. They may be incomplete or wrong. The platform is not intended to make solely automated decisions with legal or similarly significant effects about people. Do not use an agent as the sole decision-maker for employment, credit, healthcare or other consequential decisions.

4. AI, voice and avatar processing

Depending on the selected feature and account configuration, relevant prompts, conversation context, approved knowledge, documents, speech or media are sent to providers such as OpenAI, HeyGen/LiveAvatar, ElevenLabs and Microsoft Azure. LiveKit and media infrastructure can carry real-time audio/video. Browser speech recognition or speech synthesis may also use your browser or operating-system provider. Microphone, camera and screen access depend on your device permissions and the feature you activate.

Knowledge imports may retain original files, extracted content, approved versions and embeddings so the agent can retrieve business information. A public website source can contain personal information; customers must have permission to import and use it. Avoid sending secrets or unnecessary sensitive information in prompts, documents or conversations.

Cloning uses a person's likeness, voice samples and consent evidence to create or manage an authorized avatar or voice. Those materials can be sensitive and may be treated as biometric data under applicable law. Authorized reviewers and the relevant cloning provider may access them to verify consent and fulfill the request. Cloning subjects must be adults and must explicitly authorize the use. Contact us to withdraw authorization and request removal; stopping future use and removing provider-held copies can require separate steps.

Provider processing, retention and any provider model-improvement practices depend on the provider, service and account configuration. This policy does not promise that every provider request has zero retention. Contact us for the arrangements relevant to your account.

5. Optional conversation memory

Where an agent offers memory, remembering a visitor requires the feature to be enabled and the visitor's opt-in. It uses a browser-held identifier and an account/agent-scoped memory record to recall a summary in later conversations. It does not require facial recognition.

Use the available forget control or contact the business to withdraw memory consent. Forgetting disables local recall; provider deletion may finish later. It does not automatically erase separate chat records, submitted forms, bookings, recordings or billing records. Clearing browser storage may remove your local identifier without deleting server records, so use the forget control before clearing it when possible.

6. Google Calendar access

A workspace administrator may optionally connect Google Calendar using Google's authorization screen. The integration requests calendar-list read access, free/busy access and calendar-event access. We use calendar IDs, names, time zones and access information to let the administrator choose a writable calendar; availability to find appointment times; and event details to create and confirm bookings. Booking details can include the attendee's name, email, appointment time and description. Google may send calendar invitations to attendees.

Authorization and refresh tokens are stored encrypted on the server so the connection can work between visits. We retain the selected resource, booking references, times and synchronization status needed to operate and troubleshoot appointments. These permissions do not grant this integration access to Gmail, Google Drive files or a Google contacts list.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use that information for the calendar and booking features you authorize, not advertising, selling data, credit decisions or training general-purpose AI models. Human access is restricted to cases permitted by that policy, such as your specific authorization, security or legal requirements.

Disconnect the integration in workspace settings to stop future use of that connection and remove its stored credentials. You can also revoke access in your Google Account permissions. Disconnecting does not delete events already in Google Calendar or independently retained appointment records. Contact us or the relevant business to request deletion of those records.

7. Forms, bookings and other integrations

When you submit a form or request human support, the business and its authorized staff receive the details you provide. A handoff can include conversation history when you agree to share it. Contact consent and optional marketing consent are distinct; requesting help or a booking does not itself authorize unrelated marketing.

Businesses can route selected events and contact details to configured services such as HubSpot, Mailchimp, Zapier, Make or a custom webhook; enable booking through Acuity or Calendly; and send notifications through SMTP/email services or Twilio. The information transferred depends on the feature, routing and consent choices. External booking pages, payment pages, broadcasts and embedded provider tools also have their own privacy notices.

The WordPress plugin, website widget and browser extension can display a business's configured agent on selected pages. Page context or selected page content may be used when you activate the relevant tool. Review extension permissions and avoid selecting confidential content.

8. Meetings, recordings and learning

In a meeting or event, your display name, messages, audio, video and shared screen may be visible or audible to other participants and authorized hosts. If enabled, recording, transcription, translation, dubbing or broadcasting sends relevant content to the configured processing, storage or streaming services. A stream to YouTube, Facebook or another destination may reach a public audience. Do not assume a call is end-to-end encrypted or that participants cannot make their own copies.

Hosts must give the required recording and AI-processing notices and obtain necessary permissions. Students' enrollment, attendance, lesson progress and quiz results may be available to the course provider and authorized staff. Course media can remain available for the course's lifetime even when ordinary event recordings expire.

9. Cookies, browser storage and tracking

The application uses session cookies for sign-in and security, and browser storage for preferences, widget display rules and optional memory. Blocking essential storage can prevent sign-in or other features from working. You can manage cookies and site data through your browser.

Some application pages, including the PHP sign-in and registration pages, load a Converstar tracking script. Loading it connects your browser to Converstar and can disclose IP address, browser/device details, page URL and referral information. That service may use cookies or similar identifiers according to its configuration and policies. Google Fonts and optional Google reCAPTCHA also receive connection information when loaded; reCAPTCHA processes information for abuse prevention. These are separate from the information you enter in a form.

The legal pages themselves load no analytics, tracking pixels or external fonts. Browser privacy settings and content controls may limit third-party requests. Where nonessential tracking requires consent under applicable law, the website operator must provide the necessary choice before enabling it; this policy is not a consent control.

10. Who receives information

We share information with authorized workspace owners, team members, agency administrators and service staff according to their roles; the providers needed for the features you use; hosting, database, email, media-storage and security providers; and payment processors such as Stripe, PayPal, Authorize.Net or the checkout platform used for your purchase. Private files or media may be stored using configured S3-compatible storage.

We may disclose information where legally required, to protect people or the service, to investigate abuse, or as part of a merger or business transfer subject to applicable safeguards. Public links, published courses and broadcasts can expose information to their intended audience. Customer-selected recipients are governed by that customer's instructions and the recipient's own practices.

11. Retention and deletion

We retain information for as long as needed for the service, the customer's instructions, security, dispute handling and applicable accounting or legal duties. Retention depends on the data and configuration:

• Accounts, business knowledge, forms, conversations, course records and uploaded originals remain while needed for the workspace or until an authorized deletion request is completed, subject to legal and operational exceptions.
• Optional avatar memory has a configurable retention period of 7–365 days, with a 30-day default.
• Event Studio's scheduled media cleanup has a configurable retention period of 1–365 days, with a 30-day default. Course-referenced media is excluded from ordinary expiry. Cleanup depends on the maintenance process completing successfully.
• Transactions, security records and records needed for legal claims can outlast account closure. Backups, queued cleanup and provider-held copies may take additional time to expire or be removed.

Closing an account, revoking a token or forgetting avatar memory does not automatically remove every independent copy. Contact us to request account or content deletion and identify the data involved. A business may need to instruct us about records it controls.

12. Security and international processing

We use measures such as password hashing, role and workspace access controls, encrypted integration credentials and protected file access. You must protect your credentials, review team access and use secure devices. No online service can guarantee absolute security.

Our customers and providers may operate in different countries, so information may be processed outside your country, where laws can differ. Applicable law may require transfer safeguards or another lawful transfer mechanism. Contact us for information about the processing locations and arrangements relevant to your account, including any required data-processing agreement.

13. Your choices and privacy rights

You can review account details, control device permissions, decline optional memory or marketing, disconnect integrations and request help with access or deletion. Depending on your location and applicable law, you may also have rights to a copy of your data, correction, portability, restriction, withdrawal of consent and complaint to a data-protection authority.

You may have a right to object to processing based on legitimate interests and to direct marketing. Send requests to the contact below. Withdrawing consent does not invalidate earlier lawful processing. We may need to verify your identity and authority, and certain records must be retained by law. We will handle requests within the periods required by applicable law. We do not require you to buy a service to exercise applicable privacy rights.

For a business's visitor, attendee or student records, contact that business first. You may contact us if you cannot identify it or need assistance. You can also complain to your local data-protection authority, such as the Nigeria Data Protection Commission or the UK Information Commissioner's Office, where relevant.

14. Children and policy updates

OmnigentAI is a business platform and is not directed to children under 13. Account owners must be adults. Course providers and event hosts must ensure age-appropriate access and any legally required parent or guardian permissions. Do not upload children's cloning materials. Contact us if you believe a child has supplied information without the required authorization.

We may update this policy as the service or legal requirements change. We will revise the date above and provide additional notice or request consent when required for a material change. Contact us below with privacy questions or requests.