Privacy Policy

Last updated: August 30, 2026

In OmniA Reply, Operated by OMNIA REPLY SAS, we protect the privacy of those who use our platform and the privacy of the individuals whose data we process on behalf of our clients. This policy explains what data we collect, for what purpose, with whom we share it, and what your rights are.

1. Our dual role

OmnIA Reply processes personal data in two distinct capacities, and it is important to distinguish between them:

• As the data controller, Regarding the data of our own customers and users: the person who creates an account, their team members, billing and platform usage.
• As the data controller, Regarding the data we process following our client's instructions: reviews from their Google Business Profile listings, WhatsApp conversations from their business account, and data from people who interact with their business. In these cases, the client is responsible, not us.

2. Data we collect

2.1. Account and billing details

• Name, email address, and profile picture, obtained from your Google account when you log in.
• Name of the organization, assigned role, and invited team members.
• Subscription and payment data are processed by Stripe. We do not store card numbers on our systems.

2.2. Google Business Profile Data

• Information about connected locations: name, address, category, and identifiers.
• Reviews: text, rating, author's public name, date, and published responses.
• OAuth tokens required to access the API on your behalf.

2.3. WhatsApp Business Platform and Meta Data

When you connect a WhatsApp Business account to OmniA Reply, we try to:

• Your WhatsApp Business Account Identifiers (WABA ID), your connected phone number (Phone Number ID), and your display name.
• Message templates, their approval status, and their delivery metrics.
• Content and metadata of messages exchanged through your account: text, attachments, timestamps, and delivery status.
• Phone numbers and profile names of people who are talking to your business.
• Access tokens issued by Meta, stored encrypted.

2.4. Usage data

• Access logs, IP address, browser type and actions performed on the platform, for security and diagnostic purposes.

3. What we use your data for

• Sync and display reviews from your locations in a unified dashboard.
• Analyze the sentiment of each review using artificial intelligence.
• Generate draft responses and publish them when you authorize it.
• Send and receive WhatsApp messages through your business account, according to the settings you define.
• Produce competitive reports and customer voice analysis.
• Create support tickets and sync them with your CRM if you connect it.
• Manage your subscription, billing, and support.
• Maintain platform security and prevent misuse.

We do not use your data or that of your customers for advertising, nor to train our own or third-party artificial intelligence models, nor do we sell them to anyone under any circumstances.

4. Use of Google data

OmniA Reply's use of the information received from Google APIs complies with the Google API Services User Data Policy, including its limited use requirements.

We access your Google Business Profile data solely to provide the contracted service. Access is granted via OAuth 2.0 with the minimum necessary permissions, and you can revoke this access at any time from the [link to Google Business Profile settings]. Google account permission settings.

5. Use of data from the Meta platform

Our use of data obtained through WhatsApp Business Platform is governed by Meta's Platform Terms and WhatsApp's Business Messaging Policy. In particular:

• We process WhatsApp data exclusively on behalf of and under the instructions of the client who owns the business account.
• We do not sell, rent, or transfer Meta platform data to data intermediaries, aggregators, or advertising networks.
• We do not use the content of the messages for advertising segmentation or to build profiles unrelated to the provision of the service.
• We do not transfer data from the Meta platform to third parties other than the subprocessors listed in section 6.
• By disconnecting the WhatsApp account, we immediately delete the access tokens and all other associated data in accordance with section 8.

6. Subprocessors and third parties

To provide the service, we rely on the following providers, each with access limited to what is strictly necessary:

Supplier	Purpose	Data processed
Railway	Backend and database hosting	All platform data
Vercel	Web application hosting	Session data and access logs
Google	Authentication and Business Profile API	Account profile, reviews, locations
Meta Platforms	WhatsApp Business Platform	Messages, numbers, account identifiers
DeepSeek	Sentiment analysis and response generation	Review text and messages
Stripe	Payment processing	Name, email, billing information
Resend	Transactional email sending	Name and email address
HubSpot	CRM synchronization, if you activate it	Contacts and tickets according to your settings

In addition to these providers, we may disclose information when legally required to do so by a competent authority, or when necessary to protect our rights or the safety of individuals.

7. International Transfers

Our providers operate servers outside of Colombia, primarily in the United States and the European Union. DeepSeek provides its service from the People's Republic of China.

Where required by applicable regulations, these transfers are covered by standard contractual clauses or other appropriate guarantee mechanisms signed with each supplier. You can request information about applicable guarantees by writing to privacidad@omniareply.com.

8. Storage and disposal

We retain your data while your account is active. After cancellation or a deletion request, we delete it from our production systems within a maximum of 30 days, and of the backups within a maximum period of 90 days.

Billing records are kept for the period required by Colombian tax legislation, even after the rest of the account is removed.

You can find the detailed procedure on our page. data deletion.

9. Security

• Encryption in transit using HTTPS on all services.
• Encryption at rest of Google, Meta, and HubSpot access tokens.
• Passwords stored with one-way hash functions.
• Role-based access control within each organization.
• Restricted access to the database and registration of administrative operations.

No system is completely invulnerable. If we detect a security breach affecting your data, we will notify you and the appropriate authorities within the timeframes stipulated by applicable law.

10. Your rights

You can exercise at any time the rights of access, rectification, updating, deletion, opposition, limitation and portability, as well as revoke the consents given.

Write to us at privacidad@omniareply.com From the email address associated with your account. We respond within a maximum of 15 business days. If you believe we did not handle your request correctly, you can file a complaint with the Superintendency of Industry and Commerce of Colombia or with the data protection authority in your country of residence.

11. Minors

OmnIA Reply is a service for businesses. It is not intended for individuals under 18, and we do not knowingly collect data from minors. If we discover that we have done so, we will delete it.

12. Changes to this policy

We may update this policy. We will notify you by email at least 15 days in advance of any substantial changes, and we will always update the header date.

13. Contact

OMNIA REPLY SAS · [FULL ADDRESS], Colombia
Privacy: privacidad@omniareply.com
Legal matters: legal@omniareply.com
Medium: soporte@omniareply.com