Privacy Policy

OmniReach is operated by Omni Cyber Solutions LLC, a company registered in the United States. We provide a multi-tenant AI-driven B2B revenue growth platform that automates outbound sales outreach, account research, opportunity qualification, and meeting creation on behalf of our customers (each a "Tenant").

For questions about this policy or to exercise your privacy rights, contact our Privacy Officer at: privacy@omnicybersolutions.com

• Tenant — a business entity that has subscribed to OmniReach and whose authorised users access the Platform.
• Tenant User — an individual employee or contractor of a Tenant who has been granted a login to the Platform.
• Prospect Data — information about third-party individuals and companies that Tenants upload to, or that the Platform researches on behalf of, a Tenant for the purpose of B2B sales outreach.
• Connected Account Data — data retrieved via OAuth integrations (e.g. Gmail, Google Calendar, Microsoft 365, LinkedIn) that a Tenant User has explicitly authorised.
• Platform Data — aggregated, de-identified, or non-personal data generated by use of the Platform, used to operate, secure, and improve the service.

We use personal data for the following purposes:

• Service Delivery: Operating the Platform, executing AI workflows, sending outreach communications, scheduling meetings, and synchronising data with connected applications as instructed by the Tenant.
• Account Management: Creating and managing accounts, authenticating users, processing subscription payments, and providing customer support.
• Security and Fraud Prevention: Detecting and preventing unauthorised access, abuse, or security incidents.
• Legal Compliance: Meeting our obligations under applicable laws, including data protection, anti-spam, and telecommunications legislation.
• Platform Improvement: Using aggregated and de-identified data to improve AI model performance and product features. We will never use individually identifiable Google user data for this purpose.
• Communications: Sending service notifications, security alerts, and (with consent) product updates. We do not use your data for third-party advertising.

Where applicable data protection law (including the GDPR and applicable US state privacy laws) requires a legal basis, we rely on:

• Contract: Processing necessary to perform our contract with the Tenant (e.g. operating the Platform and delivering the service).
• Legitimate Interests: Security monitoring, fraud prevention, and aggregated analytics, where our interests are not overridden by individual rights.
• Consent: Where you explicitly connect a third-party OAuth account or opt in to specific features. You may withdraw consent at any time.
• Legal Obligation: Compliance with applicable laws and regulatory requirements.

For B2B prospect outreach, Tenants are the data controllers and are responsible for establishing a lawful basis (typically legitimate interests for B2B contact) under applicable law. OCS acts as a data processor for Prospect Data.

We do not sell your personal data. We may share data as follows:

We retain data for as long as necessary to provide the service and meet our legal obligations:

• Account and Tenant Data: Retained for the duration of the subscription plus 90 days after termination to allow for data export, then permanently deleted.
• Prospect Data:Retained for the duration of the Tenant's subscription. Tenants may request deletion of specific records at any time.
• Connected Account (OAuth) Tokens: Deleted immediately upon disconnection. You can revoke access at any time via your Google Account settings at myaccount.google.com/permissions.
• Audit Logs: Retained for 12 months for security and compliance purposes.
• Backups: Database backups are retained for 30 days and then purged.

To request deletion of your account or data, email privacy@omnicybersolutions.com. We will process deletion requests within 30 days.

OmniReach's access to Gmail and Google Calendar is governed by the Google API Services User Data Policy. The following limited use commitments apply:

• We only request access to Google user data that is necessary for the features you explicitly enable within the Platform.
• We do not use Gmail or Google Calendar data to develop, improve, or train generalised AI or machine learning models.
• We do not allow any human to read your Gmail or Google Calendar data except: (a) with your express permission, (b) as necessary for security or abuse investigation, or (c) as required by applicable law.
• We do not use or transfer Google user data for advertising purposes.
• We do not sell Google user data or use it for any purpose other than providing and improving the specific feature you connected.
• You may revoke OmniReach's access to your Google account at any time via myaccount.google.com/permissions.

We implement technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Encrypted storage of all third-party API credentials and OAuth tokens
• HMAC-signed OAuth state parameters to prevent CSRF attacks
• JWT-based authentication with short-lived access tokens
• Role-based access control with tenant isolation enforced at every database query
• Structured audit logging of all significant platform actions
• Regular security reviews and penetration testing

Despite these measures, no system is completely secure. In the event of a data breach affecting your rights, we will notify you and relevant authorities as required by applicable law, within 72 hours where mandated by the GDPR.

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your personal data (subject to legal retention obligations).
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Disconnect OAuth integrations at any time within the Platform settings.

To exercise any right, contact privacy@omnicybersolutions.com. We will respond within 30 days. We may require identity verification before fulfilling requests.

If you are in the EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority.

OCS is based in the United States. If you are accessing the Platform from outside the United States, your data may be transferred to and processed in the United States or other countries where our infrastructure providers operate. We ensure appropriate safeguards are in place for any such transfers, including standard contractual clauses approved by the European Commission where required for EU/EEA data.

The Platform uses session cookies strictly necessary for authentication and security. We do not use advertising cookies, tracking pixels, or third-party behavioural analytics cookies. You may disable cookies in your browser, but this will prevent you from logging in to the Platform.

The Platform is designed for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will delete it promptly.

OmniReach includes built-in anti-spam controls to assist Tenants in complying with applicable laws including the CAN-SPAM Act (USA), GDPR (EU/EEA), CCPA (California), and CASL (Canada). Tenants are responsible for ensuring their outreach campaigns comply with all applicable laws in their jurisdiction. OCS provides suppression list management, unsubscribe handling, and quiet hours enforcement, but Tenants retain legal responsibility for the content and targeting of their campaigns.

If you are a resident of California, Virginia, Colorado, Connecticut, or another US state with applicable consumer privacy law, you may have additional rights including: the right to know what personal information we collect; the right to delete personal information; the right to opt out of the sale of personal information (we do not sell personal information); and the right to non-discrimination for exercising your rights.

Note that OmniReach is a B2B platform and personal data processed through the Platform primarily relates to individuals acting in a professional business capacity. Exemptions applicable to business-to-business communications under applicable state privacy laws may apply.

To exercise any applicable rights, contact privacy@omnicybersolutions.com.

We may update this Privacy Policy from time to time. Material changes will be notified to Tenant administrators by email and via an in-platform notice at least 14 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy. The "Last updated" date at the top of this page indicates the most recent revision.

For privacy-related enquiries, data subject requests, or complaints: