Privacy policy

1. Who is responsible

Omniio is operated by Marco Lorenzo Qureshi Grima, a sole trader established in Malta, trading as Omniio (a LimitBreakIT product). VAT Reg No 3297-8402, registered as exempt under article 11 of the Value Added Tax Act (Malta).

That operator is the data controller for the personal data described here. There is no statutory requirement for us to appoint a data protection officer; questions go to sales@omniio.dev and are answered by the operator.

2. What we collect

• Account data — your email address, your name if you give one, a hash of your password, and the date you signed up. Needed to have an account at all.
• Upstream credentials — API tokens you paste in and OAuth tokens issued to us by servers you authorise. Encrypted with AES-256-GCM before storage, decrypted only in memory to make the call you asked for.
• Tool-call records — for each call your agent makes: the server, the tool, the arguments sent and the result returned, how long it took, and whether it succeeded. This is the audit trail you see in the app.
• Usage counts — the number of billable calls your account makes each calendar month. A single number per month, kept for billing.
• Subscription details — if you take a paid plan, the identifiers Stripe gives us for your customer record and subscription, its status, and the date the current period ends. We hold no card number, expiry or security code; those exist only at Stripe.
• Messages you send us — what you write in the support, server-request and sales forms, plus the address to reply to and a salted hash of your IP address used only to rate-limit those forms.
• Analytics — only if you accept it. See cookies.

Arguments and results are whatever your agent sends and receives. If your agent puts personal data into a tool call, that data is in the audit record until it is pruned. Nothing else is inspected or mined.

3. Why we have it, and on what basis

• To run the service — account data, credentials and tool calls. Necessary to perform our contract with you (GDPR art. 6(1)(b)).
• To bill and to enforce plan limits — usage counts. Contract, and our legitimate interest in being paid (art. 6(1)(b) and (f)).
• To keep the service secure — rate-limit hashes, error logs. Legitimate interest in preventing abuse (art. 6(1)(f)).
• To answer you — what you write to us. Contract, or our legitimate interest in replying (art. 6(1)(b) and (f)).
• Analytics and advertising measurement — your consent, and nothing happens until you give it (art. 6(1)(a)). You can withdraw it at any time.

4. How long we keep it

• Tool-call records: 7 days. A scheduled job deletes anything older every night. This is not configurable, and we cannot recover a call after it is pruned.
• Credentials: until you disconnect the server or delete your account, whichever comes first.
• Account data: for as long as you have an account. Deleting your account deletes it, along with your library, your credentials and your logs.
• Usage counts and invoicing records: kept while the account exists, and afterwards only as long as tax law requires.
• Form submissions: up to 24 months, so we have the history of a conversation we may still be having.

5. Who else processes it

We use a small number of processors, each for one job. We do not sell personal data, and we do not share it for anyone else’s marketing.

• Vercel Inc. — hosting and content delivery for the application and the MCP endpoint.
• Neon Inc. — the managed PostgreSQL database everything above is stored in.
• Stripe Payments Europe Ltd — takes payment for paid plans. If you subscribe, Stripe receives your email address, your billing name and address, your card details and the monthly count of MCP calls your account made, which is what its meter bills the overage from. Card details go to Stripe directly from its own checkout page and never reach us. Stripe is an independent controller of the payment data it holds for its own legal and fraud-prevention obligations, and its privacy policy applies to that.
• Our email provider — delivers the notification when you submit a form, and our reply.
• Google Ireland Ltd (Google Analytics) and Meta Platforms Ireland Ltd (Meta Pixel) — only after you accept analytics cookies.

Separately, when you switch on an upstream MCP server and your agent calls one of its tools, we send that call to the server’s operator. That is the point of the service, and it happens only for servers you enabled. Those operators are independent controllers of what they then do with it; their own terms and privacy notices apply.

6. International transfers

Some of these providers are established in, or process data in, the United States. Where personal data leaves the European Economic Area, it is transferred under the European Commission’s standard contractual clauses or an adequacy decision covering the provider. Upstream MCP servers you enable may be located anywhere; which ones you use is your choice, and each server’s endpoint is shown in the library before you switch it on.

7. Your rights

Under the GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what was done before.

Email sales@omniio.dev and we will answer within one month. Most of it you can also do yourself: the dashboard shows your audit trail, disconnecting a server deletes its credential, and account deletion removes everything.

If you think we have handled your data badly, please tell us first — but you are entitled to complain to the Office of the Information and Data Protection Commissioner in Malta (idpc.org.mt) or to the supervisory authority where you live.

8. Security

Traffic is encrypted in transit. Upstream credentials are encrypted at rest with AES-256-GCM under a key held only in the deployment’s environment, never in the database or in this repository. Every query for your data is scoped to your account, and the endpoint refuses a call it cannot attribute to a signed-in user.

No system is perfect. If a breach affects your personal data and is likely to put you at risk, we will tell you and the Office of the Information and Data Protection Commissioner within the deadlines the GDPR sets.

9. Children

Omniio is a developer tool and is not directed at children. We do not knowingly collect data from anyone under 16; if you believe we have, write to us and we will delete it.

10. Changes

The date at the top says when this policy last changed. If a change materially affects how we use your data, we will email the address on your account before it takes effect.