OmnioChat Privacy Policy

How OmnioChat collects, uses, shares and deletes personal data, including data received from WhatsApp, Messenger and Instagram.

Version 1.0 · effective 8 August 2026. Previous versions are available on request from legal@aa-labs.co.

This Privacy Policy explains how A & A Labs (Private) Limited (“we”, “us”) handles personal data in connection with OmnioChat, our unified business messaging inbox available at https://omniochat.com.

1. Two different roles — read this first

OmnioChat is sold to businesses. That means the same product handles two very different kinds of personal data, and our legal responsibility differs for each. The rest of this policy is easier to follow once this distinction is clear.

Whose data	Example	Our role
Customer data — the business that subscribes to OmnioChat and its team members	An agency signs up; its owner and five agents create accounts	Controller. We decide why and how this data is processed.
End-user data — the people who message that business	A shopper WhatsApps the agency’s client about an order	Processor. The business is the controller; we process on its documented instructions under our Data Processing Addendum.

If you messaged a business and want your conversation deleted, that business controls it. We will help — see Your rights — but we will normally act through, or notify, the business you contacted.

2. What we collect

2.1 Account and customer data (we are the controller)

Account details — name, work email address, hashed password, job role, team membership, and the workspace (“tenant”) you belong to.
Authentication data — session records, login timestamps, IP address and user agent recorded for security, and invitation tokens.
Billing data — subscription plan, billing status, invoice history and payment identifiers. We never receive or store full card numbers. Card details are entered directly with the payment provider you check out through and are held by them, not by us.
Channel credentials — the access tokens and account identifiers you supply when you connect a WhatsApp number, Facebook Page, Instagram business account or online store. These are encrypted at rest and are never returned to the browser or included in any export.
Configuration — your labels, canned replies, automation rules, knowledge-base documents, message templates, notification preferences and AI provider settings.
Usage and diagnostics — feature usage counters, message volume against plan limits, audit-log entries for administrative actions, and application error logs.

2.2 End-user data (we are the processor)

When you connect a channel, OmnioChat receives and stores the conversations that flow through it so your team can work them from a shared inbox:

Message content — the text, images, audio, video, documents, stickers and location pins exchanged between the end user and your business.
Message metadata — platform message ids, timestamps, direction, and delivery/read status.
Contact records — the end user’s phone number or platform-scoped id, display name and profile picture as provided by the platform, plus any notes, tags, custom fields or segment membership your team adds.
Commerce context — where you connect Shopify or WooCommerce, the customer, order and cart records we sync so an agent can see them beside the conversation.
Lead and campaign data — records created by your forms, campaigns and automations.

We do not decide what is said in these conversations, who is contacted, or how long you keep them beyond the limits in section 7. You do.

2.3 Data we receive from Meta

OmnioChat integrates with the WhatsApp Business Platform, Facebook Messenger and Instagram. With your authorisation, we receive from Meta only what those integrations require:

Permission	What we receive	Why
`whatsapp_business_messaging`	Inbound and outbound WhatsApp messages and their delivery statuses	To show conversations in your inbox and send your replies
`whatsapp_business_management`	Connected phone numbers, WABA details, approved message templates	To let you pick a number and send approved templates
`pages_messaging`	Messenger conversations for Pages you connect, and sender-scoped ids	To deliver Messenger threads into the shared inbox
`pages_show_list`	The list of Pages you administer	So you can choose which Page to connect
`pages_read_engagement`	Page profile data and engagement on your own posts	To show context beside conversations and report on published posts
`pages_manage_posts`	Write access to publish posts you compose in OmnioChat	To publish and schedule your Page posts
`instagram_basic`	Your connected Instagram business account and its profile	To identify the account being connected
`instagram_manage_messages`	Instagram Direct messages for that account	To deliver Instagram DMs into the shared inbox and send replies
`instagram_content_publish`	Write access to publish media you compose in OmnioChat	To publish and schedule your Instagram posts
`business_management`	Which Business Manager assets the connecting user may link	To resolve permissions correctly during connection

Our commitments on Meta platform data. In line with the Meta Platform Terms, the WhatsApp Business Messaging Policy and the Developer Policies, we:

use platform data only to provide and improve the OmnioChat features you have enabled;
never sell, rent or license platform data;
never use it for advertising — including ad targeting, ad measurement, building audiences, or determining eligibility for anything;
never transfer it to data brokers, ad networks, information resellers or monetisation partners;
never use it to build a profile of a person for any purpose other than serving the business they contacted;
never use message content to train general-purpose or third-party AI models (see section 5);
encrypt it in transit and at rest, and delete it on request or when it is no longer needed for the purpose above.

2.4 Data we do not collect

Payment card numbers, CVVs or bank credentials.
Special-category data (health, biometrics, religion, political opinion and similar) as a deliberate collection. If such data appears inside a message your customers send you, we process it only as message content on your instructions.
Data from anyone under 16. OmnioChat is a business tool and is not directed at children.

3. How we use data, and our legal basis

Purpose	Data used	Legal basis (UK/EU GDPR)
Providing the inbox, publishing and automation features	Account data, channel credentials, conversation data	Performance of a contract (Art. 6(1)(b)); for end-user data, processing on the controller’s instructions (Art. 28)
Billing, invoicing, tax and dunning	Account and billing data	Contract and legal obligation (Art. 6(1)(b), (c))
Security, abuse prevention, rate limiting and audit logging	Authentication data, IP address, audit logs	Legitimate interests (Art. 6(1)(f)) — keeping the service secure
Support, incident response and debugging	Account data, error logs, and — with your permission — specific records	Contract and legitimate interests
Service notices, security alerts and billing emails	Account contact details	Contract and legitimate interests
Product marketing to business contacts	Work email address	Consent, or legitimate interests where permitted; unsubscribe in any email
Aggregate product analytics and capacity planning	Usage counters that identify no individual	Legitimate interests

We do not sell personal data. We share it only in these situations:

Within your workspace. Conversations and contacts are visible to the members of your tenant according to their role. Owners and administrators can see all conversations in the workspace; agents see conversations assigned to them or ones they participate in.
Sub-processors. Vendors that process data on our behalf under written contract — hosting, storage, email delivery, payments and similar. The current list, with the purpose and location of each, is published at OmnioChat Sub-processors.
The messaging platforms. Sending a reply necessarily transmits it to Meta (WhatsApp, Messenger, Instagram) for delivery, under their own terms.
AI providers you configure. See section 5.
Legal requirements. Where we must comply with a valid legal process. We will notify the affected customer unless legally prohibited.
Corporate transactions. In a merger, acquisition or asset sale, subject to the acquirer honouring this policy. You will be notified before any transfer.

5. AI features

OmnioChat includes optional AI features: suggested replies, automated chatbots and retrieval over a knowledge base you build. How your data is handled depends on how you configure them.

You bring your own provider. In the normal configuration you supply credentials for an OpenAI-compatible AI provider. Prompts, retrieved knowledge-base passages and relevant conversation context are sent to that provider under your agreement with them. We are not a party to it; check their retention and training terms.
Platform embeddings fallback. If a workspace has no working embedding provider configured, we may index knowledge-base documents using a platform-level embedding service so search still functions. This affects documents you upload to a knowledge base — not conversation content. It can be avoided entirely by configuring your own provider, and the provider currently used is named in the sub-processor list.
No training on your data. A & A Labs (Private) Limited does not use your messages, contacts or knowledge-base content to train, fine-tune or evaluate any AI model of ours or anyone else’s.
Automated decisions. AI features draft and suggest; they do not make decisions with legal or similarly significant effects about any individual.

6. International transfers

OmnioChat is operated from cloud infrastructure that may be located outside your country, and our sub-processors operate globally. Where personal data leaves the UK, EEA or another region with transfer restrictions, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with technical measures including encryption in transit and at rest. Our hosting region, and the location of every other sub-processor, is listed in the sub-processor list.

7. How long we keep data

Data	Retention
Conversations, messages, media and contacts	For as long as your workspace is active, or until you delete them. You control this; we do not impose an expiry.
After you close your account	Deleted within 30 days of closure. The grace period exists so an accidental closure can be reversed.
Verified deletion requests	Actioned within 30 days.
Encrypted backups	Rotated out within 90 days. Deleted records are not restored to live systems if a backup is ever used.
Application and security logs	90 days.
Invoices and payment records	7 years, as tax and accounting law requires.
Channel access tokens	Destroyed immediately when a channel is disconnected.

8. Security

All traffic is served over TLS. Data is encrypted at rest by the underlying storage, and channel credentials receive an additional layer of application-level encryption.
Passwords are stored as salted hashes and are never recoverable in plaintext.
Workspaces are isolated: every query is scoped to the tenant, and inbound messages that cannot be matched to an active channel are quarantined rather than filed under an arbitrary account.
Access within OmnioChat is role-based (owner, administrator, agent) and administrative actions are recorded in an audit log.
Webhook deliveries from Meta and from payment providers are rejected unless their signature verifies.
Staff access to production data is limited to those who need it for support or incident response, and is logged.

Our full security posture is described at Security Practices. Report a vulnerability to security@aa-labs.co. We will acknowledge a qualifying breach to affected controllers without undue delay and, where required, within 72 hours of becoming aware of it.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to receive it in a portable format, and to withdraw consent. Under the CCPA/CPRA you may also request disclosure of the categories of personal information collected and opt out of “sale” or “sharing” — we do neither, so there is nothing to opt out of. We will not discriminate against you for exercising a right.

If you have an OmnioChat account, most rights can be exercised in the app, or by writing to privacy@omniochat.com.
If you messaged a business that uses OmnioChat, contact that business first — they control the conversation. You may also write to us and we will route the request and assist the business in fulfilling it.
To delete your data, follow the Data Deletion Instructions or use the deletion request form.

We respond within 30 days and may need to verify your identity first. If you are in the UK or EEA and are unhappy with our response, you may complain to your local supervisory authority.

You can revoke OmnioChat’s access at any time, independently of anything you ask us to do:

Facebook → Settings & privacy → Settings → Apps and Websites → select OmnioChat → Remove.
Instagram → Settings → Website permissions → Apps and websites → OmnioChat → Remove.
WhatsApp Business → Meta Business Suite → Business settings → WhatsApp accounts → remove OmnioChat’s access to the number.

Revoking access stops any further data flow immediately. It does not by itself delete data we already hold — request that through the deletion instructions. When Facebook notifies us that you have removed the app, our automated deletion callback records the request and returns a confirmation code you can use to track it.

11. Cookies

The OmnioChat application uses strictly necessary cookies only: a session cookie to keep you signed in and a CSRF token to protect form submissions. It sets no advertising or cross-site tracking cookies. Cookies on this marketing website are described in the Cookie Policy.

12. Children

OmnioChat is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, write to privacy@aa-labs.co and we will delete it.

13. Changes to this policy

We will post any change here with a new version number and effective date. For material changes affecting how we use personal data, we will notify account owners by email at least 30 days before the change takes effect. Superseded versions are available on request.

14. Contact us

Controller: A & A Labs (Private) Limited, registered number 0355145, Pakistan.
Privacy enquiries: privacy@omniochat.com
Data protection contact: dpo@aa-labs.co
Security: security@aa-labs.co