This Privacy Policy explains how OmevAI collects, uses, discloses and retains personal data when you visit OmevAI websites, contact us, create or administer an account, use an API, dashboard or connector, purchase access, or connect OmevAI through an approved partner (collectively, the Service).
Privacy questions and rights requests may be sent to [email protected].
Important Customer Content notice: OmevAI uses Customer Content, including inputs and outputs, to train, evaluate, test and improve models and related service systems. This is mandatory and has no customer opt-out. Self-service users must not submit personal data in Customer Content. Enterprise personal-data processing requires prior manual approval, NDA and DPA.
See the AI and Customer Content Terms for the full content rules.
1. Scope and roles
This Policy applies to OmevAI-controlled websites and services, including omev.be, llmapi.omev.be, usage.omev.be, cabinet.omev.be, and successor or replacement interfaces that link to this Policy.
OmevAI generally acts as a controller for:
- website, inquiry, account, authentication, billing-administration, usage, security and support data;
- product analytics and service-improvement data; and
- personal data, if any, that OmevAI uses for its independently determined purpose of general model training, evaluation and improvement.
For an approved Enterprise use case, OmevAI may act as a processor when handling agreed personal data solely on the Enterprise customer's documented instructions to deliver the Service. That processing is governed by a signed Data Processing Addendum. Roles are purpose-specific: the DPA does not cover OmevAI's separately disclosed independent-controller training purpose.
Creem acts as an independent controller and Merchant of Record for checkout, payment, invoicing, indirect tax, refunds and its customer portal. See the Creem Privacy Notice.
An Authorised Integration Partner generally acts independently for its own platform. Its privacy notice governs information it collects or handles through its interface.
2. Personal data we collect
2.1 Website and inquiry data
We may collect:
- pages viewed, referring page, approximate location derived from IP, device/browser information and cookie identifiers;
- information submitted through inquiry, waitlist, demo or contact forms, such as business email, name, company, website, expected volume and intended AI uses; and
- communications and support history.
Forms may be delivered by a third-party form platform. Website analytics and non-essential tracking are governed by the Cookie Policy.
2.2 Account and organisation data
We may collect:
- business email, display name, organisation and role;
- project, site and workspace labels;
- team membership, permissions and invitations;
- language and account preferences;
- Terms and policy acceptance records; and
- account state, entitlement and integration status.
2.3 Authentication and security data
We may collect:
- hashed session and login tokens;
- authentication method, magic-link or one-time-code events;
- Google sign-in identifiers and basic profile information when that option is selected;
- IP address, user agent, request time and security/audit events; and
- API-key alias, last characters, hash, creation, use, rotation and revocation metadata.
OmevAI does not need to store a reusable plaintext API key after secure issuance. Do not send a full credential in a support request.
2.4 Customer Content
Customer Content may include prompts, messages, files, URLs, uploaded connector data, saved inputs, generated outputs and request parameters. OmevAI may log the full request and response for service operation and mandatory training/improvement.
Self-service Customer Content must contain no information about an identified or identifiable natural person. Enterprise Customer Content may contain only personal-data categories expressly approved under a signed DPA and remains subject to the absolute prohibitions in the AI and Customer Content Terms.
2.5 Usage, metering and service telemetry
We may collect:
- request and event identifiers;
- date/time, endpoint, task class, product tier and project;
- input, output, cached, reasoning and total token or task counts;
- latency, response status, error and retry/fallback events;
- entitlement, balance, overage and tariff information; and
- coarse geography, IP address and user agent for a limited period.
Internal model, provider, routing, margin and cost information is not customer profile data and is not exposed through customer-facing records except where law requires disclosure.
2.6 Connector and dashboard data
When you choose a connector or upload workflow, we may receive information you select from services such as Google Search Console or Google Analytics, including site properties, query/page metrics and text exported through your browser. We also store saved analysis inputs and results where the feature provides saved runs.
Your use of the third-party connector remains subject to that provider's terms and privacy notice.
2.7 Purchase and billing-administration data
Creem collects payment-card or bank information directly. OmevAI may receive or store limited transaction information needed to provision and support the Product, such as:
- customer and order identifiers;
- business email and billing country;
- Product, amount, currency, tax status and invoice reference;
- subscription, renewal, cancellation, refund and chargeback state; and
- correlation and integration-partner attribution.
OmevAI does not receive or intentionally store full payment-card credentials.
2.8 Partner-integration data
When you connect through an Authorised Integration Partner, we may collect the partner identifier, partner workspace/account reference, acceptance evidence, connection state and correlation identifiers. At your direction, we may transmit a newly issued API key and limited entitlement status to the partner so that it can operate the integration for you.
The partner may see Customer Content that you enter or generate through its interface independently of OmevAI.
3. Sources of personal data
We obtain information:
- directly from you and your organisation;
- automatically from your browser, device, API client and use of the Service;
- from an administrator or authorised user in your organisation;
- from Creem about the state of a purchase;
- from an Authorised Integration Partner at your direction;
- from a Google or other connector you select; and
- from service providers that return inference, security, delivery or analytics information.
4. Why we use personal data and legal bases
Where the GDPR or a similar law requires a legal basis, we rely on the following:
| Purpose | Typical data | Legal basis |
|---|---|---|
| Create and administer accounts, authenticate users, deliver purchased functionality and provide support | Account, organisation, authentication, entitlement and communications | Performance of a contract; steps requested before contract |
| Process purchases and coordinate fulfilment with Creem | Order, transaction state, tax/business status and entitlement | Performance of a contract; legal obligations; legitimate interests in administering sales |
| Secure the Service, prevent fraud/abuse, enforce Terms and maintain audit trails | IP, user agent, authentication, API-key, event and security data | Legitimate interests in security and service integrity; legal obligations where applicable |
| Meter usage, calculate balances, reconcile charges and provide reports | Request metadata, token/task counts, tariffs, subscription and project data | Performance of a contract; legitimate interests in accurate operations and dispute prevention; legal obligations for financial records |
| Respond to inquiries and improve acquisition | Form, contact and communication data | Requested pre-contract steps; legitimate interests; consent where required for marketing |
| Analyse website performance | Cookie/device and usage data | Consent where required; otherwise legitimate interests subject to applicable opt-out rights |
| Operate, evaluate, train and improve models and related systems | Customer Content, outcomes, quality and telemetry | Contractual authorisation for non-personal Customer Content; for personal data in an approved Enterprise use case, OmevAI's legitimate interests following necessity and balancing assessment, subject to data-subject rights |
| Comply with law and protect legal claims | Relevant account, transaction, communication and audit data | Legal obligation; legitimate interests in establishing, exercising and defending claims |
We do not characterise general model improvement as necessary to perform every individual request under GDPR Article 6(1)(b). Where personal data is involved, the intended basis is legitimate interests, supported by a documented assessment of purpose, necessity, reasonable expectations, safeguards and impact. If that basis is unavailable for a proposed Enterprise use case, OmevAI will not activate that use case.
5. Mandatory training and statutory objections
There is no product-level or Customer contractual opt-out from use of Customer Content for model training and improvement. A Customer that rejects that use is not eligible for the Service.
This does not eliminate a data subject's non-waivable legal rights. Where OmevAI relies on legitimate interests, an individual may object based on their particular situation. OmevAI will assess the request and stop the relevant processing unless it demonstrates compelling legitimate grounds that override the individual's interests, rights and freedoms, or needs the data for legal claims.
The self-service prohibition on personal data substantially reduces this issue. Enterprise customers must provide legally required notices and ensure their disclosed use case is compatible with OmevAI's mandatory training purpose.
6. How we disclose data
We may disclose data to:
- cloud hosting, storage, database, content-delivery, security and monitoring providers;
- AI inference, evaluation and model-service providers;
- authentication, email, form, analytics and support providers;
- Creem for purchase and entitlement coordination;
- an Authorised Integration Partner at your direction;
- professional advisers, auditors, insurers and transaction advisers under confidentiality duties;
- authorities or other persons where legally required or necessary to protect rights and safety; and
- a successor in a merger, financing, reorganisation or transfer of the relevant business, subject to appropriate safeguards.
The public category/region map is available at Subprocessors and Data Transfers. Confidential inference-provider identities, model selection, routing priority, volumes and economics are not disclosed to self-service users. A manually approved Enterprise customer receives the legally required named subprocessors in its confidential DPA annex before activation.
We do not sell personal data for money. We do not use personal data for cross-context behavioural advertising. Where a US state law defines sale or sharing more broadly, you may contact us to exercise an applicable opt-out right.
7. International data transfers
OmevAI and its providers may process data in the EEA, the United States and Asia-Pacific. A request may be routed through more than one region for inference, validation, reliability or security.
Where the GDPR restricts a transfer, the intended safeguards include an adequacy decision where available, the European Commission's Standard Contractual Clauses, and supplementary contractual, organisational and technical measures appropriate to the transfer. An Enterprise DPA identifies the applicable mechanism and potential subprocessor locations for the approved use case.
Do not use self-service Customer Content to send personal data across borders. Enterprise processing will not be activated until the transfer assessment and required contracts for that use case are complete.
8. Retention
We retain information only for the period reasonably necessary for the stated purpose, subject to these principal rules:
| Data | Typical retention rule |
|---|---|
| Raw Customer Content and copies in training/evaluation datasets | No more than 24 months, then deletion or irreversible anonymisation |
| Irreversibly anonymised data, aggregate metrics and non-extractable trained parameters | Until the relevant model/system is retired or the material is no longer useful |
| Request metadata without prompt/response content | Generally 13 months online; longer only where incorporated into a required financial, security or audit record |
| IP address, user agent and coarse location in routine web/usage telemetry | Generally no more than 90 days unless a security investigation or legal hold requires longer |
| Active web session cookie | 12 hours for the usage cabinet; OAuth state only until the sign-in flow completes |
| Account and organisation records | While active and afterwards for the applicable claims, fraud-prevention and recordkeeping period |
| Transaction, tariff, ledger, invoice-reference and financial audit records | Generally 7 years where retained by OmevAI; Creem applies its own retention rules to payment records |
| Generated export file | Generally 24 hours; export audit metadata generally 1 year |
| Inquiry and support records | While the matter is active and then for a reasonable claims, security and service-improvement period |
| Terms acceptance evidence | For the contract term and applicable limitation/claims period |
Deletion from an active system may be followed by deletion from encrypted backups on the normal rotation schedule. A legal hold, security investigation or mandatory recordkeeping duty may temporarily extend retention of a restricted copy.
Completed training cannot always be technically reversed. OmevAI may retain a model artefact only when the source personal data cannot reasonably be extracted or reconstructed from it. If personal data remains reasonably identifiable or extractable, the artefact is not treated as anonymous merely because it is a model.
9. Security
OmevAI uses administrative, technical and organisational safeguards designed for the nature of the Service, including access controls, credential hashing, encrypted transport, tenant and role restrictions, audit logging, key rotation and restricted provider access.
No system is completely secure. You are responsible for securing your devices, partner workspace and credentials and for not submitting prohibited information. Report a suspected incident to [email protected] without including the compromised secret itself.
10. Your privacy rights
Depending on the law and OmevAI's role, you may have the right to:
- request access to and a copy of your personal data;
- correct inaccurate data;
- request deletion;
- restrict processing;
- object to processing based on legitimate interests or to direct marketing;
- receive portable data you provided where applicable;
- withdraw consent for future processing where consent is the basis; and
- complain to a competent data-protection authority.
Send a request to [email protected]. Specify your relationship with OmevAI, account email and the right requested. Do not send identity documents unless we request a proportionate verification method.
If OmevAI processes data solely for an Enterprise customer, we may refer the request to that customer and assist it under the DPA. We may deny or limit a request where law permits, including where identity cannot be verified, data is not reasonably identifiable, another person's rights would be harmed, or retention is legally required. We will explain the applicable reason.
You may use an authorised agent where applicable law permits, subject to verification of authority. We will not discriminate for exercising an applicable privacy right.
11. Automated processing
OmevAI automatically classifies requests, selects providers, validates outputs, detects abuse and calculates usage. These processes concern service operation and are not intended to make a decision producing legal or similarly significant effects about a natural person.
The Acceptable Use Policy prohibits customers from using OmevAI as the sole or determinative basis for high-impact decisions about individuals.
12. Children
The Service is for professional users aged 18 or older. It is not directed to children, and Customer Content may not contain data about a person under 18. Contact us if you believe such data was submitted.
13. Cookies and similar technologies
We use essential technologies for security, authentication and preferences and may use analytics only under the consent/opt-out rules described in the Cookie Policy. You can change available choices through the cookie settings link on the website.
14. Third-party links and services
This Policy does not govern Creem, an Authorised Integration Partner, Google or another independently controlled site or service. Review that provider's notice before giving it information. A link or integration does not make OmevAI responsible for the provider's independent processing.
15. Changes
We may update this Policy to reflect legal, product or processing changes. We will post the updated version and date. We will provide reasonable advance notice of a material adverse change where practicable and obtain a new consent where law requires it.
16. Contact and complaints
Controller contact: OmevAI
Email: [email protected]
You may also complain to the data-protection authority in the country where you live, work or believe a violation occurred. We encourage you to contact us first so we can investigate.