OmniGolem Privacy Policy
Effective date: 19 September 2026 · Last updated: 4 October 2026
OmniGolem ("OmniGolem", "we", "us") is operated by Octane Labs, a sole proprietorship registered in Singapore (UEN 53458905K) and owned by Chen Shengxi, with its principal place of business at 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051.
This policy covers three groups:
- Visitors to omnigolem.com, including people who join our waitlist.
- Platform users — people who create an OmniGolem account to manage a business's messaging.
- End customers — people who message a business that uses OmniGolem. We process your data on that business's behalf; section 8 explains what that means.
Contact: privacy@omnigolem.com. Data Protection Officer: Chen Shengxi (proprietor), same address.
1. Data we collect
1.1 Website visitors and waitlist
| Data | Source | Why |
|---|---|---|
| Email address | You, via the waitlist form | To tell you when OmniGolem is available and send occasional product updates. |
| Roadmap votes | You, via the public roadmap | To prioritise what we build. Stored against a session, not your identity, unless signed in. |
| Usage analytics: pages viewed, referrer, approximate country, device type | Vercel Analytics | To understand how the site is used. Cookieless; no cross-site tracking. |
| Error reports | Sentry | To fix bugs. May include IP address and browser details. |
When you join the waitlist we also send ourselves an internal notification (via Telegram) containing your email so we can respond quickly. Deleted within 30 days.
1.2 Platform users (business accounts)
| Data | Source | Why |
|---|---|---|
| Name, email, profile photo, authentication identifiers | You or your sign-in provider, via Clerk | Create and secure your account. |
| Organisation name, team members, roles | You | Run your workspace and control access. |
| WABA ID, phone number ID, display name, verification status, messaging limits, quality rating | Meta, when you connect a WhatsApp Business Account | Send/receive on your behalf; show account health. |
| Access tokens for connected channels | Meta, via Embedded Signup | Call the WhatsApp Cloud API for your account. Encrypted at rest. |
| Message templates you create | You | Submit to Meta for approval and send. |
| Product usage events | Our application | Improve the product and support you. |
| Billing details (plan, invoices; card details held by our payment processor) | You | Charge for the service. |
| Support correspondence | You | Help you. |
1.3 End customers
When you message a business that uses OmniGolem, the business is the data controller and we are its data processor. On the business's instructions we receive and store: your WhatsApp phone number and profile name; the content of messages you exchange with the business including media; delivery and read status; and notes, tags and assignment information the business adds.
We do not use end-customer messages for our own purposes, do not read them except where necessary to operate the service or where the business asks us to for support, and do not use them to train models or build profiles.
2. Legal basis
Where GDPR/UK GDPR applies: contract (providing the service; processing on the business's instructions), legitimate interests (security, abuse prevention, product improvement, launch information you signed up for — you can object), consent (marketing beyond that — withdraw any time), legal obligation (record-keeping).
Where Singapore's PDPA applies: consent, deemed consent (data provided for an obvious purpose such as joining a waitlist), or as otherwise permitted, and only for purposes a reasonable person would consider appropriate.
3. Retention
| Data | Retention |
|---|---|
| Waitlist email | Until unsubscribe, or 12 months after launch if you never sign up. |
| Platform account and workspace data | Deleted when the organisation is deleted (all contacts, conversations, messages, templates, channels, team records). Deletion is subject to a 72-hour cancellation window for the account owner before it runs. Backups, where the cluster tier has them, rotate within our database provider's backup window. |
| Channel access tokens | Deleted on disconnect or account deletion. |
| End-customer conversations and contacts | As instructed by the business; default life of the business's account. A business can delete a conversation or contact at any time: it moves to a trash for 30 days (recoverable by the business; hidden from the inbox) and is then permanently deleted. The business can also delete permanently at once. If the end customer messages again while the item is in trash, it is restored so that an active customer is never invisible. |
| Media (images, documents, audio, video) | We do not store media files. We store only WhatsApp's media reference (ID, type, checksum) inside the message record; the file itself stays on WhatsApp's servers under WhatsApp's retention. Deleting the message deletes our reference; for media the business uploaded, we also ask WhatsApp to delete the copy on a best-effort basis. |
| Error logs (Sentry) | 90 days. |
| Analytics (Vercel) | Aggregated; no personal data beyond 24 hours. |
| Invoices and billing records | 5 years (Singapore tax law). |
4. Sub-processors
| Provider | Role | Data | Location |
|---|---|---|---|
| Vercel Inc. | Hosting, serverless, analytics | All request data; aggregated analytics | US (Washington DC, iad1) |
| PlanetScale Inc. (on Amazon Web Services) | Primary database | All account, workspace, contact and message data | Set up for Singapore; provider's written confirmation of storage location pending; may be accessed from the US for support |
| MongoDB Inc. (Atlas) | Previous primary database (being retired) | All account, workspace, contact and message data | US |
| Upstash Inc. | Redis — rate limiting, caching | Request identifiers, short-lived cache | US |
| Clerk Inc. | Authentication | Name, email, sign-in identifiers, org membership | US |
| Inngest Inc. | Background jobs (webhook processing) | Message payloads in transit | US |
| Functional Software Inc. (Sentry) | Error monitoring | IP, browser details, stack traces | US |
| Meta Platforms, Inc. | WhatsApp Business Platform | Everything sent via WhatsApp, under Meta's terms | Global |
| Our payment processor (named here before billing goes live) | Payments | Billing name, email; card details held by them | US |
| Telegram | Internal waitlist notification | Waitlist email | Global |
We update this list before adding a sub-processor handling end-customer data and give business customers 14 days' notice. We do not sell personal data or share it with advertisers. We disclose to authorities only when legally required and, where permitted, tell the affected business first.
What we cannot delete ourselves
- Media files live on WhatsApp/Meta infrastructure, not ours (see above).
- Sign-in identity (name, email, login provider) is held by Clerk; deleting your OmniGolem organisation removes our records but you must also delete your Clerk-backed login if you want it gone — or email us and we will do it.
- Channel access tokens are deleted from our database on disconnect or account deletion; the corresponding token on Meta's side is invalidated when you remove OmniGolem from your Meta Business settings.
- Disconnecting a channel permanently deletes that channel's conversations, messages, templates and analytics. Contact records are kept (they are the business's CRM data and may span channels); the business can delete them individually or by deleting the account.
- Error logs (Sentry) and hosting logs (Vercel) expire on those vendors' schedules (90 days for Sentry).
- Rate-limit keys in Redis contain identifiers and expire automatically within minutes.
5. International transfers
Based in Singapore; some providers store data in the US or elsewhere. For EU/UK data we rely on Standard Contractual Clauses (or UK Addendum) or the provider's EU-US Data Privacy Framework participation. Under the PDPA we ensure recipients protect data to a comparable standard.
Our primary database is set up to store data in Singapore. We are waiting for the provider's written confirmation of where the data and its backups are stored; until then, data may be stored or accessed outside Singapore. We will update this section when it is confirmed.
6. Security
Encrypted in transit (TLS 1.2+) and at rest; channel tokens additionally encrypted at the application layer. Production access limited to our team and logged. Role-based access within workspaces. Webhook endpoints verify Meta signatures. Rate limiting and abuse monitoring.
Breach affecting personal data: we notify affected businesses without undue delay and regulators where required (72 hours under GDPR; 3 calendar days after assessing a notifiable breach under PDPA).
7. Your rights
Depending on where you live: access, correct, delete, receive a copy, object/restrict, withdraw consent, complain to a supervisory authority (Singapore: PDPC; EU: your national DPA).
Platform users: update most data in settings; delete your account to trigger section 3. Otherwise email privacy@omnigolem.com; we respond within 30 days.
End customers: contact the business you messaged — they control your data. If you contact us we forward the request and help them respond. If the business's account is closed and we still hold your data in the deletion window, we act directly.
8. What "processor" means for end customers
The business decided to use OmniGolem, decides retention, and decides who on their team sees your messages. We act only on their instructions under a Data Processing Agreement. We will not contact or market to you, or use your messages for anything other than delivering them. Your relationship with WhatsApp itself is governed by WhatsApp's privacy policy.
9. Cookies
Strictly necessary cookies for sign-in sessions (Clerk) and a session identifier for roadmap voting. No advertising or cross-site tracking cookies. Vercel Analytics is cookieless.
10. Children
Business tool, not directed at children; no knowing collection from under-18 platform users. End-customer data is controlled by the business; contact us if a child's data has reached us inappropriately and we will help the business remove it.
11. Changes
Posted here with an updated date. Material changes affecting platform users: account owners emailed 14 days in advance.