This policy explains how Omi Bot (“we”, “us”) handles personal information when you use the hosted Omi Bot service at app.omibot.ai, the Omi Bot desktop and mobile apps, an Omi Bot presence in a chat app, or the website omibot.ai. An organisation that runs Omi Bot on its own infrastructure under an Enterprise agreement is responsible for that deployment’s privacy practices; see section 6.
1. What this covers
Omi Bot lets you run bots that have their own computer, sign in to the tools you choose, and do work for you. To do that the Service handles your account, what you tell your bots, what they produce, and the connections you give them. We collect only what we need to run, secure and improve the Service, and we say so before a bot sends anything anywhere.
2. What we collect
Depending on how you use Omi Bot, we collect:
- Account information: your name, email address, password hash, sign-in codes, team memberships and roles.
- Content you provide: bot names and instructions, messages, tasks, files, memories, routines, and support conversations.
- Connection information you choose to give a bot: encrypted credentials or tokens for model providers, connected apps and browser sessions, and the chat-app identity you link (for example a Telegram account).
- Billing information: plan, invoices and payment status. Card details go straight to our payment provider; we never see the full number.
- Technical information needed to operate and secure the Service: IP address, browser and device type, session records, device push token, timestamps, and diagnostic logs.
- Website analytics, only if you allow analytics cookies (section 5).
3. How we use it
We use this information to:
- provide, maintain, secure and troubleshoot the Service;
- sign you in and keep your account in sync across the web, desktop, mobile and chat apps;
- run the bots, routines, connections and notifications you ask for;
- bill paid plans;
- answer support requests;
- understand how the website is used, with your permission;
- meet legal obligations and enforce our terms.
We do not sell personal information, we do not use your content for advertising, and we do not train models on your content.
4. Bots, models and other services
A bot cannot do its work without sending some of your content to the services you configure. Here is what goes where.
- Models: messages, relevant conversation history, bot instructions, memories, attachments and file content, screenshots, and content retrieved from connected apps are sent to the model provider you have chosen (for example OpenAI, Anthropic, Google, xAI, OpenRouter, Vercel AI Gateway, Cursor, or a custom model server) to generate responses and carry out tasks, including scheduled ones.
- Gateways: OpenRouter and Vercel AI Gateway forward requests to model providers according to your account’s routing settings. Their processing and retention depend on your gateway account and the provider agreements behind it.
- Voice: recorded audio is sent to the transcription service you selected; text you choose to play is sent for speech generation. Supported services include OpenAI, ElevenLabs, Cartesia and Fish Audio.
- Memory: when Supermemory is configured, conversation summaries, saved memories, search queries, and bot and team identifiers are sent to store and retrieve context.
- Connected apps: a bot signed in to an app (your email, calendar, CRM, a website) receives the content needed for the actions you ask for, and their terms govern what they do with it.
Before the mobile app submits content or starts AI work, it names the configured recipients, explains the data and the purpose, and asks your permission. You can withdraw it later under Account → AI data sharing for new mobile actions; stop existing runs and turn off routines separately. Withdrawal cannot recall data already sent. Web, desktop and chat-app workflows use the connections you configured without this extra step.
Services we select must protect your information at least as well as this policy does. We review their terms and safeguards before offering them. Provider terms govern processing after receipt; the policies of the services above are linked from AI data sharing in the app and from each provider’s website.
5. Cookies
The website omibot.ai and the web app use a small number of cookies and similar browser storage.
- Essential (always on): signing you in and keeping you signed in on app.omibot.ai, protecting against abuse, remembering your theme, your language and your cookie choice. Without these the site and the app do not work.
- Analytics (only with your permission): on omibot.ai we use PostHog to learn which pages people visit and where they leave. It sets a cookie and stores an identifier in your browser; we do not link it to an account. We turn it on only after you choose “Accept all” or turn on Analytics in Cookie settings, and never before.
Change your choice at any time with “Cookie settings” at the bottom of every page of the website. “Reject all” keeps only the essential storage. Your choice is kept in your browser for this device.
6. Enterprise deployments
The Omi Bot apps can connect to a server that your organisation operates under an Enterprise agreement. In that case the organisation, not us, controls the information sent to that deployment and is responsible for its privacy practices. The apps store the chosen server address and your session securely on your device and send nothing about that deployment to us.
7. Keeping and deleting
We keep hosted account information and content while your account is active and for as long as reasonably needed to provide the Service. You can permanently delete your hosted account and everything in your Personal team from Account in the app; a team you own is deleted with it unless you transfer ownership first. After deletion we remove your content within 30 days, except limited information we must keep for legal, security or billing reasons. Information already sent to a third-party provider is subject to that provider’s retention.
8. Security and international transfers
We use technical and organisational safeguards designed to protect personal information: encryption in transit and at rest, encrypted storage of connection credentials, access controls, and logging. No system is completely secure, so please use a strong password and tell us at security@omibot.ai if you find a weakness.
We and our providers may process information in the United States and other countries, whose data-protection laws may differ from yours. Where the law requires, we rely on recognised transfer mechanisms such as standard contractual clauses.
9. Children
Omi Bot is not directed to children under 13 (or under 16 where that is the applicable age), and we do not knowingly collect personal information from them. If you think a child has given us personal information, contact us and we will delete it.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or receive a copy of your personal information, to object to certain processing, and to complain to a data-protection authority. Most of this you can do yourself in the app: edit your account, export your content, or delete your account. For anything else, email hello@omibot.ai and we will respond within 30 days. We will not treat you differently for exercising your rights.
11. Changes to this policy
We may update this policy as the Service changes. We will post the new version here with a new date and, for material changes, tell you by email or in the app before they take effect.
12. Contact
Privacy questions and requests: hello@omibot.ai. Security reports: security@omibot.ai.