Privacy Policy

1. What we collect

When you use OmniX as a buyer

• Account: your name, email address and password (stored only as a secure hash by our authentication provider), and an optional profile photo.
• Activity: what you buy or claim, your Library and downloads, reviews, wishlist, cart, refund requests, and the interests and notification choices you set.
• Payments: the Razorpay order and payment IDs, amount and status. Your card, UPI or bank details go directly to Razorpay; OmniX never receives them.
• AI requests: what you type into the AI Concierge or an AI creation request, and the images and files we create for you. Your Concierge conversations are saved as your chat history (your latest 50) so you can reopen them; you can delete any of them at any time.
• Support and reports: messages you send us, and reports you make about products. For copyright and trademark claims, we may share the claim, including the rights owner's name, with the seller so they can respond.

If you sell on OmniX

• Your legal name, store name, phone number and email (each verified with a one-time code), address and PAN.
• For bank verification during setup: your bank account holder name, IFSC and the last 4 digits of your account number. The full account number is sent to Razorpay to verify it.
• Payout details you enter to get paid: a UPI ID, or a bank account number, IFSC and holder name. The UPI ID, account number and holder name are encrypted before they are stored; you only ever see them masked, and only staff who make payouts can read them, to pay you.
• Your products, sales, earnings, payouts (amount, date and transfer reference), shareable links and their click counts.

If you join the affiliate program

• Your affiliate code, the sales your links brought in and the commission you earned, your payout details (encrypted, as above) and your payouts.
• How many people opened your links, counted once per visitor per day with the anonymous visitor cookie below. Affiliates never see who those visitors or buyers are.

Automatically

• Essential cookies that keep you signed in.
• An anonymous visitor cookie (we store only a scrambled version of it) used to count product views and clicks on sellers' links once per day, and a 30-day cookie remembering which seller link brought you to a product, so the seller gets credit if you buy. If you open OmniX through an affiliate's link, a 30-day cookie remembers that affiliate's code so they earn commission if you buy. These don't identify you and aren't used for advertising.
• Technical logs kept by our hosting providers (such as IP address, browser and error reports) to keep the service secure and working.

We don't use third-party advertising or tracking cookies.

2. Why we use it

• To run your account, process purchases, deliver products, handle refunds and send receipts and important account emails.
• To let sellers sell: verifying identity and bank details, paying out earnings, and showing them sales, buyer first names and private buyer tags (never your email).
• To run the affiliate program: crediting sales to the affiliate who referred them, showing affiliates their clicks and earnings, and paying them.
• To personalise OmniX, for example recommendations and notifications based on your interests, within the choices you set in Notifications.
• To keep OmniX safe: preventing fraud, abuse and piracy, and enforcing our terms.
• To meet legal duties, such as tax and accounting records.

We rely on your consent (given when you sign up and when you choose optional features), and on the legitimate uses the DPDP Act allows, such as fulfilling purchases you ask for and complying with the law. You can withdraw consent for optional processing at any time in your account settings.

3. Who we share it with

We don't sell your personal data. We share only what each service needs to do its job for us (our Data Processors):

• Razorpay: payments, refunds, and seller bank verification.
• Google (Gemini API): powers the AI Concierge, AI creations (images and documents), AI assist for sellers and semantic search. What you type into AI features is sent to Google for processing under Google's Gemini API terms. Depending on the service tier OmniX uses, Google may use such content to improve its products, so please don't include personal or sensitive information in AI requests.
• Supabase: our database, sign-in and file storage.
• Vercel: hosting the website.
• Resend: sending emails such as receipts and verification codes.
• An SMS provider: sending phone verification codes to sellers.
• Sellers: when you buy, the seller sees your first name and a private tag (not your email) on their order list.
• Authorities: when the law requires it, for example a valid court or government order.

Some of these providers may store data on servers outside India. We use reputable providers with appropriate security, and transfers follow the DPDP Act.

4. How long we keep it

• Your account data, for as long as your account is open. Concierge chat history until you delete it (we keep your latest 50 conversations).
• Earnings and payout records for sellers and affiliates, for as long as tax and accounting laws require.
• Order, payment and refund records, for as long as tax and accounting laws require (generally up to 8 years), even after you close your account, but without your personal details.
• Logs and security data, for a limited period needed to keep the service safe.

5. Your rights

• Access: download a copy of your data from Data & privacy.
• Correction: update your details in Your profile and Login & security.
• Erasure: close your account from Data & privacy; we delete your personal data except records the law requires us to keep.
• Withdraw consent for optional uses, such as personalised notifications.
• Nominate someone to exercise your rights if you die or become unable to, by writing to us.
• Grievance redressal: contact our Grievance Officer (below). If you're not satisfied, you can complain to the Data Protection Board of India.

6. Children

OmniX is meant for adults. If you are under 18, you may use it only with the permission of a parent or legal guardian, who gives consent for your personal data. We don't knowingly track children's behaviour or target advertising at them. If you think a child has given us data without consent, contact us and we'll delete it.

7. Security

We protect data with encryption in transit, strict access rules in our database (each person can only reach their own data), private storage for purchased files with short-lived download links, two-factor authentication for administrators, and payment verification on our servers. No system is perfectly secure; if a breach affects you, we'll tell you and the Data Protection Board as the law requires.

8. Changes

We'll update this policy when our practices change and show the new date at the top. For important changes, we'll let you know before they apply.

Contact us

[Legal business name] (trading as OmniX)
[Registered address, City, State, PIN]
Email: omnix0325@gmail.com

Grievance Officer: [Grievance Officer's name], [grievance@your-domain.in]. See Contact & Grievances for how complaints are handled.