Privacy Policy

This Privacy Policy explains how Omni Systems, Inc., a Delaware corporation (the “Company,” “we,” “us” or “our”), collects, uses, discloses and otherwise processes personal data. It applies when you:

• visit our website at https://omnitep.io (the “Site”);
• use our Omnitep products and services, currently provided on the omnitep.com domain (the “Services”). These include the Omnitep IDE, the SDLC Portal, My Account, hosted development and staging runtimes, and AI features;
• contact us, attend our events or training, subscribe to product updates, apply for a job, or otherwise interact with us.

“Personal data” means information that relates to an identified or identifiable individual. It includes “personal information” and similar terms under applicable privacy laws.

This Privacy Policy does not cover:

• personal data that our customers put into the Services, which we process on their behalf (see Section 6); or
• applications that our customers and partners build with Omnitep and run on their own infrastructure (see Section 6).

1. Who We Are and How to Contact Us

The Company is responsible, as controller, for the personal data described in this Privacy Policy.

You can contact us about privacy:

• by email at privacy@…Show; or
• by mail at Omni Systems, Inc., Attention: Privacy, 2501 Chatham Rd, Ste R, Springfield, IL 62704, USA.

2. Personal Data We Collect

2.1 Information you give us

• Inquiries and meeting requests. You can use a form on the Site to request a demo, a trial, a workshop, an estimate or other help. When you do, we collect:
  • your first and last name, business email address and company;
  • your message and the topic you selected;
  • the page you came from;
  • your preferred meeting time, if you choose one.
• Product updates. When you subscribe, we collect your email address. Our marketing emails may use standard technologies that tell us whether an email was opened and which links were clicked.
• Account information. When you or your organization create an account for the Services, we collect:
  • your name, business email address, organization and role;
  • your account settings;
  • your sign-in credentials, or identifiers from your single sign-on provider.
• Billing information. For paid subscriptions, we collect billing contact details, billing address and tax identifiers. Our payment processor, Stripe, collects and processes payment card details. We receive only limited card information, such as the card brand, last four digits and expiration date.
• Support and communications. When you contact us or open a support case, we collect your contact details and the content of your messages. This includes any attachments, screenshots or session recordings you choose to share.
• Events and training. When you register for a webinar, workshop or Omnitep Academy course, we collect your registration details. For courses, we also collect information about your participation and progress.
• Careers. When you apply for a job, we collect your contact details, your résumé and any other information you choose to provide.
• Feedback and surveys. We collect the information you provide when you answer a survey or send us feedback.

2.2 Information we collect automatically

• Device and log information. When you visit the Site or use the Services, our systems and hosting providers automatically record technical information, such as:
  • your IP address, browser type and version, and operating system;
  • device identifiers;
  • referring pages, the pages you view, and the date and time of access.

  We may infer your general location, such as country or city, from your IP address.

• Usage information in the Services. We record how the Services are used. This includes:
  • the features used and actions taken;
  • performance and error data;
  • the amount of AI usage, including the model used and the resulting usage units.

  We need this information to operate, secure, support and bill for the Services.

• Cookies and similar technologies. See Section 5.

2.3 Information from other sources

• Your organization. If your organization’s administrator invites you to the Services or manages your account, we receive your name, email address and role from them.
• Partners and resellers. If you buy through a partner or are referred by one, we receive your contact and order details from that partner.
• Service providers. For example, we receive payment status from Stripe, and sign-in information from a single sign-on provider you use.
• Public and professional sources. We may obtain business contact information from publicly available sources, from professional networks, and from marketing service providers and outreach agencies. This information includes name, job title, employer and professional profile. We use it to contact professionals who may be interested in our products.

3. How We Use Personal Data

We use personal data to:

• provide, operate, maintain and secure the Services. This includes creating and managing accounts, authenticating users and providing AI features;
• respond to inquiries, schedule and hold demos, meetings and workshops, and provide trials;
• process subscriptions and payments, bill for usage and manage our customer relationships;
• provide customer support and training;
• send service-related communications, such as security notices, billing messages and changes to our terms;
• send product updates and marketing communications, where permitted (you can opt out at any time);
• understand how the Site and Services are used, and improve and develop our products;
• detect, prevent and respond to fraud, abuse, security incidents and other harmful activity;
• recruit and evaluate job applicants;
• comply with legal obligations, enforce our agreements, and establish, exercise or defend legal claims; and
• fulfil other purposes we describe when we collect the information, or that you consent to.

We may also create de-identified or aggregated information that no longer identifies you, and use it for any lawful purpose.

Legal bases (European Economic Area, United Kingdom and Switzerland)

Where European or UK data protection law applies, we rely on the following legal bases:

Where we rely on legitimate interests, you can object as described in Section 11.

4. AI Features and Your Content

Several Services include AI features. Examples include the AI assistant and agentic workflows in the Omnitep IDE, role-based agents in the IDE and the SDLC Portal, and AI agents that customers embed in their applications.

• No training on your content. We do not use the content that you or your organization put into the Services to train or fine-tune artificial intelligence or machine-learning models. This content includes prompts, inputs, outputs, code and models.
• Models we provide. When you use AI models that we provide, your prompts and the model outputs are processed through Amazon Bedrock, a service of Amazon Web Services, in AWS regions in the United States or the European Union. AWS states that Amazon Bedrock does not share prompts and outputs with the model providers and does not use them to train foundation models.
• Your own model provider. Your organization may connect its own account with an AI model provider (“bring your own key”). If it does, prompts and outputs are sent to that provider and handled under your organization’s agreement with it.
• Your own AI tools. If you connect third-party AI coding tools, such as Claude Code or Codex, to Omnitep, those tools are governed by their providers’ terms and privacy policies.
• Agent memory. AI agents in the Services can keep memory and playbook entries. These entries are part of your organization’s content, are controlled by your organization, and are handled as described in Section 6.

5. Cookies and Similar Technologies

On the Site (omnitep.io)

The Site uses one necessary cookie, omnitep_consent, which stores your cookie choices for six months. If your browser does not accept it, the Site stores your choices in your browser’s local storage instead.

Optional analytics and marketing cookies are used only if you allow them, either in the cookie banner or in Cookie Settings. You can open Cookie Settings at any time from the link at the bottom of every page. Cookie Settings lists the tools in use in each category. At present, no analytics or marketing tools are active on the Site.

Before we add a tool, we will update this section and Cookie Settings.

Our hosting provider keeps technical logs as described in Section 2.2.

In the Services (omnitep.com)

The Services use:

• Necessary cookies. These keep you signed in, protect your session, remember your preferences, and are required for the Services to work.
• Google Analytics. This is a web analytics service provided by Google LLC. It uses cookies and similar technologies to help us understand how the Services are used, for example which features are used and how often. Google receives information such as your IP address, device and browser information, and the pages you visit.
  • You can learn how Google uses this information at https://policies.google.com/technologies/partner-sites.
  • You can opt out by installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.
  • Where the law requires consent for analytics cookies, including for users in the European Economic Area and the United Kingdom, we ask for it before setting them.

We may add other analytics or marketing tools. If we do, we will update this section first.

Browser controls and signals

Most browsers let you block or delete cookies. Blocking necessary cookies may stop the Services from working.

There is no common standard for responding to “Do Not Track” signals, and we do not respond to them.

On the Site, we treat a Global Privacy Control signal as a refusal of marketing cookies. We do not sell or share personal data (see Section 7). If that changes, we will honor Global Privacy Control signals as required by law.

6. Personal Data We Process on Behalf of Our Customers

Our customers are organizations and professionals. They put content into the Services, such as:

• project models, code and documents;
• tickets, test cases and test data;
• screenshots;
• prompts, AI outputs and agent memory.

This content (“Customer Content,” called “Customer Data” in our Master Customer Agreement) may include personal data.

We process Customer Content on behalf of the customer, under its instructions and our agreement with it. That agreement includes our Data Processing Addendum. The customer decides how Customer Content is used and is responsible for its own privacy notice.

If your personal data is in Customer Content and you want to exercise your rights, please contact the organization that provided it. If you contact us instead, we will forward your request to that organization.

Our customers and partners operate the applications they build with Omnitep. Production runtimes on their own infrastructure can run fully offline and send us no data. Data reaches us only if a customer connects a deployment to the Services. If a customer gives us access to its systems for support or Expert Services, we handle any personal data we see on the customer’s behalf, under our agreement with it.

7. How We Disclose Personal Data

We do not sell personal data. We do not share it for cross-context behavioral advertising.

We disclose personal data to:

• Service providers that process it on our behalf. These include:
  • Amazon Web Services, for cloud hosting and AI model processing;
  • Stripe, for payments;
  • Google, for analytics in the Services;
  • providers of email, customer relationship management, support and communication tools.

  Service providers may use personal data only to provide services to us, except where they act as independent controllers under their own privacy policies. Stripe, for example, does so for fraud prevention and legal compliance.

• Your organization. If you use the Services through your organization’s account, its administrators can access information about your use and your content.
• Partners and resellers. We disclose personal data to them when you buy through or are referred by them, or ask to be connected with them. We disclose only what is needed to manage that relationship.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by confidentiality obligations.
• Authorities and others, for legal and safety reasons. We disclose personal data where we believe it is necessary to:
  • comply with law, legal process or government requests;
  • enforce our agreements;
  • protect the rights, property and safety of our users, the Company and others;
  • investigate fraud or security issues.
• Parties to corporate transactions. This covers a merger, acquisition, financing, reorganization, sale of assets or bankruptcy, including while such a transaction is being considered or negotiated.
• Anyone else, with your consent or at your direction.

8. Retention

We keep personal data only as long as reasonably necessary for the purposes in this Privacy Policy. These purposes include providing the Services, complying with legal obligations, resolving disputes and enforcing our agreements. In particular:

• Account information: for as long as the account is active, and for a reasonable period afterwards to handle renewals, questions and legal matters.
• Billing and transaction records: for as long as tax and accounting laws require.
• Inquiries and sales communications: for as long as needed to respond and follow up, then for a reasonable period to keep a record of our business relationship, unless you ask us to delete them.
• Marketing preferences: until you unsubscribe. After that, we keep only the minimum needed to respect your choice.
• Job applications: for the recruitment process and a reasonable period afterwards, unless you ask us to delete them sooner or agree to a longer period.
• Customer Content: as set out in our agreement with the customer.
• Technical logs: for the limited periods needed for security and troubleshooting.

When we no longer need personal data, we delete it or de-identify it.

9. Security

We use reasonable technical and organizational measures designed to protect personal data. These include hosting the Services on Amazon Web Services, access controls and encrypted connections.

No method of transmission or storage is completely secure, and we cannot guarantee security.

To report a security vulnerability, email security@…Show.

10. International Data Transfers

We are based in the United States. Our personnel are located in the United States and the European Union, and our service providers mainly process personal data there. The Services are hosted in Amazon Web Services regions in the United States and the European Union.

Some transfers of personal data from the European Economic Area, the United Kingdom or Switzerland go to countries that are not recognized as providing an adequate level of protection. For these transfers, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

You can request a copy of the relevant safeguards by emailing privacy@…Show.

11. Your Choices and Rights

11.1 Choices

• Marketing emails. You can unsubscribe using the link in any marketing email, or by emailing privacy@…Show. You will still receive service-related messages.
• Cookies. On the Site, use the Cookie Settings link at the bottom of every page. See also Section 5.
• Account information. You can update your account information in My Account or through your organization’s administrator.

11.2 Rights in the European Economic Area, the United Kingdom and Switzerland

Where European or UK data protection law applies, you have the right to:

• access your personal data;
• correct your personal data;
• delete your personal data;
• restrict the processing of your personal data;
• receive your personal data in a portable format;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect processing that took place before it.

You also have the right to lodge a complaint with a data protection supervisory authority where you live or work, or where you believe an infringement occurred.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Providing personal data to us is generally voluntary. However, some information is needed to provide the Services or to respond to you, such as a business email address for an inquiry. If you do not provide it, we may not be able to do so.

11.3 Rights under US state privacy laws

Depending on where you live, you may have the right to:

• know what personal data we hold about you and how we use and disclose it, and to access it;
• correct inaccurate personal data;
• delete personal data;
• obtain a portable copy of your personal data;
• opt out of the sale of personal data, of sharing for targeted advertising, and of profiling with legal or similarly significant effects. We do not do any of these;
• not be discriminated against for exercising your rights.

We use sensitive personal information, such as account credentials, only for purposes permitted by law, such as providing and securing the Services.

In the past 12 months we have collected the following categories of personal information, for the purposes described in Section 3:

We obtain this information from the sources described in Section 2 and keep it for the periods described in Section 8.

11.4 How to exercise your rights

To exercise your rights, email privacy@…Show.

• Verification. We verify requests, for example by confirming that you control the email address associated with your data.
• Authorized agents. An authorized agent may submit a request on your behalf with proof of authorization.
• Timing. We respond within the time required by applicable law.
• Appeals. If we decline your request, you may appeal by replying to our decision with the word “Appeal.” If you are not satisfied with the outcome, you may contact the attorney general of your state.

For personal data in Customer Content, please contact the organization that provided it (see Section 6).

12. Children

The Site and Services are intended for business and professional use and are not directed to children. We do not knowingly collect personal data from anyone under 18.

If you believe a child has provided us with personal data, contact privacy@…Show and we will delete it.

13. Third-Party Services

The Site and Services may link to or work with services that we do not control. These include social networks, video platforms, AI model providers connected with your own keys, AI coding tools and cloud accounts that you connect to Omnitep. This Privacy Policy does not apply to those services. Their use of your personal data is governed by their own terms and privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date.

If we make material changes, we will notify you by email or through the Services before they take effect, where required by law.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our handling of personal data, contact us:

• by email at privacy@…Show; or
• by mail at Omni Systems, Inc., Attention: Privacy, 2501 Chatham Rd, Ste R, Springfield, IL 62704, USA.