Privacy Policy

Account data: when you create an account you provide your name, email address, and organization name. Workspace owners may additionally provide billing details, which are processed by our payment providers (Stripe and PayPal) — we never store full card numbers on our servers.

Contacts and CRM data you provide: names, phone numbers, email addresses, social handles, message threads, and notes that you import, sync, or create in the platform. Each organization’s data is isolated to that organization (cOrgId / org_id scoping) and syncs only to that organization’s chosen CRM: the OmniSphere Built-in CRM (one-click, no server to run) or your own bring-your-own CRM (EspoCRM, HubSpot, or any OpenAPI-described CRM using your own URL and credentials). crm.xaiproperties.com is only the operator X AI Properties’ own EspoCRM instance and is never a shared store for subscriber data. You control what you put in — we only process what you give us.

Social account tokens: when you connect a platform (Meta/Facebook, Instagram, Threads, TikTok, YouTube, LinkedIn, X/Twitter, Pinterest, Bluesky, Mastodon, Discord, Snapchat, WhatsApp Business), we store the OAuth tokens you authorize. Tokens are Fernet-encrypted at rest in Redis and are only ever used to perform actions you request.

Usage logs: API calls, message counts, publish history, delivery receipts, and operational telemetry (error logs, performance metrics) generated when you use the platform at omnisphere.xaiproperties.com and the API at omniapi.xaiproperties.com.

To provide and operate the service: authenticating your account, delivering inbox messages, publishing your posts, running scheduled tasks, and syncing contacts to your organization’s chosen CRM (Built-in or your connected EspoCRM / HubSpot / OpenAPI CRM).

To improve reliability: diagnosing failures, retrying transient errors, monitoring quota usage, and detecting abuse.

To communicate with you: security alerts, billing updates, and material policy changes. We never use your data for third-party advertising, and we never train shared models on your private messages or contacts.

We do not sell your personal information — ever.

Processors acting on your instructions: when you publish a post, send a WhatsApp message, or sync a contact, we transmit the minimum necessary data to the platform you chose (Meta, TikTok, YouTube, LinkedIn, and others) so your action can complete. Nothing is sent to a platform until you act.

Hosting and infrastructure providers that store or transmit data on our behalf under contractual confidentiality and security obligations.

Legal compliance: we may disclose information where required by applicable law or a valid legal order. We will notify you unless prohibited from doing so.

OmniSphere integrates with Google API Services to support optional features you explicitly enable in your workspace, including YouTube channel publishing, Google Sheets CRM contact and lead imports, Google Calendar meeting synchronization, and Google Sign-In authentication.

Google User Data We Access: Depending on features you connect, OmniSphere requests: (a) basic profile info and email address for account authentication; (b) YouTube API scopes (youtube.upload, youtube.readonly) to upload video posts, retrieve upload status, and sync channel comments; (c) Google Sheets API scopes (spreadsheets.readonly) to read customer and lead spreadsheets you select for CRM pipeline import; and (d) Google Calendar API scopes (calendar.events) to synchronize scheduled meetings and CRM activities.

How We Use Google Data: We access Google user data solely upon your explicit instruction to fulfill the platform features you request. We never sell Google user data, never use Google user data to serve advertisements, and never transfer Google user data to third parties except as strictly necessary to execute the actions you initiate.

No AI Model Training on Google User Data: Data received from Google APIs is never used to train, retrain, improve, or fine-tune generalized artificial intelligence, machine learning, or large language models.

Data Storage & Encryption: All Google OAuth tokens and credentials are encrypted at rest using Fernet (AES-256) encryption within isolated, organization-specific namespaces. Google tokens are held strictly in secure storage and decrypted only in ephemeral memory when making authorized API requests on your behalf.

Data Deletion & Revoking Access: You can revoke OmniSphere’s access to your Google account at any time via Google Security Settings at https://myaccount.google.com/permissions. You can also delete your connected Google accounts, stored credentials, and associated CRM records at any time from your account settings (Settings > Privacy or Settings > Channels), or by requesting full account erasure via [email protected]. All stored Google tokens and cached data are permanently deleted within 30 days of a verified request or account termination.

Google Limited Use Policy Disclosure: OmniSphere’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

Account data is retained for the duration of your subscription and deleted within 30 days of account closure on request.

Message timeline data cached in Redis is subject to the configured expiry policy (default: 90 days). Publish history and audit logs are retained while your organization exists so you keep a complete record, and removed on verified deletion requests.

Backups roll off on a rotating schedule; residual copies expire automatically and are not restored except for disaster recovery.

Social tokens are Fernet-encrypted at rest and decrypted only in memory at the moment of use. Secrets resolve through a hardened chain (container mounts, secrets manager, environment) so the same image runs in development and production without code changes.

Per-organization isolation: every contact, token, and timeline entry is namespaced to your organization (cOrgId). One organization can never read another’s data.

Your CRM, your boundary: use the OmniSphere Built-in CRM in one click (no server to run) or connect your own EspoCRM, HubSpot, or OpenAPI-described CRM in Settings. The operator-owned instance at crm.xaiproperties.com holds only X AI Properties data and is never a shared subscriber store.

All traffic uses industry-standard TLS in transit, credentials are hashed, and access is restricted to authorized personnel on a need-to-know basis.

Access, export, and delete: you can view and export your data at any time from your account (contacts, leads, publish history, GDPR export), and you can request correction or deletion of your personal data.

To exercise these rights, use the in-account export/delete controls or contact us via the site. We respond to verified requests within 30 days.

Opting out of WhatsApp Business messaging is honored immediately — send STOP, or ask us, and marketing messages stop while purely transactional receipts required by law continue only where permitted.

We use strictly necessary cookies and local storage to keep you signed in, remember your language (Arabic/English) and workspace preferences, and protect against cross-site attacks.

We do not use third-party advertising trackers on the marketing site or the dashboard. If that ever changes, we will update this section and ask for consent where required.

OmniSphere is a business product and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

We may update this Privacy Policy as the product evolves. Material changes will be announced by email or in-app notice before they take effect. The “Last updated” date below always reflects the current version.

OmniSphere is an owner-operated SaaS by X AI Properties, with support in Arabic and English. For privacy questions, rights requests, or deletion requests, contact us via the site at omnisphere.xaiproperties.com.