Privacy Policy

Last updated: October 8, 2026

1. Data controller

The Omrela platform (omrela.com and app.omrela.com, the “Service”) is operated by Xam Technology sp. z o.o., Wójtowa 67, 38-305 Wójtowa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division, under KRS number 0000815124, NIP 7382159104, REGON 384913929, share capital PLN 5,000 (the “Operator”).

Privacy questions and data subject requests: privacy@omrela.com.

2. What data we collect

On the marketing site (omrela.com):

• the email address you submit to the waitlist or contact form,
• a hashed IP address, used only for abuse prevention,
• basic technical logs (browser type, requested pages) kept for security.

On the application (app.omrela.com), when you or your company create an account:

• account data: name, email address, workspace membership and role,
• workspace content processed on behalf of your company: orders, customer messages, documents, product listings and related business records synced from the tools you connect,
• integration credentials (API keys, OAuth tokens) for services you choose to connect - stored encrypted and used solely to operate those connections,
• usage and security logs, and billing records where a paid plan applies.

3. Purposes and legal bases (GDPR)

• Providing the Service (Art. 6(1)(b) GDPR) - operating your account, syncing the tools you connect, running automations and the AI assistant you invoke.
• Legitimate interests (Art. 6(1)(f)) - security, abuse prevention, service diagnostics and improvement.
• Consent (Art. 6(1)(a)) - waitlist and product-update emails; you can withdraw at any time via the unsubscribe link or by writing to us.
• Legal obligations (Art. 6(1)(c)) - accounting and tax records.

4. Third-party platform data (including Meta)

Omrela connects to third-party platforms (marketplaces, email providers, carriers, ERP systems and advertising platforms such as Meta and Google) only after you authorize the connection for your own accounts. Data obtained from those platforms - including Platform Data received from Meta - is used exclusively to provide the Service to the customer who connected the account: displaying it in their workspace, running the automations they configure and reporting they request.

• We do not sell platform data and do not share it between customers or with third parties.
• Each customer only ever sees data from accounts their own workspace connected.
• We process Meta Platform Data in accordance with the Meta Platform Terms.
• Disconnecting an integration stops the sync; on request we delete the data obtained through it (see section 8).

5. Google user data

If you connect a Google account, Omrela requests only the access needed for the feature you enable, and only after you approve it on Google’s consent screen:

• Google Analytics (read-only, analytics.readonly) - traffic and conversion reports of the properties you select, shown in your workspace and used in reports and automations you configure;
• Google Search Console (read-only, webmasters.readonly) - search queries, clicks, impressions, sitemaps and index status of the sites you select;
• Google Merchant Center (content) - the product listings of your Merchant Center account, so that you can publish, update or remove your products in Google Shopping from Omrela and see their approval status;
• Google Ads (adwords) - performance reports of your Google Ads accounts and, when you request it, creating, changing or pausing your campaigns and budgets. Every change to a campaign or budget is shown to you and runs only after your confirmation.

Omrela’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the user-facing features of Omrela that you use, in the workspace that connected the account.
• We do not transfer Google user data to third parties, except as necessary to provide those features (our processors listed in section 6, bound by data processing agreements), to comply with applicable law, or as part of a merger or acquisition with prior notice to you.
• We do not use Google user data for serving advertisements, including retargeting or personalized ads.
• We do not sell Google user data and do not use it to build user profiles for third parties.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• Our staff does not read Google user data, unless you ask us to for support, it is needed for security or to comply with the law, or the data has been aggregated and anonymized.

OAuth tokens for Google services are stored encrypted. Data received from Google is kept for as long as the integration stays connected and is deleted under the rules in sections 7 and 8. You can revoke Omrela’s access at any time by disconnecting the integration in the app or in your Google Account at myaccount.google.com/permissions; after revocation we stop all access and, on request, delete the data obtained through it.

6. Recipients and processors

We use a small set of infrastructure providers acting as processors under data processing agreements: EU-based hosting (Hetzner Online GmbH, Germany), a managed database provider (Supabase), a transactional email provider, and AI model providers used to power assistant features you explicitly invoke. We do not use your workspace content to train our own or third parties’ models. Data may be disclosed to public authorities only where the law requires it.

7. Retention

• Waitlist data: until you unsubscribe or ask us to delete it.
• Account and workspace data: for the duration of the contract with your company.
• After termination, workspace data is deleted or irreversibly anonymized within 90 days, except where the law requires longer retention (e.g. invoices).
• Security logs: up to 12 months.

8. Your rights and data deletion

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, Warsaw).

To request deletion of your data - including data obtained from a connected platform such as Meta or Google - email privacy@omrela.com from the address associated with your account, or disconnect the integration in the app and request erasure of the previously synced data. We confirm completion of deletion requests within 30 days.

9. Cookies

The marketing site uses only technically necessary cookies. The application uses cookies required to keep you signed in and to remember workspace preferences. We do not use third-party advertising cookies.

10. Changes

We will announce material changes to this policy on this page. The date above always reflects the current version.