Privacy Policy

Last updated: September 1, 2026

1. Data controller

The Omrela platform (omrela.com and app.omrela.com, the “Service”) is operated by Xam Technology sp. z o.o., Wójtowa 67, 38-305 Wójtowa, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division, under KRS number 0000815124, NIP 7382159104, REGON 384913929, share capital PLN 5,000 (the “Operator”).

Privacy questions and data subject requests: privacy@omrela.com.

2. What data we collect

On the marketing site (omrela.com):

• the email address you submit to the waitlist or contact form,
• a hashed IP address, used only for abuse prevention,
• basic technical logs (browser type, requested pages) kept for security.

On the application (app.omrela.com), when you or your company create an account:

• account data: name, email address, workspace membership and role,
• workspace content processed on behalf of your company: orders, customer messages, documents, product listings and related business records synced from the tools you connect,
• integration credentials (API keys, OAuth tokens) for services you choose to connect - stored encrypted and used solely to operate those connections,
• usage and security logs, and billing records where a paid plan applies.

3. Purposes and legal bases (GDPR)

• Providing the Service (Art. 6(1)(b) GDPR) - operating your account, syncing the tools you connect, running automations and the AI assistant you invoke.
• Legitimate interests (Art. 6(1)(f)) - security, abuse prevention, service diagnostics and improvement.
• Consent (Art. 6(1)(a)) - waitlist and product-update emails; you can withdraw at any time via the unsubscribe link or by writing to us.
• Legal obligations (Art. 6(1)(c)) - accounting and tax records.

4. Third-party platform data (including Meta)

Omrela connects to third-party platforms (marketplaces, email providers, carriers, ERP systems and advertising platforms such as Meta) only after you authorize the connection for your own accounts. Data obtained from those platforms - including Platform Data received from Meta - is used exclusively to provide the Service to the customer who connected the account: displaying it in their workspace, running the automations they configure and reporting they request.

• We do not sell platform data and do not share it between customers or with third parties.
• Each customer only ever sees data from accounts their own workspace connected.
• We process Meta Platform Data in accordance with the Meta Platform Terms.
• Disconnecting an integration stops the sync; on request we delete the data obtained through it (see section 7).

5. Recipients and processors

We use a small set of infrastructure providers acting as processors under data processing agreements: EU-based hosting (Hetzner Online GmbH, Germany), a managed database provider (Supabase), a transactional email provider, and AI model providers used to power assistant features you explicitly invoke. We do not use your workspace content to train our own or third parties’ models. Data may be disclosed to public authorities only where the law requires it.

6. Retention

• Waitlist data: until you unsubscribe or ask us to delete it.
• Account and workspace data: for the duration of the contract with your company.
• After termination, workspace data is deleted or irreversibly anonymized within 90 days, except where the law requires longer retention (e.g. invoices).
• Security logs: up to 12 months.

7. Your rights and data deletion

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the President of the Personal Data Protection Office (UODO, Warsaw).

To request deletion of your data - including data obtained from a connected platform such as Meta - email privacy@omrela.com from the address associated with your account, or disconnect the integration in the app and request erasure of the previously synced data. We confirm completion of deletion requests within 30 days.

8. Cookies

The marketing site uses only technically necessary cookies. The application uses cookies required to keep you signed in and to remember workspace preferences. We do not use third-party advertising cookies.

9. Changes

We will announce material changes to this policy on this page. The date above always reflects the current version.