Privacy notice

How OumsAI uses the personal data of the people who use the platform: store owners, their teams, and visitors to oumsai.com.

Who we are

OumsAI is run by BRODV LTD, a company registered in England and Wales under number 17069547, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("we"). We decide how your account data is used, so we are its controller.

Contact: hello@oumsai.com. For anything about your data, write to us there.

What we collect

Your account: name, email address, phone number if you give it, profile photo, password (stored only as a hash), two-factor and passkey settings.

Your use of OumsAI: the workspaces you belong to and your role, what you do in them (kept in the activity history), where you are signed in (browser, IP address, times).

What you write to the AI assistant, and its answers.

Billing and payouts: your store's Stripe account details are held by Stripe; we keep its identifiers and status.

Why we use it, and on what basis

To provide the service you signed up for: accounts, workspaces, stores, email, payments, the assistant (performance of our contract with you).

To keep the platform secure: sign-in checks, rate limits, the activity history, fraud and abuse prevention (our legitimate interest in a safe service).

To meet legal duties: accounting, tax, answering lawful requests (legal obligation).

We do not sell your data and do not use it for advertising.

Your store's customers

For the data of your store's buyers and newsletter subscribers, your business is the controller and we act as your processor, under the Data processing agreement.

Who processes it for us

We use carefully chosen service providers who process data on our behalf, under contract and only on our instructions: our hosting provider (servers in the European Union); our email delivery provider (European Union); our payment provider, Stripe, for store payments and payouts; and AI service providers for the assistant and AI features. You can ask us for the names of our providers at any time.

Transfers outside Europe

Our AI service providers process the data they receive, including in China. Neither the European Union nor the United Kingdom has recognised China as protecting personal data to their standard, so your data may be less protected there, and local laws may give public authorities access to it. The legal basis for this transfer is under legal review. Avoid putting sensitive data in what you send to the AI; a workspace can switch the AI assistant off in Settings → AI.

Our payment provider may process data in the United States, under the EU–US Data Privacy Framework and its UK extension.

How long we keep it

Your account data, while your account exists; when you delete it, within 30 days, except what the law requires us to keep.

The activity history, for the period your workspace sets (by default 365 days).

Sign-in records, 90 days. Invoices and accounting records, as long as tax law requires (up to 10 years).

Your rights

You can access, correct, export or delete your data, object to or restrict its use, and withdraw a consent you gave. Most of it you can do yourself in My account; for the rest, write to hello@oumsai.com.

You can complain to a data protection authority: in the United Kingdom the Information Commissioner's Office (ico.org.uk), in France the CNIL (cnil.fr), or the authority where you live.

Security

We protect your data with technical and organisational measures suited to the risk, including encryption, access controls and regular encrypted backups.

Cookies

OumsAI uses only the cookies it needs to work: your session, protection against forged requests, and your display preferences. No advertising or tracking cookies.

Changes

We will tell you by email before a change that affects your rights takes effect.