Privacy policy
Last updated 21 September 2026 · นโยบายความเป็นส่วนตัว
Omni Chat is a customer-service platform operated by Omnicone. A business connects its own accounts — a Facebook Page, an Instagram professional account, a WhatsApp Business number, a LINE official account, a TikTok or Lazada shop, or a chat widget on its website — and its staff answer the people who write to those accounts. For the messages of those people the business is the controller and Omnicone is its processor: we hold the data on its behalf and act on its instructions.
What we collect
- From the business: the workspace and company details, the users it invites (name, e-mail, role), and the credentials of the channels it connects (access tokens, webhook keys), which are stored encrypted.
- From the people who message the business, through the provider's own API: the message and its attachments, the provider's identifier for the sender, the profile name and picture the provider gives us, the time of each message and its delivery and read status. Nothing is read from a person's account beyond the conversation with that business.
- Added by the business's staff: tags, notes, custom fields and the assignment of a conversation.
- Technical: session cookies for the console, server logs (IP address, request path, timestamp) and error reports, used to run and secure the service.
We do not buy contact lists, we do not sell data, and we do not use anyone's messages to advertise or to train models.
Why we hold it
- To deliver messages both ways and show the conversation to the staff who answer it.
- To let the business search its own history, report on it and export it.
- To keep the service secure and to investigate abuse.
- To bill the business for its plan.
Who it is shared with
- The messaging providers the business connected (Meta for Facebook, Instagram and WhatsApp; LINE; TikTok; Lazada) — they receive the replies the business sends, as they must to deliver them.
- Amazon Web Services, where the install runs. Data of an install stays in its own AWS account and Region; transactional e-mail is sent through Amazon SES.
- A slip-verification provider, when the business uses that feature, to check a bank transfer slip a customer sent.
- No one else; we disclose data to authorities only where the law compels it.
How long
- Conversations, contacts and their attachments: while the workspace exists, until deleted.
- Raw webhook payloads: 7 days.
- Server logs: 30 days.
- Backups: up to 30 days, then overwritten.
- After a workspace is closed: 30 days, then everything of it is deleted, except records the law requires us to keep (invoices) and figures that no longer identify anyone.
Your rights
You may ask for a copy of your data, its correction, or its deletion. The quickest route is the business you were writing to, because the data is theirs; if that fails, write to [email protected] and we will act within 30 days. Deletion instructions, including how to remove the app's access at Facebook, are on the data deletion page.
Security
Traffic is encrypted in transit (TLS). Channel credentials are encrypted with keys held in AWS KMS. Access to an install is limited to the people the business invites, each with a role; our own access is limited to named operators and is logged.
Children
The service is for businesses; it is not directed at children under 13.
Changes
If this policy changes we update the date above and, for a material change, tell the businesses that use the service before it takes effect.
Contact
Omnicone — [email protected]