Privacy Policy

Omnisocial is operated by Timothy Odebunmi, an individual based in Nigeria and trading under the Omnisocial name. There is no incorporated company behind the service.

Based in Nigeria.

Privacy contact: hello@executioninc.org. This is the address to use for access, correction, deletion and any other privacy request.

This policy covers the Omnisocial marketing website and the Omnisocial application, including accounts, connected social accounts for the integrations actually enabled, posts, media, scheduled posts, the content calendar and shared workspaces.

It does not cover Instagram or any other third-party service. Those services have their own privacy policies, and using them is your choice.

Features shown as unavailable are not part of this release. If we introduce AI features, a marketplace or identity verification later, we will describe the related data handling separately before those features become available.

We do not ask for your date of birth. We do not sell personal data or build advertising profiles. The current release does not initialise third-party analytics or advertising tracking; earlier Google Analytics for Firebase collection is disclosed above and has been disabled.

Current uploaded media is stored in private Amazon S3 storage in US East 1 and served through time-limited links that expire after approximately four hours. Some earlier media remains in legacy Cloudflare R2 storage, which may be publicly accessible; not all historical media is private or time-limited. When you publish content to Instagram, X, LinkedIn, TikTok or another platform, that platform receives the content and controls its audience, storage and public availability.

• Account details: your email address, display name and authentication identifiers. Where password sign-in is used, the password is stored as a one-way cryptographic hash, not readable text. If you continue with Google, Google confirms your identity to our authentication provider; we do not receive your Google password.
• Policy acceptance records: the terms version you accepted, the time you accepted it, and whether you confirmed you are 18 or over. This is an eligibility flag, not a date of birth.
• Workspace details: workspace names, membership, roles and invitations.
• Content you create: captions, drafts, scheduled times, time zone, post status and media you upload.
• Connected social-account details for integrations actually enabled on your account, which may include X, LinkedIn, TikTok and Instagram: account or profile identifiers, usernames, display names, account type, granted permission scopes, connection status and capabilities. We store the access tokens (and refresh tokens where issued) needed to perform the functions you authorise. We do not ask for your social-network password.
• Publishing and insights data: identifiers for posts we publish on your behalf, publishing results, errors and the metrics the connected platform makes available to the app. Some metrics may be unavailable or returned as zero depending on the account, media type and the platform's own limits.
• Technical and security data: IP address, browser and device information, request timestamps, error logs and audit records needed to operate and protect the service.
• Legacy analytics data: earlier production builds automatically initialised Google Analytics for Firebase. That analytics collection has been disabled for this release and sends no new events. Historical analytics data may still be held by Google under its retention and deletion terms; it was collected before disablement, and we do not claim it was never collected.
• Support communications: the contents of messages you send to us, including email processed by our email provider.

We do not sell your personal data. We do not use your content to train generative AI models, and we do not grant ourselves a licence to reuse your content for that purpose.

• To create and secure your account and sign you in.
• To let you draft, publish and schedule content and to show you publishing status.
• To show insights or publishing status that a connected platform makes available for your account.
• To operate shared workspaces, membership and permissions.
• To send transactional email such as sign-in, security and account notices.
• To provide support and respond to requests.
• To detect abuse, prevent fraud and maintain security and reliability.
• To comply with legal obligations and enforce our Terms of Service.

Where the Nigeria Data Protection Act 2023 applies, we rely on one or more of the following: performance of a contract with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where we specifically ask for it.

Where another law gives you stronger mandatory protections, those protections continue to apply.

You can withdraw consent at any time for processing that relies on consent. Withdrawal does not affect processing that already happened, and some processing is still necessary to provide the service.

We share data only as needed to run the service, with providers acting on our instructions under appropriate confidentiality and data-protection terms.

• Amazon Web Services (AWS), US East 1 (N. Virginia): private storage for current media.
• Our virtual private server hosting provider (Contabo), processing location Germany: application database and cache.
• Google Firebase: authentication.
• Google Analytics for Firebase (legacy, disabled on release): historical analytics data retained by Google under its own retention and deletion terms.
• Resend: transactional email delivery.
• Zoho Mail: incoming support and privacy email. Its processing is governed by its own terms and locations.
• Cloudflare R2 (legacy): earlier media storage that may still contain existing media and may be publicly accessible.
• Connected platforms actually enabled on your account, which may include Meta/Instagram, X, LinkedIn and TikTok: when you connect an account, publish content or request analytics, data is exchanged with that platform to perform the action you requested. The platform also processes data under its own notice.
• Other workspace members: content you place in a shared workspace is visible to members according to the permissions the workspace owner or administrators set.
• Professional advisers, authorities or courts where required by law, or where necessary to establish, exercise or defend legal claims.
• A successor or acquirer as part of a genuine reorganisation, subject to this policy and applicable law.

If you use a shared workspace, the workspace owner and administrators control membership and can see workspace content. Do not upload another person's personal data unless you have a lawful reason and permission to do so.

When you act for a workspace, you are responsible for having the authority to connect its accounts and publish its content. If a workspace owner asks us to remove a member, we may do so without deleting that member's own account.

We use measures appropriate to the risk, including encryption in transit, access controls, private storage with short-lived links for current S3 media, and audit logging. Legacy Cloudflare R2 media may be public; not every historical media link is private.

No service can guarantee absolute security. We do not claim certification under any security standard, and we do not claim compliance with a framework unless a current independent assessment supports that claim.

If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant authority and affected users as required by applicable law.

We do not promise that backup copies can be edited individually before they expire. Backup data is isolated and is not used for normal operations.

• Account and workspace data: while your account is active, then for a short period needed to complete deletion and resolve disputes.
• Content and media: while needed for the service, until you delete it or ask us to delete your account, subject to backup expiry.
• Publishing logs and minimal audit records: kept only as long as needed for security, debugging and legal obligations.
• Deleted data: removed from active systems within 30 days of a verified deletion request and from backups within 90 days, unless a shorter legal or platform limit applies.
• Support email: kept for as long as needed to resolve the request and meet legal obligations.
• Legacy Google Analytics for Firebase data: no longer collected after disablement; any historical data held by Google is subject to Google's retention and deletion terms, and we will assist with deletion requests where possible.

You can request deletion by emailing hello@executioninc.org, without signing in. When we verify the request, we stop access and affected queued operations immediately, then delete from active systems within 30 days and let backups expire within 90 days.

The Data Deletion Policy explains verification, exceptions and what happens to content already published on a connected platform.

Send requests to hello@executioninc.org. We may need to verify your identity, but we will not require you to create or keep an account just to make a deletion request.

In Nigeria, you can complain to the Nigeria Data Protection Commission. You may also complain to a supervisory authority where mandatory law gives you that right.

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion.
• Receive data you provided in a portable format where applicable.
• Object to or request restriction of certain processing.
• Withdraw consent where processing relies on consent.
• Complain to a data protection authority.

Some providers process data outside Nigeria, including in the United States. Where required, we use contractual and organisational safeguards for those transfers.

AWS media storage is configured in US East 1. Google (including historical Google Analytics for Firebase data) and Resend may process data in the United States and other locations they disclose. Our virtual private server provider is Contabo, with processing location Germany. Zoho Mail processes incoming support and privacy email under its own terms and locations.

The service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18.

If we learn that an account belongs to someone under 18, we will stop access and delete the data, subject to legal requirements. If you believe a child has used the service, contact hello@executioninc.org.

We use essential cookies and browser storage needed to keep you signed in, remember interface preferences and protect the service. We do not use advertising cookies in this release.

Blocking essential storage may prevent sign-in and other core features from working.

We may update this policy as the service changes. The effective date and version at the top of this page show the current text.

If a change materially affects your rights, we will give reasonable notice before it takes effect, or ask for consent where required.

Timothy Odebunmi, trading as Omnisocial, based in Nigeria. Email: hello@executioninc.org.