OmniMind

GDPR overview

The privacy policy carries a dedicated section headed "Additional Disclosures for General Data Protection Regulation (GDPR) Compliance (EU)", in which the publisher declares itself a data controller. Four legal bases are named — consent, performance of a contract, legitimate interests and legal obligation — and the rights of access, rectification, erasure, restriction, objection and portability in CSV are all listed, along with the right to complain to a supervisory authority. Transfers outside the EEA are said to rest on standard contractual clauses approved by the European Commission or binding corporate rules. Parental consent is required below sixteen. The publisher is itself established in the European Union, in Estonia, so no Article 27 representative applies. Two gaps remain visible: no data processing agreement is offered, and no formal subprocessor register is published — only a list of eight third-party services.

Who owns the data?

The privacy policy states that uploaded content belongs to the customer and is used only to run the service or to answer support requests, and that deleting data in the application deletes it from the vendor's servers. A file or website added to an agent is not kept as a file or website unless the customer explicitly allows it. The terms nevertheless have the customer grant the publisher, Procoders OÜ, a non-exclusive, fully paid-up and royalty-free licence to process that content for the operation and maintenance of the application, and users waive moral rights on it where the law permits. The publisher acts as data controller for the personal information it collects.

Reuse rights

Customers keep the right to reuse their own uploads and the answers their agents produce; nothing in the terms restricts commercial use of that output. The restriction runs the other way: content belonging to the platform itself may not be copied, resold, republished or turned into derivative works beyond ordinary use of the service. On the vendor's side, the privacy policy limits processing to delivering and improving the service, analytics, security and legal compliance, and states plainly that customer data is not used to train any OpenAI models. Eight named third parties receive data — Google Analytics, Hotjar, Amplitude, PayPal, Stripe, Sentry, Google Payments and Apple Pay. Customers may plug in their own OpenAI key, which also keeps those calls off the credit meter.

Data retention & training

Hosting summary

The privacy policy states that data at rest is held in a Pinecone vector database whose server is hosted by Google Cloud Platform in the us-west1-gcp region, placing it in the United States. No alternative region is offered and no European hosting option is documented, which is a notable gap given that the publisher itself is established in Estonia. Customers who want the storage under their own control can connect their own Weaviate database instead, and their own OpenAI key for model calls. The site's own web server resolves to an address operated by DigitalOcean in London, United Kingdom. For personal data leaving the European Economic Area, the policy relies on standard contractual clauses approved by the European Commission, binding corporate rules or another legally accepted mechanism. Eight third-party services are named as recipients: Google Analytics, Hotjar, Amplitude, PayPal, Stripe, Sentry, Google Payments and Apple Pay. No hosting certification of any kind is published.