# Oomira Privacy Policy

Effective October 2026.

## 1. Introduction

Welcome to Oomira. We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how Oomira Holdings Inc. (“Oomira,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards your information when you use our services.

## 2. Information we collect

Information you provide:

- Account information (name, email address)
- Payment information, which is collected and held by Stripe; card details never reach Oomira
- The company you ask about (its website address) and the questions you ask
- An email address you give us to receive a report
- Whether you asked for product news, and when and on which form you asked
- Communications with us (support requests, feedback)

Information we gather to answer your questions:

- The answers AI assistants give to the questions asked
- Copies of the public web pages those assistants and our own checks opened, kept as the evidence behind each answer

Information collected automatically:

- Usage data (pages visited, features used, actions taken), including through Google Analytics (section 10)
- Device information (browser type, operating system)
- Log data (IP address, access times, error logs). IP addresses are also used to limit request rates.
- Email activity: when an email we send you is opened, and which of its links are clicked
- Cookies and browser storage, described in section 10
- **A device identifier:** Your browser computes an identifier from its own settings, which is stored in that browser and sent with a run so free allowances can be counted per device rather than per account. It is used for that and for billing, never to decide who owns a record or to sign you in, and it is not sold or shared with advertisers.

## 3. How we use your information

- Provide, maintain, and improve our services
- Process transactions and send related information
- Send technical notices, updates, and security alerts
- Respond to your comments, questions, and customer service requests
- Measure how our pages and emails are used (Google Analytics, email opens and clicks)
- Send product news through our mailing list, to people who ticked the box asking for it, to customers for two years after their last purchase, and to people who asked for a report before October 2026 for six months after they asked. Every mailing has an unsubscribe link.
- Detect, prevent, and address technical issues and security vulnerabilities
- Comply with legal obligations

Your information is not used to train AI models, by Oomira or by the AI providers in section 5. We use those providers through their commercial APIs, under terms that do not allow them to train on what we send, and we have not opted in to any provider's data sharing.

## 4. Information sharing and disclosure

We do not sell your personal information. We may share your information in the following circumstances:

- **Service providers:** The companies listed in section 5, which process information on our behalf to run Oomira.
- **Legal requirements:** We may disclose information if required by law or in response to valid legal requests.
- **Business transfers:** In connection with any merger, sale of company assets, or acquisition.
- **With your consent:** We may share information with your explicit consent.

## 5. Service providers

These companies process information on our behalf, each for the purpose listed:

- **Supabase:** our database and sign-in. Hosted on AWS in Montreal, Canada.
- **Vercel:** runs our application servers, in Montreal, Canada.
- **Cloudflare:** delivers our website and stores images and logos, on its global network.
- **Anthropic, OpenAI, Google (Gemini) and Perplexity:** the AI assistants Oomira asks your questions, and the models that analyze their answers and the web pages behind them. OpenAI also converts stored pages into embeddings used for search. United States. Each keeps API logs for up to 30 days for abuse monitoring.
- **Exa and Brave:** web search. United States.
- **Browser Use:** opens public web pages in a browser. United States.
- **SendGrid (Twilio):** sends our email. United States.
- **Klaviyo:** our mailing list, holding the names and email addresses of the people in section 3 who may receive product news. United States.
- **Stripe:** processes payments.
- **Google Analytics:** measures visits and page views on our website and app. United States.
- **ipwho.is:** estimates an approximate location from an IP address, only when a person is researched through our API, as a suggestion that person confirms.

To research a company, Oomira also looks it up in public sources, such as Wikipedia, the Internet Archive and company registries. Those lookups send the company's name or website address, not your personal information.

## 6. Where your information is stored

Oomira's database and application servers are in Montreal, Canada. The providers in section 5 outside Canada process what their service needs: the AI providers, search providers and Browser Use receive the questions asked, the answers and public web pages; SendGrid receives the email addresses we write to; Klaviyo receives the names and email addresses on our mailing list; Google Analytics receives website usage data; Stripe receives payment details; and Cloudflare carries traffic to our website and stores images and logos. We will email account holders at least 30 days before we add a service provider or move stored information to a new region.

## 7. Data security

Traffic to Oomira is encrypted with TLS, and so is the connection between our servers and our database, which verifies the database's certificate. Data is encrypted at rest (AES-256) by Supabase for the database and by Cloudflare for stored files. Access is controlled per account: a record is readable by its owner and by readers that owner has authorized. Passwords are hashed by Supabase Auth, API keys are stored only as hashes, and payment card details are handled by Stripe and never held by Oomira.

No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

## 8. Data retention

We keep your information for as long as your account is open, so results can be compared over time, and you can ask for a copy of it at any time. When you ask us to delete your account or your information, we delete it from our database within 30 days of the request. Database backups are kept for 30 days, so it is gone from backups within a further 30 days. We keep only what the law requires us to keep, such as billing records. A record of each sign-in attempt (the time, the address used, whether it worked, the IP address and browser) is kept for 90 days, only to detect and investigate misuse of accounts. The AI providers in section 5 delete their API logs within 30 days.

## 9. Your rights and choices

Depending on your location, you may have certain rights regarding your personal information:

- **Access:** Request access to your personal information
- **Correction:** Request correction of inaccurate information
- **Deletion:** Request deletion of your information
- **Export:** Request a copy of your data in a portable format
- **Opt-out:** Opt out of certain data processing activities

Oomira handles personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). To exercise these rights, email us at the address below and we will respond within 30 days.

## 10. Cookies and similar technologies

We use:

- A cookie and browser storage that keep you signed in
- Google Analytics cookies, which measure visits and page views. You can turn them off at any time from “Cookie settings” in the footer. If you visit from Quebec, the European Union or European Economic Area, the United Kingdom or Switzerland, they are set only if you choose “Allow analytics” in the bar at the foot of the page.
- A cookie that records which of those applies to you (from the region of your connection, kept 30 days), and one that remembers your choice for a year, so you are not asked again
- The device identifier described in section 2
- A small image and link redirects in our emails, which record opens and clicks

When analytics is off, Google Analytics sets no cookie, so nothing it receives links one visit to the next. Advertising cookies stay off whatever you choose. A completed payment is counted in Google Analytics by its amount and payment reference, with no cookie, name or email address.

You can block cookies in your browser settings, though you will not stay signed in without them. Google offers a browser add-on that opts you out of Google Analytics.

## 11. Children's privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us.

## 12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We post every change on this page and update the “Effective” date, and we email account holders about a material change before it takes effect, at least 30 days ahead for a new service provider or a new storage region. Your continued use of our services after a change takes effect constitutes your acceptance of the updated Privacy Policy.

## 13. Contact us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

**Oomira Holdings Inc.**  
Ontario, Canada  
Email: [privacy@oomira.com](mailto:privacy@oomira.com)

Oomira Holdings Inc. is registered in Ontario, Canada and operates as Oomira. It was founded by Katherine Homuth.

Canonical HTML: https://oomira.com/privacy