Privacy Policy

OmniChan is a marketing workspace for planning, publishing and measuring social media, email and advertising. It is operated by Lightning Leap Analytics Private Limited, H No 506, Plot 36-D, Sector 56, Gurugram, Haryana 122003, India (“we”, “us”). We are responsible for the personal data described in this policy.

Where you upload data about other people to your workspace — for example an email contact list — you decide what that data is for, and we process it on your behalf and on your instructions.

• Account data. Your name, email address and organisation name; your password, stored only as a one-way hash; and, if you use them, your passkeys, two-factor settings and the Google or GitHub account you sign in with.
• Workspace content. The projects, posts, drafts, media, campaigns, email contacts and other material you and your team create or upload.
• Connected-platform data. When you connect a social or advertising account, the data that platform shares with us with your permission — described in the two sections below. We never see or store your password for those platforms.
• Billing data. Your plan and subscription status. Card details are entered on Stripe’s checkout and never reach our servers.
• Usage and security logs. The IP address and browser of each signed-in session, and an audit log of security-relevant actions such as sign-ins and permission changes.
• Cookies and local storage. The app keeps your sign-in token and display preferences in your browser’s local storage, and sets a 10-minute cookie while you sign in with Google or GitHub to protect that sign-in. Our public marketing pages set a first-party cookie (verjson_visitor_id, up to 24 months) to count visits and page views; it is not set inside the app or on this page. Microsoft Clarity’s cookies are described under product analytics, below.
• Product analytics. We use Microsoft Clarity to see how our website and app are used: clicks, scrolling and page views, shown to us as heatmaps and session recordings. Inside the app, on sign-in pages and in the client portal, recordings replace all text and images on screen, so your content, messages and contacts are never sent to Microsoft; and Clarity never records what anyone types into a form. Clarity sets its own cookies (_clck, up to a year, and _clsk, one day), and Microsoft may set its MUID cookie. Microsoft processes this data as described in the Microsoft Privacy Statement.
• Messages to us. What you send when you request a demo or email us.

• To provide the service: publish and schedule your posts, show your analytics, run your campaigns and emails, and let your team work together.
• To keep accounts secure, prevent abuse, and investigate problems.
• To bill you for a paid plan.
• To send you messages about your account, such as password resets, invitations and deletion confirmations.
• To meet our legal obligations.

We do not sell personal data and do not use it to show you advertising. When you use an AI feature — for example drafting a caption or suggesting a reply — the content you send to it is passed to third-party AI model providers solely to generate the output you asked for. Separately, the text of comments and messages that arrive in a connected account’s inbox is sent automatically to our AI model provider, Groq, to label each one positive, neutral, negative or mixed, so your team can sort and prioritise them.

OmniChan, operated by Lightning Leap Analytics Private Limited, connects to Facebook Pages and Instagram professional accounts only when a user chooses to connect them. With the user’s permission we access: the names, profile pictures and follower counts of the connected Pages and Instagram accounts; the posts published through our app and their insights; comments on those posts; and Messenger and Instagram Direct messages sent to the connected accounts, including the sender’s name and profile picture.

We use this data only to publish and schedule the user’s posts, show their analytics, and let their team read and reply to comments and messages. We do not sell it, use it for advertising, or share it with third parties other than our infrastructure providers (DigitalOcean, Cloudflare, Resend) and our AI model providers: the text of each incoming comment and message is sent automatically to Groq to score its sentiment (positive, neutral, negative or mixed), and, when a team member asks for an AI-drafted reply, the content involved is sent to the AI model provider that drafts it. They process it only on our behalf, to produce that output.

Access tokens are stored encrypted. Disconnecting an account deletes its access token immediately. Users can delete all their data at any time as described at https://studio.lightningleap.store/data-deletion.

Requests from public authorities: if we receive a request from a public authority for users’ personal data, we review whether it is lawful, challenge it where we consider it unlawful, disclose only the minimum data necessary, and keep a record of each request and our response.

OmniChan uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google handles your data as described in the Google Privacy Policy.

We connect to a YouTube channel only when you choose to connect it. With your permission we access:

• Your channel’s profile — its name, handle, profile picture and its subscriber, view and video counts — to show which channel is connected and how it is growing.
• Video uploads — when a video you scheduled in OmniChan is due, we upload it to your channel with the title, description and settings you chose.
• Your existing videos — the titles, descriptions, thumbnails, publish dates and privacy status of the videos on your channel, so they appear alongside the ones you publish through us.
• Video statistics — the view, like, dislike, comment and favourite counts of your videos, to show how they perform.

We store this data in our database, and the access and refresh tokens Google issues to us are encrypted at rest. It is shown to the members of the workspace the channel is connected to. We do not sell it or use it for advertising. When someone in that workspace uses an AI feature, such as drafting posts or generating a content plan, the titles, descriptions and statistics of published videos can be part of what is sent to the AI model provider, solely to produce that output.

Disconnecting the channel in OmniChan deletes its access and refresh tokens immediately, so we can no longer reach your channel. Its name and picture, the videos you published or imported, and their statistics are kept so your reports stay complete. Once the channel is disconnected, deleting it permanently from the same menu also erases the statistics we collected for it, and deleting the project it belongs to erases the channel, its videos and their statistics. A channel belongs to the workspace it is connected to, so deleting your own OmniChan account does not disconnect it.

Disconnecting in OmniChan does not remove the permission from your Google Account. You can revoke our access at any time at https://security.google.com/settings/security/permissions; after that we can no longer reach your channel and mark it disconnected the next time we try.

OmniChan’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can also connect Threads, LinkedIn (to post from your personal profile), Pinterest, TikTok and X. The same principles apply to each: we connect only when you choose to, request only the permissions needed to publish your posts and report on them, and where a platform allows, show your comments and messages so your team can reply. From each we store the account’s name, identifier and profile picture, the posts you publish through us and their metrics, and an encrypted access token.

Disconnecting any account deletes its access token immediately. You can also revoke our access from the platform’s own settings at any time.

• DigitalOcean — hosting and database.
• Cloudflare — network delivery and secure connections to our servers.
• Resend — sending account and transactional email.
• Stripe — payments and subscription billing.
• AI model providers (including Groq) — generating output for the AI features you use, and scoring the sentiment of incoming comments and messages.

Each processes data only to provide its service to us. The platforms you connect (Meta, LinkedIn and the others above) receive what you publish through us under their own privacy policies.

We are based in India and our servers are hosted by DigitalOcean in the United States, so your data is transferred to and stored in the United States. Our processors may handle it in other countries where they operate. We rely on our agreements with them to protect it wherever it is processed.

• Account and workspace data: while your account is active.
• Access tokens for a connected account: deleted as soon as you disconnect it.
• After you delete your account: a 7-day window in which you can cancel, then your personal data is permanently deleted.
• A data export you request: available to download for 7 days.
• Billing records and the record that a deletion happened: as long as the law requires.

Subject to the law that applies to you — including India’s Digital Personal Data Protection Act, 2023 and, where it applies, the EU and UK GDPR — you can:

• Access and export your data: sign in and go to Settings → Privacy to download an archive.
• Delete your account from Settings → Privacy, or follow the data deletion instructions.
• Correct inaccurate details by asking us.
• Withdraw consent for a connected platform by disconnecting it.
• Complain to us, and to your data protection authority (in India, the Data Protection Board of India).

For anything you cannot do in the app, email [email protected]. We reply within 30 days.

Connections to the service are encrypted in transit. Access tokens and other credentials are encrypted at rest, and passwords are stored only as one-way hashes. You can protect your account with two-factor authentication or a passkey, and workspace owners control what each team member can see and do. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

OmniChan is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

We will update the date at the top of this page when we change the policy, and tell you in the app or by email before a material change takes effect.

Lightning Leap Analytics Private Limited, H No 506, Plot 36-D, Sector 56, Gurugram, Haryana 122003, India. Email [email protected].