Privacy Policy

OmniCloser is a business service. Most of the personal data that flows through it is data about our customers’ own leads and customers, which those customers decide to process. This policy therefore describes two different things: what we do with personal data of our own (visitors, account holders, people who contact us), and what we do with the personal data our customers process through the service.

This policy applies to omnicloser.eproz.business, app.omnicloser.eproz.business, docs.omnicloser.eproz.business and our APIs. The Effective Date of this policy is 16 August 2026.

EPROZ is the controller for the personal data we process for our own purposes: website visitors, account registration and administration, billing, support requests, security and our own business communications. This policy describes that processing and is the notice we give you about it.

For the contacts, messages and conversations that a customer processes through OmniCloser, the customer is the controller. They decide whose data goes into the service, why, and for how long. We act as a processor for that data and handle it to provide, secure and support the service on the customer’s instructions. If you are an end user who has messaged a business that uses OmniCloser and you want your data accessed, corrected or deleted, contact that business directly — they are the ones who hold the relationship with you. If you contact us instead, we will pass the request on to them.

These roles depend on the actual circumstances of the processing. Where the facts differ from the description above, the allocation of roles under data-protection law follows the facts.

Information you give us directly

• Account information: name, email address, phone number, company name and role
• Billing information: billing contact and address, VAT details, subscription and invoice records
• Profile and workspace settings: time zone, language, notification preferences and team-member access
• Configuration and uploaded content: the instructions you give the AI agent, business and product information, FAQ and knowledge-base material, and files you upload
• Support communications: the messages, tickets and attachments you send us when you ask for help

Data you process through the service

• Contact data: contacts you import or that arrive through inbound messages — name, phone number, email, social or channel identifiers, tags and custom fields
• Conversation and message data: the content of conversations on the channels you connect, including text, images, voice notes, video and documents that people send, and the replies the agent generates
• Channel connection data: the account identifiers, connection settings and access tokens needed to send and receive messages on the channels you connect
• Appointment and scheduling data: bookings made from inside a conversation, including the time, participants and any details captured with the booking
• Campaign and automation data: the audiences, content, triggers and delivery records of the campaigns and automations you run
• AI inputs and outputs: the message content and context sent for AI processing, and the responses, summaries, classifications and tags produced from it

Payment information

When you subscribe to a paid plan, payment card details are handled by our payment processor. We do not store full card numbers on our servers; we may store a payment token, the last four digits of the card, the card brand and your billing address.

Information we collect automatically

• Usage data: pages and features used, actions taken in the application, and errors encountered
• Technical data: IP address, browser, device and operating system, and referring URL
• Log and security data: server logs, authentication attempts and security events

• To provide, operate, maintain and improve the service
• To process AI conversations and understand the media people send, such as transcribing a voice note or reading an uploaded document
• To deliver and meter messages across the channels you connect
• To measure usage against your plan’s OmniCredit allowance
• To provide customer support and respond to your requests
• To process billing, manage your subscription and detect fraud
• To secure the service and prevent abuse and security incidents
• To send service emails and, with your separate consent, marketing emails
• To comply with legal obligations and respond to lawful requests

We do not sell personal data, and we do not share personal data with third-party advertisers for cross-context behavioural advertising.

OmniCloser is built on AI, so message content and the context around it are sent to AI systems in order to work. Depending on what you enable, that processing may include:

• Generating replies in a conversation
• Summarising a conversation or its history
• Qualifying a lead and scoring or recording intent
• Classifying and tagging conversations and contacts
• Understanding images, voice notes, video and documents that people send, where those capabilities are enabled on your plan

This processing is carried out by AI service providers acting as sub-processors. Because AI processing is inherent to the service, it cannot be switched off while you use the AI agent, although you control which optional capabilities you enable and what information you give the agent to work with.

AI outputs can be inaccurate or incomplete. They are not a substitute for human review where the subject matter matters — see the AI Outputs section of our Terms of Service.

Where data-protection law such as the GDPR requires a legal basis for the personal data we process as controller, we rely on the following:

• Contract performance: processing necessary to provide the service you signed up for and to administer your account
• Legitimate interests: securing the service, preventing fraud and abuse, improving the product, and establishing or defending legal claims
• Consent: marketing emails and any other processing that requires consent, which you can withdraw at any time
• Legal obligation: tax, accounting and other regulatory requirements that apply to us

Where we act as a processor for a customer, that customer is responsible for having a legal basis for the personal data they put into the service.

You can object to processing based on legitimate interests, or withdraw consent, at any time by contacting us at privacy@eproz.business.

Where your data is hosted

OmniCloser and the data you process through it are hosted on cloud infrastructure in the European Union. Data is encrypted in transit using TLS, and access to production systems is restricted to authorised personnel.

Sub-processors

We rely on the following categories of sub-processor to handle personal data on our behalf. We require each of them to process personal data only under appropriate data-protection terms. Which of them apply to you depends on the channels and capabilities you enable.

The specific providers within each category, and where they process data, can change over time. You can request the current list, and ask to be told about changes, by contacting us at privacy@eproz.business.

Beyond these sub-processors, we do not sell personal data. We may share data with professional advisors under confidentiality obligations, with authorities where the law requires it, and in connection with a merger, acquisition or sale of assets subject to appropriate protections.

Our infrastructure is located in the European Union. Where a sub-processor processes personal data outside the European Economic Area, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism.

You can ask us for information about the safeguards that apply to a given transfer by contacting us at privacy@eproz.business.

We keep personal data only for as long as we need it for the purposes described in this policy, or for as long as the law requires.

• Account data: retained for as long as your account is open, and deleted or anonymised within a reasonable period after you close it
• Contacts, conversations and message data: Contacts and conversation content are retained for as long as your account is active, and are deleted from active systems within a reasonable period after your account is closed, unless a longer period is required by law.
• Financial records: retained for the period required by applicable tax and accounting law
• Backups: Backups are kept on a rolling basis and are overwritten in the normal course of operation.
• Server logs and security events: Server logs and security events are retained for a limited period for security, troubleshooting and abuse prevention.

As a customer you control retention of the data you process through the service: you can delete individual contacts and conversations at any time, and you can export your data before you close your account. You can ask us at privacy@eproz.business for the retention periods that apply to a specific category of data.

Under the GDPR and similar laws you have the following rights over your personal data. Some of them apply only in particular circumstances, and some are subject to exceptions — for example where we have to keep records for tax or legal reasons, or where a request would reveal someone else’s personal data.

• Access: to be told whether we process your personal data and to receive a copy of it
• Rectification: to have inaccurate or incomplete data corrected
• Erasure: to have your data deleted where one of the grounds in the law applies
• Restriction: to have processing limited while a dispute about accuracy or lawfulness is resolved
• Objection: to object to processing based on legitimate interests, and to object to direct marketing at any time
• Portability: where processing is based on consent or a contract and is carried out by automated means, to receive your data in a structured, commonly used, machine-readable format
• Withdrawal of consent: where we rely on consent, to withdraw it at any time, without affecting processing carried out before you withdrew it
• Complaint: to lodge a complaint with your local data-protection supervisory authority

To exercise these rights, contact us at privacy@eproz.business. We will respond within the time limits set by applicable law and may need to verify your identity first. If your data was given to a business that uses OmniCloser to talk to its customers, that business is the controller and we will forward your request to them.

OmniCloser is a business service and is not directed to children. It is not intended for individuals under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us at privacy@eproz.business and we will delete it.

This website

The OmniCloser website at omnicloser.eproz.business does not set cookies. We do not run analytics, advertising, tracking pixels or a tag manager on it, so there is no consent banner to accept and nothing to opt out of. The site loads its web fonts from Google Fonts, which means your browser requests those font files from Google and Google receives your IP address as part of that request. If you open a design-preview link on the site (a URL containing ?theme= or ?layout=), your choice is remembered in your browser’s session storage for that tab only and is never sent to us.

The application

Signing in to app.omnicloser.eproz.business requires strictly necessary cookies or equivalent browser storage to keep you authenticated, to remember your workspace and preferences, and to protect the security of your session. These are essential to providing a service you have asked for, so they are set without consent and cannot be switched off while you use the application.

We do not use cookies for advertising or cross-site tracking. If we introduce analytics or other non-essential cookies in future, we will update this policy and ask for your consent where the law requires it.

We use technical and organisational measures appropriate to the risk to protect personal data, including:

• Encryption of data in transit using TLS
• Access controls that limit access to production systems and personal data to authorised personnel who need it
• Authentication and access logging on accounts and administrative actions
• Periodic review of our security measures

We do not currently claim any third-party security certification or audit for OmniCloser. If that changes, we will say so here rather than implying it.

No system can be completely secure. If we become aware of a personal data breach that is likely to result in a risk to people’s rights, we will notify the relevant supervisory authority and affected users as required by applicable law, and we will inform any customer whose data is affected without undue delay.

We may update this policy from time to time. For material changes we will give reasonable advance notice by email or in-app notice before the changes take effect. For non-material changes we will post the updated policy here with a revised “Last updated” date.

For privacy questions, or to exercise your rights, contact us at the address below. Please include enough information for us to verify your identity and act on your request.

• EPROZ
• Privacy contact: privacy@eproz.business

You also have the right to lodge a complaint with the data-protection supervisory authority in the country where you live or work.