Privacy Policy

Omega Nodes Company Ltd (“Omeganodes”, “we”), incorporated in Uganda, operates the Omeganodes Platform-as-a-Service and is the data controller for the personal data described here. Omega Nodes Italia di Francesco Galleano (trading as ThinkPink Studio), Italy, is a separate controller for the billing data of card and PayPal payments it collects and invoices. Both are listed in section 13. This policy explains what we collect, why, and the rights you have.

• Account data — name, email address and password (stored only as a salted hash).
• Usage data — projects, deployments, logs and security events such as sign-ins, needed to run and protect the Service.
• Billing data — plan, invoices, the payment method used and, when you provide them, your billing name, address and tax number. Card details are handled by Stripe or PayPal; we never see or store full card numbers. For manual mobile money we keep the transaction reference you send us.
• Technical data — IP address and device/browser information, used for security, fraud prevention and abuse detection.
• Product events — a few moments of your account (signed up, email confirmed, project created, deploy finished or failed, payment opened or confirmed), with your account id, the method or plan and the amount. Never your email, name or the content of your apps.
• Omega AI and the AI debugger, only when you use them — what you send to Omega AI (instructions, product data, images) and, when you run the AI debugger on a project, that project’s settings, what its address answers, the end of its build and runtime logs and, if you allow it, a few of its repository files. Variable values, known secret formats, email addresses and public IP addresses are removed before anything leaves our servers; you see exactly what is sent before you run it.
• Help chat, only when you use it — the questions you ask “Ask Omega” and its answers, and to answer them your plan and limits, your projects’ names, addresses and last deploy, your AI credit balance and how many tickets you have open.
• Analytics and advertising data, only with your consent — pages visited, clicks and device data in our analytics (HeyCatch), and the public pages you visit and your sign-up sent to Meta (Meta Pixel). See section 10.

We use personal data to provide and secure the Service, process payments, prevent fraud and abuse, send essential service and (where you opt in) product notifications, answer your Omega AI, AI debugger and help chat requests, answer your support requests (our staff may use an AI assistant to read a ticket and prepare a reply, which they check before it reaches you), check Marketplace reviews for spam and abuse before staff decide, match manual payments to invoices, explain anti-fraud signals and similar accounts to staff before they clear or block a sign-up (the AI never decides on an account), spot failed deploys and errors that affect many customers, check sites reported to us for phishing and scams, review Marketplace entries, suggest which customers to contact when their use drops, find the questions our guides do not answer yet, understand where people get stuck between signing up, deploying and paying so we can fix it, measure our advertising (only with your consent), and meet legal obligations.

Where the EU/UK GDPR applies, we rely on: performance of our contract with you (to provide the Service), our legitimate interests (security, fraud prevention and improving the Service, including the product events in section 2, which you can object to by writing to us), your consent (optional communications, and the analytics and marketing cookies of section 10, which you can withdraw at any time from “Cookie settings”), and compliance with legal obligations. Where Uganda’s Data Protection and Privacy Act, 2019 applies, we process data in line with its principles of lawful, fair and accountable processing.

We host data on dedicated servers in Falkenstein, Germany, within the European Union (provider: Hetzner). Personal data is encrypted in transit (TLS) and sensitive data is encrypted at rest (AES-256-GCM). We apply least-privilege access controls and isolate customer workloads in separate containers.

We do not sell your personal data. We share it only with the providers below, which process it on our behalf or as independent controllers for their own services, and where required by law:

• Hetzner Online GmbH (Germany and Finland (EU)) — Dedicated servers that host the platform, customer apps, databases and backups.
• Resend, Inc. (United States) — Delivery of transactional email (account, billing and deploy notices).
• Stripe (Ireland / United States) — Card payments, when you pay by card.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — PayPal payments, when you pay with PayPal.
• Cloudflare, Inc. (United States) — Bot protection (Turnstile) on sign-up and sign-in, when enabled.
• GitHub, GitLab, Google (United States) — Sign-in and repository access, only if you sign in with them or connect a repository.
• OpenRouter, Inc. (United States) — Routing Omega AI requests (your prompts, product data and images; when you run the AI debugger, that project's settings and logs with secrets removed and, if you allow it, its key repository files; your help chat questions and the account details needed to answer them; for our staff's AI tools, support tickets, NPS comments, Marketplace reviews and submitted Marketplace entries, manual payment details, the risk signals of a flagged sign-up and of the accounts that share something with it (without names, emails or IP addresses), failed deploy and error logs with secrets removed, the content of sites reported to us, account activity to draft a message to you, and help chat questions without who asked them) to AI model providers that do not train on them, only when you use Omega AI or the help chat, or our staff use these tools.
• Anthropic, PBC (United States) — Claude, the AI assistant our support staff use under commercial terms that exclude training on the data, to read support tickets and the account details needed to answer them and to prepare replies; staff check and send every reply, only for support requests.
• Telegram (United Arab Emirates) — Internal operational alerts to our staff, limited to account and project identifiers.

For analytics and, with your consent, advertising:

• HeyCatch, Inc. (United States) — our product analytics: the product events of section 2 and, only if you accept analytics cookies, the pages and clicks of your visits. It processes them on our behalf, under its Data Processing Addendum.
• Meta Platforms Ireland Ltd (Ireland) — only if you accept marketing cookies, the Meta Pixel sends Meta the public pages you visit on our site, your sign-up, your browser data and IP address. We and Meta are joint controllers for collecting and sending this data (EU Court of Justice, C-40/17 Fashion ID); what Meta then does with it is Meta’s responsibility, described in the Meta Privacy Policy. You can exercise your rights with us or with Meta. The pixel never runs in the dashboard.

When you host other people’s personal data in your apps and databases, we process it for you as a processor under our Data Processing Agreement.

Where personal data is transferred across borders, we use appropriate safeguards (such as standard contractual clauses or an equivalent lawful transfer mechanism) to protect it. HeyCatch processes data in the United States under the EU Standard Contractual Clauses; OpenRouter routes Omega AI, AI debugger, help chat and our staff’s AI tool requests from the United States under the EU Standard Contractual Clauses of its Data Processing Agreement; Anthropic processes the support tickets our staff work on with Claude in the United States under the EU Standard Contractual Clauses of its Data Processing Addendum; Meta may transfer data to Meta Platforms, Inc. in the United States under the EU–US Data Privacy Framework.

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account we delete or anonymise your personal data, except records we must keep by law: invoices and payment records are kept for the period tax law requires (up to 10 years for invoices issued in Italy). Error diagnostics are deleted after 90 days. Product events stay on our servers for 7 days after they are sent; your cookie choice is kept for 6 months, then we ask again. Omega AI chats, AI debugger answers and help chat conversations are deleted after 90 days; the logs and files sent to the model for a diagnosis are not stored. Encrypted backups of the platform database are kept for up to 6 months, after which deleted data disappears from them too.

Subject to applicable law, you may request to:

• access a copy of your personal data (you can export your data from account settings);
• correct inaccurate data or complete incomplete data;
• delete your data (“right to erasure”);
• object to or restrict certain processing, and withdraw consent at any time;
• lodge a complaint with your data-protection authority.

We use strictly necessary cookies to keep you signed in and to secure the Service. Analytics cookies (HeyCatch) and marketing cookies (Meta) are set only after you accept them in the cookie banner; until then, and after a “Reject all” or the X, those scripts do not run. Without JavaScript nothing is sent to them.

Change your choice at any time with Cookie settings at the bottom of every page (in the dashboard, in the account menu). Withdrawing consent stops the scripts and removes their cookies from our domain; cookies Meta set on its own domain are managed in your Meta account or your browser.

The Service is not directed to children under 18, and we do not knowingly collect their personal data.

We may update this policy and will note the date above. For privacy questions or to exercise your rights, write to info@omeganodes.ai. For billing data of card and PayPal payments you can also write to privacy@thinkpinkstudio.it. In Uganda you can complain to the Personal Data Protection Office; in the EU, to the data-protection authority of your country.