Privacy Notice
Effective date: 1 October 2026 · OmnixNova Technology
DPDP Act 2023 Compliant · Amazon DPP Compliant · Last reviewed: 1 October 2026
1. Who We Are
OmnixNova Technology ("OmnixNova") operates the OmnixNova platform at app.omnixnova.com. We are a Data Fiduciary under the Digital Personal Data Protection Act 2023 (DPDP Act) with respect to data of our brand customers (you). For data of your end-customers processed through our platform, we act as a Data Processor on your behalf.
2. Data We Collect
We collect: (a) Account data: name, email, phone, company name, GST number when you register. (b) Usage data: how you use the Platform, features accessed, session logs. (c) Payment data: subscription tier, billing email — payment card details are handled by our payment processor and not stored by us. (d) Brand data: product listings, inventory, pricing data you upload or sync. (e) Customer data: your customers' phone numbers, emails, purchase history, browsing behavior — only when you use OmnixNova's customer communication features. (f) Technical data: IP address, browser type, device information, cookies.
3. How We Use Your Data
We use your data to: (a) Provide and improve the Platform services. (b) Process payments and manage subscriptions. (c) Send service communications (product updates, security alerts). (d) Generate analytics and reports for your use. (e) Train and improve our AI models using anonymised, aggregated data only — never individual customer data. (f) Comply with legal obligations. We do NOT sell your data to third parties. We do NOT use your data for advertising.
4. Your Customers' Data (Data Processing)
When you use OmnixNova's customer communication features, we process your customers' personal data (phone numbers, emails, behavior) on your behalf as a Data Processor. You are the Data Fiduciary. You must: (a) Obtain valid consent from your customers before using our WhatsApp, retargeting, or abandoned cart features. (b) Maintain a Privacy Policy on your website disclosing OmnixNova's role. (c) Honour customer opt-out and erasure requests. Our Data Processing Agreement (DPA) governs this processing.
5. Amazon SP-API Data
If you connect your Amazon account, we access data via Amazon's SP-API in accordance with Amazon's Data Protection Policy. We use Amazon data solely for: fulfillment operations, business analytics for your own use, and customer service. Amazon customer names and contact details are not stored beyond 90 days and are never used for non-Amazon marketing.
6. Cookies and Tracking
OmnixNova uses essential cookies for authentication and session management. Our retargeting script (installed on your website with your consent) tracks visitor behavior to enable personalized WhatsApp retargeting. Your website visitors must consent to tracking via a cookie banner before the script activates. We use no advertising cookies on our own Platform.
7. Data Sharing and Third Parties
We share data with: (a) Supabase — database infrastructure (data stored in secure cloud). (b) Brevo — email delivery for reports and notifications. (c) Shiprocket — shipping data for logistics integration. (d) WhatsApp Business API (Meta) — message delivery for campaigns. (e) Amazon SP-API — marketplace data sync. (f) Legal authorities — when required by law. We have data processing agreements with all sub-processors. We do not share your data with any other third parties.
8. Data Retention
We retain: Account data for the duration of your subscription plus 7 years (GST compliance requirement). Customer personal data: deleted 90 days after contract end or on request. Behavior tracking events: auto-deleted after 90 days. Campaign messages: auto-deleted after 1 year. Amazon order data: auto-deleted after 90 days. You may request earlier deletion at any time.
9. Your Rights Under DPDP Act 2023
Under the Digital Personal Data Protection Act 2023, you have the right to: (a) Access — request a copy of personal data we hold about you. (b) Correction — request correction of inaccurate data. (c) Erasure — request deletion of your personal data (subject to legal retention requirements). (d) Grievance redressal — raise concerns with our Data Protection Officer. (e) Nominate — nominate a person to exercise rights on your behalf. To exercise these rights, contact: privacy@omnixnova.com. We will respond within 72 hours.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data including: encrypted data storage (Supabase with AES-256), TLS encryption for data in transit, access controls and role-based permissions, regular security assessments, and API key rotation policies. In the event of a data breach affecting your data, we will notify you within 72 hours.
11. International Data Transfers
Your data is processed on Supabase infrastructure. Some data may be processed by sub-processors in locations outside India (including the EU and USA). We ensure appropriate safeguards are in place for such transfers through standard contractual clauses and processor agreements.
12. Children's Data
OmnixNova is a B2B platform for businesses. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected such data, contact us immediately.
13. Data Protection Officer
Our Data Protection Officer can be contacted at: privacy@omnixnova.com | OmnixNova Technology, Pune, Maharashtra, India. For complaints not resolved by us, you may contact the Data Protection Board of India (when constituted under the DPDP Act).
14. Changes to This Policy
We may update this Privacy Policy. We will notify you of material changes via email or Platform notification with 30 days' notice. The current version is always available at omnixnova.com/legal/privacy-notice.