Privacy Policy

1. Who we are

OmniRelay is operated by MIRVOS PTE. LTD., a company registered in Singapore (“we”, “us”, or “our”). This policy covers personal information handled through omnirelay.ai, its account console and APIs, and communications with us.

For privacy questions, access or correction requests, withdrawal of consent, or account deletion requests, contact [email protected], addressed to the Privacy Contact, MIRVOS PTE. LTD..

2. Information we handle

• Account information: your email address, name, account and workspace identifiers, role, status, and registration date. Supabase manages passwords for new accounts; existing legacy accounts retain salted password hashes, not original passwords.
• Login and security information: hashed session references and expiry, authentication events, browser/User-Agent, IP address, sign-in method, first observed sign-in, last activity, end time and observed session duration, plus API key names, prefixes, hashes and rate-limit records. Users can view their own login history and authorised administrators can view records within their permitted scope. The interface does not show device hostnames. Infrastructure may also process network request or error logs.
• Service records: selected models, request identifiers, timestamps, token counts, calculated costs, request status, account balances, ledger entries, and administrative audit events. For each API call we also record the source IP address, to enforce a key's IP allowlist, show the address in your request log, and investigate misuse; it is cleared from request records after 90 days. Per-key IP allowlists and call-rate and concurrency limits are stored with the key or workspace settings.
• Submitted content: prompts, conversation messages, and other information you submit for processing, plus communications you send to support.
• Preferences: language and appearance preferences stored in your browser.

Please do not submit passwords, payment-card details, confidential third-party material, or sensitive personal information that is not necessary for your use of the service.

3. Live service and request content

OmniRelay enables live model service per workspace and offers top-ups through available payment checkout. A live request forwards submitted content to the corresponding service provider to generate the reply; a public model listing does not grant account access. Isolated demo workspaces use simulated responses and credits.

The request-history database stores usage, cost and diagnostic metadata, not prompt or response text. This is not a universal zero-retention guarantee for infrastructure logs, browser state, upstream providers or support communications. Provider processing and retention depend on the actual service arrangements.

4. Google and other third-party sign-in

Where offered, third-party sign-in allows an identity provider to authenticate you. For Google sign-in, we request basic identity information: your provider account identifier, email address, name, and profile image if supplied. We use that information to authenticate you, create or maintain your account, display your profile, and help secure the service. We do not request access to Gmail messages, Drive files, contacts, or calendars for sign-in.

Supabase processes authentication information when Supabase-backed sign-in is used. GitHub or Apple sign-in, if enabled, similarly supplies the identity information permitted by the provider and your choices. We do not receive your provider password. Authentication information is not submitted as model prompt content merely because you sign in.

You can revoke Google access through your Google Account connections, or use the corresponding controls for other providers. Revoking access does not automatically delete an existing OmniRelay account; contact us to request deletion.

5. Why we use information

We use information to provide accounts and workspaces, authenticate users, process requested operations, show usage and balances, answer support requests, troubleshoot faults, prevent abuse, maintain security, and meet legal obligations. We also use operational information to understand and improve reliability. Where consent is required, we seek it; where applicable law permits another basis for processing, we rely on that basis.

The application does not include an advertising network or an application-level model-training pipeline. We do not describe model providers as having a particular training or retention policy until their actual arrangements have been assessed and disclosed.

6. Who may receive information

Information may be processed by hosting, network-delivery, authentication, payment, email and support service providers as needed to perform their functions. Current service providers are:

• AWS: hosting, databases and backups.
• Cloudflare: network delivery and security services.
• Supabase: account authentication.
• Stripe: payment checkout and processing. Stripe receives the payment details you enter on its hosted checkout page, the amount and order reference, and the billing details you provide for receipts, and may use them for fraud prevention under its own privacy policy.
• Airwallex: payment checkout and processing. Airwallex receives the payment details you enter on its hosted checkout page, the amount and order reference, and the billing details you provide for receipts (such as name, email address, address and tax number). We do not receive or store full card numbers.
• Resend: email delivery, including verification and password-reset emails, beta invitations and waitlist notices, account notices, and sign-in security codes for administrators. Resend processes recipient addresses, message content and delivery information.
• Model relay partner and model providers: live requests are routed through an upstream model relay partner to the provider of the model you select (for example OpenAI, Anthropic, Google, DeepSeek, Moonshot AI or Z.ai). They process the request content and the usage metadata needed to generate and bill the reply, under their own terms and retention practices.

Workspace administrators can see information available to their role, including member details, usage, and audit records.

We may disclose information when legally required, to investigate misuse or protect people and the service, or as part of a business transfer subject to appropriate protections. We do not sell personal information or share it for cross-context behavioural advertising. Independent third-party websites and identity providers have their own privacy policies.

7. Cookies, local storage, and external resources

The application uses an essential omni_session cookie to keep you signed in, with a configured lifetime of up to seven days. Signing out invalidates that session. Authentication providers may use their own session or security cookies during sign-in. Supabase sign-in stores authentication and refresh tokens in browser local storage to maintain and refresh your session. Multiple-account switching also stores saved accounts’ refresh sessions and basic profiles locally, not passwords. Signing out of the selected account does not sign out other saved accounts; sign out of each saved account on a shared device. The legacy/demo session cookie described above applies to legacy and demo accounts. Browser local storage also remembers language and theme choices; it is not an advertising identifier.

Some site styles load fonts from Google Fonts. Loading those resources sends ordinary network information, such as your IP address, to Google. You can clear cookies and local storage in your browser, but this may sign you out or reset preferences. We will provide appropriate notice and choice before introducing non-essential tracking that requires consent.

Analytics is one such use, and it is off until you allow it. On your first visit we ask, and nothing from Google is loaded and no analytics cookie is set unless you accept; declining is remembered exactly as accepting is, and you can change your answer at any time through the Cookie settings link in the footer. If you accept, Google Analytics sets _ga and _ga_* cookies and receives the page path, the page title and ordinary network information such as your IP address. It never receives the query string or fragment of a URL, so a payment order reference or a sign-in code cannot reach it. We also use Cloudflare Web Analytics, which sets no cookie and stores no identifier for you, and therefore runs without consent.

8. Retention, security, and international processing

We retain information for the purposes described here, taking account of account activity, security investigations, dispute resolution, and legal requirements. Session expiry does not necessarily mean immediate deletion of the corresponding database record. We have not established a single fixed deletion period for all categories of data. Account closure and deletion requests are reviewed against necessary legal and security retention; limited records or backups may remain until they can appropriately be removed.

We use safeguards such as password hashing, restricted account access, and secure connections. No system is completely secure. If a personal-data incident occurs, we assess it and provide notifications required by applicable law.

Our service providers may process information outside Singapore. Where personal information is transferred overseas, we are responsible for arranging protections required by applicable Singapore law; we do not promise Singapore-only data residency.

9. Your choices and requests

You may ask us about the personal information we hold, request access or correction, withdraw consent where applicable, or request account closure and deletion by emailing [email protected]. We may need proportionate identity verification before acting. Some requests are subject to legal exceptions; we will explain relevant restrictions and any permitted fee before proceeding. Withdrawal of consent may prevent us from providing features that require the information.

If you use a workspace managed by another organisation, that organisation may also be responsible for its use of your information. Contact its administrator where appropriate. If our response does not resolve your concern, you may contact Singapore’s Personal Data Protection Commission or another competent authority.

10. Age and policy updates

OmniRelay is intended for adults aged 18 or over, not for children. If you believe a child has supplied personal information, contact us so we can review and address it.

We may update this policy as the product or our practices change. The date above identifies this version. We will provide additional notice of material changes where appropriate and obtain fresh consent where required. Questions may be sent to [email protected].