OmniFire← Back to home

Privacy Policy

Last updated: September 28, 2026

NiceMatrix Technologies Inc. (“Company”, “we”, “us”, or “our”) operates OmniFire at omnifire.app (the “Service”). This Privacy Policy (the “Policy”) explains what personal information we collect, how we use and share it, your rights, and how you can contact us. By accessing or using the Service, you agree to the practices described in this Policy. Capitalized terms used but not defined here have the meaning given to them in our Terms of Service.

We act as the data controller for the information we collect about you as our customer — your account, billing, usage, and technical data. Where you use the Service to manage your own audience, brands, listings, or apps — including the content you publish and the comments, messages, reviews, and statistics we retrieve from the platforms you connect — we act as a data processor on behalf of the workspace that owns the connection, and that workspace is the controller. Section 2.1 sets out this split in full.

1. Information We Collect

1.1 Account Information

When you create an account through our authentication provider (Logto SSO), we receive and store:

We do not store your authentication passwords — these are managed entirely by our SSO provider (Logto).

1.2 Social Media Account Connections

When you connect a third-party social media platform to OmniFire through OAuth, we collect and store:

Some platforms are not connected through OAuth. Where a platform requires an application password, bot token, API key, developer key, or an equivalent manually supplied credential, we store that credential in the same encrypted form and use it only to perform the actions you have asked us to perform on that platform.

1.3 Content Data

We store the content you create and manage through the Service, including:

1.4 Workspace and Collaboration Data

If you create or join a workspace, we also collect information that supports team collaboration:

1.5 Usage Data

We automatically collect information about how you use the Service:

1.6 Payment Information

Payment processing is handled by Stripe, Inc. We do not store full card numbers, CVV codes, or other sensitive cardholder data. Stripe provides us with:

1.7 Technical Data

We collect technical information including:

1.8 Communications

If you contact us by email or through in-product messaging, we retain the content of your messages together with your email address so that we can respond and keep a service history. This includes product feedback and support requests you submit inside the Service, and our replies to them.

1.9 Engagement Data About Other People

If you use the Engagement Inbox, we retrieve from the platforms you have connected the interactions that other people direct at your accounts, and store them so that your team can read, reply to, and moderate them in one place. This information includes:

This information concerns individuals who are usually not OmniFire users. We process it as a data processor, on the documented instructions of the workspace that connected the account (Section 2.1). We do not use it to build advertising or behavioural profiles, we do not combine it with data from other sources to enrich it, we do not sell it, and we do not use it to train AI models.

1.10 Analytics and Insights Data

Where a connected platform makes performance data available, we retrieve it on a scheduled basis and store daily snapshots so that trends remain visible over time:

Audience geography and comparable demographic breakdowns are supplied by the platforms in aggregate form only. We do not receive the identity or the location of any individual follower, and we do not attempt to re-identify individuals from these aggregates.

1.11 Brand and Business Profile Data

If you use Brand Profiles to maintain business listings, we store the information you enter and publish on your instruction:

Where an address is completed, validated, or converted into coordinates, the address text is sent to Google Maps Platform for that purpose (Section 3.9). Business contact details you publish become publicly visible on the listing platforms you select — do not enter personal information that you do not intend to make public.

1.12 App Store and Developer Data

If you connect an Apple App Store Connect or Google Play developer account in order to manage and measure your apps, we store the credentials you supply and the reporting data we retrieve with them:

This is commercially sensitive information. It is visible only to the members of your workspace whose role and client assignment permit it, and to authorised personnel under the conditions described in Section 5.1.

1.13 Cloud Storage Connections

If you connect a cloud drive (Microsoft OneDrive, Dropbox, or Google Drive) in order to import media, we store:

We read file and folder metadata only so that you can browse and search the drive, and we transfer the contents of a file only when you select that file for import. We do not create, modify, or delete anything in your drive.

2. How We Use Your Information; Legal Bases

We use the information we collect for the purposes listed below. Where the General Data Protection Regulation (“GDPR”) or a similar law applies, the corresponding legal basis is shown in brackets.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

2.1 Our Role: Controller and Processor

For some of the information described in Section 1 we decide why and how it is processed, and we are the controller. For other information we act only on your instructions; in that case the workspace owner is the controller and we are the processor.

Where we act as your processor, you are responsible for having a valid legal basis for the processing, for giving any notice the individuals concerned are entitled to, and for responding to their requests — see Section 7.4 of this Policy and the corresponding section of our Terms of Service. We process that data only on your documented instructions, restrict access to personnel who need it, apply the safeguards described in Section 5, engage sub-processors only under written terms no less protective than those we owe you, assist you with data-subject requests and security incidents so far as we reasonably can, and delete or return the data in accordance with Section 4.

3. How We Share Your Information

We share personal information only with the categories of recipients listed below, and only to the extent necessary to operate the Service or comply with law. All service providers are contractually required to handle your data securely and use it only for the purposes we specify.

3.1 Connected Social Media Platforms

When you publish through OmniFire, the content and account metadata needed to complete the publication are transmitted to the platforms you have connected. Supported platforms include (without limitation) Twitter/X, Facebook, Instagram, Threads, LinkedIn, Pinterest, YouTube, TikTok, Mastodon, Bluesky, Telegram, Discord, VK, Weibo, WeChat Official Accounts, WeChat Channels (视频号), Xiaohongshu, Douyin, Bilibili, and Kuaishou. Each platform processes your data according to its own privacy policy and terms.

The same applies to engagement: when your team sends a reply or a private message, hides, deletes, or reports a comment, or blocks a participant through OmniFire, that instruction and any message content are transmitted to the platform concerned and are thereafter governed by that platform's own policies. Actions taken on a platform may be irreversible, and we cannot recall a message once it has been delivered.

3.2 Identity and Authentication — Logto

Account authentication is handled by Logto. The name, email address, and SSO identifier you provide at sign-up are processed by Logto on our behalf.

3.3 Payment Processing — Stripe

Your payment information is processed by Stripe, Inc. Stripe’s handling of your data is governed by Stripe’s Privacy Policy.

3.4 AI Providers

When you use AI-assisted features, the specific content you submit for processing is sent to the AI provider configured for the Service. Depending on that configuration the provider may be OpenAI, Anthropic, Google, DeepSeek, or another provider that exposes an OpenAI-compatible interface, and it may process your submission in a country other than your own. We only send the content you choose to process; we do not forward unrelated data, and AI features are never applied to your engagement inbox. For OpenAI, the applicable terms are set out in their privacy policy.

3.5 Media Storage and CDN — Cloudflare

Media files you upload are stored on Cloudflare R2, and videos that must be converted to satisfy a destination platform’s format requirements are transcoded using Cloudflare Stream. Cloudflare also provides CDN, DNS, and security services that may process IP addresses and request metadata on our behalf. See Cloudflare’s Privacy Policy.

3.6 Email Delivery — Resend

Transactional emails, periodic report emails, and service announcements are delivered through Resend, Inc. Your email address, message content, and delivery metadata are shared with Resend solely for delivery and bounce handling.

3.7 SMS Delivery — Twilio / Aliyun

Where you enable SMS notifications, your phone number and the message content are shared with our SMS providers (currently Twilio, Inc. and/or Alibaba Cloud Aliyun SMS) solely for delivery.

3.8 Hosting Infrastructure

Our application and databases are hosted on professionally managed cloud infrastructure with providers such as Hetzner Online GmbH. These providers process data only as necessary to provide hosting, network, and storage services.

3.9 Google Services

Depending on the features you use, information is transmitted to Google LLC and its affiliates:

Google’s handling of this data is governed by the Google Privacy Policy.

3.10 Apple Services

If you connect Apple App Store Connect, the credentials you supply are used to make signed, authenticated requests to Apple Inc. in order to retrieve your app’s sales, download, rating, and review data, and to send the responses you write to customer reviews. If you publish a brand profile to Apple Business Connect, the profile information you select is transmitted to Apple for that listing. Apple’s handling of this data is governed by the Apple Privacy Policy.

3.11 Microsoft and Dropbox

If you connect a Microsoft OneDrive account, authenticated requests are made to Microsoft Graph in order to browse and download the files you select, and if you export a brand profile to Bing Places the profile information you select is transmitted to Microsoft; see the Microsoft Privacy Statement. If you connect Dropbox, the equivalent requests are made to Dropbox, Inc.; see the Dropbox Privacy Policy.

3.12 Reference Exchange Rates

To present app-store proceeds in a single display currency, we retrieve daily reference exchange rates from an exchange-rate service operated by NiceMatrix Technologies Inc. Only a currency code and a date are sent for this purpose; no personal information, workspace identifier, or financial amount leaves our systems.

3.13 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

3.14 Legal Requirements

We may disclose your information when we believe in good faith that disclosure is necessary to comply with applicable law, lawful requests from public authorities, court orders, or to protect the rights, property, or safety of the Company, our users, or the public.

4. Data Retention

We retain personal information only as long as necessary for the purposes set out in this Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Default retention guidelines:

We may retain anonymized or aggregated data indefinitely for analytics and product improvement; such data cannot reasonably be used to identify you.

5. Data Security

We implement administrative, technical, and organizational measures designed to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. These measures include:

No security measure is perfect. We cannot guarantee that unauthorized access will never occur, and you are responsible for maintaining the confidentiality of your account credentials.

5.1 Staff Access to Account Data

Authorized personnel may access limited account connection metadata when necessary to provide support, maintain security, investigate technical issues, or comply with legal obligations. Such access is role-restricted; sensitive fields are masked by default, and each disclosure is logged with the accessing person, time, and reason. Your platform access tokens, developer keys, and cloud-drive tokens are never exposed to staff.

The same restrictions apply to engagement content, analytics, and app-store data. We do not read the messages in your inbox or your app revenue figures as a matter of routine; access occurs only in response to a support request you raise, a security or abuse investigation, or a legal obligation, and it is logged in every case.

6. Data Breach Notification

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required by law, affected users without undue delay. Notice will describe the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures we have taken or propose to take. Where we act as your processor, we will notify you without undue delay after becoming aware of a breach affecting the data we process for you, so that you can meet your own notification obligations. Where applicable, we will also notify you at the email address associated with your account or by posting a notice on the Service. If you suspect a security incident, please contact us at [email protected] immediately.

7. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

To exercise any of these rights, contact us at [email protected]. We will respond within the time required by applicable law (typically 30 days).

7.1 For EU/EEA and UK Residents (GDPR / UK GDPR)

In addition to the rights above, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you. We do not currently make automated decisions of this kind. If we ever do, we will provide notice and the option to request human review.

7.2 For Canadian Residents (PIPEDA)

You have the right to access your personal information, request corrections, and file a complaint with the Office of the Privacy Commissioner of Canada if you believe we have mishandled your information.

7.3 For California Residents (CCPA / CPRA)

California's California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA / CPRA), gives you additional rights, including the right to know what personal information we have collected about you, the right to delete or correct that information, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioral advertising. You may exercise your rights by contacting us at the email below.

7.4 If You Interacted With a Business That Uses OmniFire

If you commented on, messaged, reviewed, or otherwise interacted with an account managed through OmniFire, we hold that interaction only on behalf of the business that operates the account. That business decides why and for how long it is kept, and is the correct first point of contact for any request to access, correct, or delete it — it can remove the conversation from its inbox at any time.

If you cannot identify or reach that business, write to us at [email protected] with enough detail to locate the interaction. We will forward your request to the responsible workspace, require it to be handled, and where the law makes us directly responsible we will act on it ourselves. We will never use your details for any purpose other than resolving your request.

7.5 Deletion Instructions Received Through a Platform

Some platforms require us to honour a data-deletion instruction sent by the platform itself on behalf of one of its users — for example, when a person removes the OmniFire application from their platform account. On receiving such an instruction we revoke and erase the affected credentials and stop retrieving further data for that connection. Records already collected into a workspace are handled as described in Section 4 and can be deleted by the workspace owner at any time.

8. Cookies

We use cookies and similar browser storage for the following purposes:

A small number of pages load a component supplied by a third party directly into your browser — most notably the Google map shown on brand-profile pages — and that provider may store its own identifiers or preferences on your device under its own privacy policy. Such components load only on the pages where the feature is actually used.

We do not use advertising cookies or cross-site tracking cookies, we do not participate in advertising networks, and the OmniFire application itself does not set analytics cookies. For how the analytics providers handle data, see Google’s Privacy Policy and the Microsoft Privacy Statement.

9. Children’s Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly. If you believe a child under 16 has provided us with personal information, please contact us at [email protected].

Where a workspace uses the Engagement Inbox, comments, messages, and reviews are retrieved from the connected platforms exactly as those platforms deliver them, and may originate from individuals whose age we cannot determine. We do not solicit that content and do not process it beyond making it available to the workspace concerned. Such content can be deleted by the workspace owner, and we will act on a request sent to the address above.

10. International Data Transfers

NiceMatrix Technologies Inc. is established in Canada. Your data may be transferred to and processed in countries other than your country of residence, including Canada, the United States, the European Union, mainland China (where you connect a Chinese platform or where a Chinese notification or AI provider is used), and any region where our service providers or the platforms you connect operate. We implement appropriate safeguards for such transfers, such as the European Commission’s Standard Contractual Clauses, equivalent UK international data transfer mechanisms, and relying on adequacy decisions where available. Where you instruct us to publish content or send a message to a platform, that transfer is made on your instruction and to the destination you have chosen.

11. Third-Party Links

The Service may contain links to third-party websites or platforms. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review the privacy policies of any third party you visit.

12. Governing Law

This Policy is governed by the laws of the Province of Alberta, Canada, without regard to its conflict-of-laws principles, and subject to any mandatory consumer-protection or data-protection law that applies in your jurisdiction.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy on the Service with a new “Last updated” date and, where appropriate, notify you by email. Your continued use of the Service after the updated Policy takes effect constitutes acceptance of the changes.

14. Contact Us

If you have questions or concerns about this Policy or our data practices, please contact us: