Privacy Policy

Last updated: 21 August 2026.

Omni.ba is software operated by UniCode d.o.o., Brčko District, Bosnia and Herzegovina (“we”). This policy explains what data we collect, why, who we share it with and how long we keep it. If you have questions, call 062 080 246 or write to podrska@omni.ba.

1. Who this applies to

Omni.ba is intended for businesses only. This policy covers data about the people who use the Service on behalf of a company (owner, employees) and the data the company enters into its account.

2. Who is responsible for which data

This is the most important distinction in the whole document:

For data about your account (company name, first and last name, e-mail, phone, payment records) we are the controller.
For the data you enter about your own customers — names, phone numbers, addresses, tax numbers, job history — you are the controller and we are only the processor. We hold and process that data on your instructions, as part of running the application. The obligation to have a legal basis for processing it, to inform your customers and to answer their requests is yours. If your customer contacts us, we will refer them to you.

3. What data we collect and why

Account data — company name, first and last name, e-mail, phone, line of business. Basis: performance of the contract. Purpose: opening the account, sign-in, support.
Business data you enter — customers, items, work orders, documents, products, expenses. Basis: performance of the contract with you; towards your own customers the controller is you (section 2).
Billing data — records of subscription payments, payment reference, status. Basis: the contract and the legal obligation to keep records.
Messages — if you fill in the contact form or write to us from the application: name, e-mail, phone and the text of the message.
Technical data — the session cookie, basic error logs and security logs. Basis: legitimate interest (running and securing the service).

We do not sell data, we do not use it for advertising and we do not use it to train AI models.

Marketing and disclosure to third parties. We do not run marketing campaigns using your data and we do not pass it to third parties for their use — which is why we have never asked for your consent to do so. If you do receive any message you do not want, it is enough to say so at the contact in section 13 and it stops immediately, with no explanation required and no consequences for your subscription.

4. Where data is stored

Data is stored with our infrastructure providers, on servers in the European Union. Every company has a technically separate space: database-level access rules make it impossible for one company to see another company’s data. Access is limited to the users you have authorised yourself and, to the extent necessary, our staff for maintenance and support.

5. Service providers (sub-processors)

We use established infrastructure providers to run the Service. Each of them receives only what is necessary for its function, namely for:

hosting the application,
the database, sign-in and file storage,
sending e-mail (e.g. password resets, notifications),
protecting forms from automated abuse,
reporting technical errors so faults can be fixed,
relaying requests to the AI model, solely for Omni AI features (section 6).
processing card payments for the subscription — Dodo Payments, which is also the merchant of record on the subscription invoice.

When paying by card, you enter the card number, expiry date and security code (CVV) on the Dodo Payments page — that data never reaches us and we have nowhere to store it. All that comes back to us is the fact that the charge was approved, the amount, and the date access is paid up to. Because Dodo is the legal seller, it also issues your invoice, and for that purpose it processes your invoicing data under its own privacy policy. More detail on the Payment security page.

A named list of providers, with their role and place of business, is available on request — write to the contact in section 13. The list changes when the technical setup changes.

6. Omni AI — what is sent to the model and what is not

Omni AI features call a language model through a specialised provider. The call is made exclusively from our server — your browser never talks to the model directly and the access key never leaves the server.

Your customers’ personal data is stripped before sending. When Omni AI answers a question about your business, the data that goes to the model passes through a cleaning step that removes phone number, e-mail, address and tax number.
When scanning paperwork, the document itself goes to the model — the one you selected (a photo or a PDF), because reading it is not possible otherwise. You choose which document you send.
The call carries a flag saying the prompts must not be stored and a ban on routing to providers that store them. We cannot, however, guarantee a third party’s conduct beyond what we have technically influenced.
We do not store the content: our usage records note who called the AI, when, and what it cost — not the text of your question or the content of the document.
Conversation history stays on your device (browser storage) and is not sent to us. Clearing your browser data clears it as well.

On the accuracy of what the AI returns and on responsibility for decisions made on that basis, see the Terms of Service, section 7.

7. How long we keep data

While the account is active — for as long as you use the Service.
After the subscription ends — 90 days, after which the data may be permanently deleted.
Payment records — as long as tax and accounting rules require.
Technical error logs — short term, as a rule up to 90 days.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing and to data portability. You can export all of your data yourself, at any time (Settings → Export all, labelled “Postavke → Izvezi sve” in the app). To delete your account, contact us at the address below; we act without undue delay and within 30 days at the latest. If you believe we have infringed your rights, you may contact the competent personal data protection authority.

9. Security

Data is transmitted exclusively over an HTTPS connection protected by SSL/TLS encryption — both on our pages and on the Dodo Payments page used for payment. Access is separated per company by database-level rules, together with the roles and permissions you assign to your own users. We keep regular backups. No system, however, is absolutely secure and we cannot guarantee that an incident will never occur. In the event of a data breach that poses a risk, we will notify you without undue delay.

10. Cookies

We use only essential cookies — the ones that keep you signed in and store basic settings (theme, menu layout). We have no advertising cookies, no third-party trackers and we do not follow you across other sites. That is why there is no cookie consent banner either.

11. Children

The Service is not intended for persons under 18 and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy. The date of the last change is shown at the top of the page, and we will notify you of material changes in the application or by e-mail.

13. Contact

"UniCode" (Jedinstveni kod) društvo sa ograničenom odgovornošću za proizvodnju, trgovinu i usluge, Brčko distrikt BiH
(short form: UniCode d.o.o.) · Brka bb, 76100 Brčko distrikt BiH
Tax ID (JIB) 4600493000006 · VAT number 600493000006 · Registration number (MBS) 96-01-0014-22, Osnovni sud Brčko distrikta BiH
Phone: 062 080 246 · E-mail: podrska@omni.ba