Privacy Policy
Effective 23 October 2026
This policy explains what AI Sales Agent (“the Service”), operated by AI Sales Agent, does with personal data. It covers data about the people who use the Service and data about the people they research through it, because both are personal data and the second is easy to overlook.
1. About this project, and who is responsible
AI Sales Agent is a project built as part of a software engineering internship programme. It is operated by an individual rather than a company, is provided free of charge, and is not a commercial service. There is no registered company behind it and therefore no registered office; everything in these pages is handled by the contact address below.
For account data and the Service’s own operation, AI Sales Agent is the controller. All privacy requests go to admin@omnexlab.site, which reaches a person.
For the business contacts a user adds to their own workspace, that user — or the organisation they work for — is the controller, and this Service acts as a processor on their behalf. If you are such a contact and want your data removed, write to us and we will act on it and tell the workspace owner.
2. What the Service collects
Account data
- Email address and password, handled by our authentication provider. Passwords are stored only as salted hashes, never in readable form, and are not visible to us.
- Display name, and the professional details you choose to enter.
- Email confirmation and sign-in timestamps.
Workspace content you create
- Your professional profile, business context and target-audience descriptions.
- Prospects and contacts you add, including name, role, company, and business email address where you provide or verify one.
- Opportunities, content drafts, email drafts, notes and activity history.
- Records of each AI request: which provider was used, when, and whether the result was real or simulated.
Technical data
- Server logs containing IP address, request path, status and timing, kept for operational diagnosis.
- A session cookie, which is strictly necessary to keep you signed in.
The Service sets no advertising or analytics cookies and does not track you across other websites.
3. LinkedIn data
If you connect a LinkedIn account, the Service requests only the permissions needed for the features you use — identifying your account, and publishing content you have explicitly approved. It receives your basic profile information from LinkedIn for that purpose.
Specifically, the Service:
- stores LinkedIn access and refresh tokens encrypted, and uses them only to perform actions you have approved;
- publishes nothing without your explicit, per-item approval;
- does not scrape LinkedIn, automate connection requests or messages, read other members’ data, or use unofficial endpoints or browser automation;
- does not sell, rent or transfer LinkedIn data to anyone, and does not use it to build a profile of any third party;
- deletes stored LinkedIn data when you disconnect the account or delete your workspace.
You can revoke the Service’s access at any time from LinkedIn’s own settings, which takes effect immediately regardless of anything in your account here.
4. Why we process it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Providing the Service you signed up for | Performance of a contract |
| Sending verification, password reset and approval notifications | Performance of a contract |
| Keeping the Service secure, diagnosing faults, preventing abuse | Legitimate interests |
| Researching and contacting business prospects you add | Legitimate interests of the workspace owner, within the limits in section 7 |
| Complying with legal obligations | Legal obligation |
5. Who else receives data
The Service uses the following processors. Each receives only what its function requires, and none is permitted to use the data for its own purposes except as noted.
| Processor | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication and file storage | Account details and all workspace content |
| Vercel | Application hosting | Request metadata, including IP address, in server logs |
| Spacemail | Sending transactional email | Recipient address and message content |
| Mistral, Google (Gemini), Groq | Generating drafts, analysis and classifications | The text submitted for a given task, which may include professional and prospect details |
| SerpApi | Public web research | Search queries, which may include a company or person’s name |
| Hunter | Finding and verifying business email addresses | Names and company domains |
| Himalayas, Arbeitnow | Public job and opportunity listings | Search criteria only; no personal data is sent |
One caveat worth stating plainly: the AI providers above are used on their free tiers, and free tiers may use submitted content to improve their models. Do not paste anything confidential into AI-assisted fields. Where a feature can work on a summary rather than raw personal data, it does.
We do not sell personal data, and we do not share it for advertising. Data may be disclosed if we are legally required to, or to establish or defend legal claims.
6. Where data is stored
Data is held by the processors above, which operate internationally and may process data outside your country. Where that involves a transfer out of the UK or EEA, it relies on the processor’s own transfer safeguards, typically Standard Contractual Clauses.
7. Outbound contact and your obligations as a user
The Service helps draft outreach. It does not send anything without your approval, and the following are prohibited by the Terms and enforced in the product:
- importing purchased, rented or scraped contact lists;
- mass or unsolicited bulk sending;
- contacting anyone who has asked not to be contacted.
If you contact people through the Service, you are responsible for having a lawful basis to do so under the rules that apply where they are — which differ materially between jurisdictions.
8. How long data is kept
- Account and workspace data — while your account exists, then deleted within 30 days of a deletion request.
- Server logs — a short operational period, typically no more than 30 days.
- Suppression records — kept after deletion of other data, because honouring a “do not contact” request requires remembering it.
9. Your rights
Subject to the law that applies to you, you may request access to your data, its correction or deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests. You can also withdraw consent where consent is the basis.
Write to admin@omnexlab.site. We aim to respond within 30 days. See Data deletion for how to delete an account and what that removes. If you are in the UK or EEA you may also complain to your supervisory authority.
10. Security
Data is encrypted in transit. Passwords are hashed by the authentication provider. Credentials for third-party services are stored encrypted and are never exposed to the browser. Access to data is restricted at the database level so one workspace cannot read another’s.
No service can promise perfect security, and we do not. If a breach affects your data and presents a risk to you, we will notify you and any required regulator without undue delay.
11. Children
The Service is for business use by adults and is not directed at anyone under 18. We do not knowingly collect their data.
12. Changes
If this policy changes materially we will update the effective date above and notify account holders by email before the change takes effect.