Privacy Policy

Omesta Systems LLC (“Omesta”, “we”, “us”) provides advertising measurement, optimization and related integration tools. Our mailing address is 5830 E 2nd St, Ste 7000 #33555, Casper, WY 82609, United States. Contact support@omestasystems.com about this notice or your personal information.

We determine how account, billing, support and service-security information is used. When a business or event organizer directs us to process its customer information, we generally act on that organization’s behalf. Its own notice also applies; advertising platforms and other recipients may have their own responsibilities and privacy terms.

Omesta currently serves US customers. This does not exclude rights that apply because of an individual’s location or the processing involved. This notice is not a certification of compliance or a substitute for a required data-processing agreement.

We receive information from you, your device, authorized account members, connected providers, installed tracking, webhooks and applications you authorize. Categories depend on features and permissions:

• Account and communications: name, email, business/profile details, authentication identifiers, preferences, messages, support requests and material submitted to AI tools.
• Workspace and team activity: workspace identifiers, invited email addresses, roles, membership and invitation status, account connections, approvals and relevant access or action records. These support account administration and the access available in your version of the service.
• Creative and AI work: prompts and chat history; campaign or website context; briefs, scripts, copy, reference links, brand information, submitted images or other media; generated outputs, reviews, proposals, job status and related usage records for enabled tools. Media and free-text submissions can include personal information.
• Billing: subscription and invoice identifiers, plan, payment status and billing metadata. Stripe handles payment entry for Omesta subscriptions; our checkout does not ask you to send full card details to Omesta’s application server.
• Connections and advertising: OAuth credentials, account identifiers, permissions, campaign names/content, targeting, budgets, spend, impressions, clicks, conversion metrics, search reports and action histories.
• Customers, bookings and events: available names, emails, phone numbers, CRM contact/opportunity details, conversation/message responses used for follow-up analysis, booking status, event/ticket information, registrations and check-ins. Event rosters can store readable names and contact details.
• Commerce: available order, checkout, product, customer, invoice, payment, refund and subscription data, amounts, currencies, statuses and provider metadata.
• Website and technical information: URLs, referrers, timestamps, events and values, click/ad identifiers, UTM parameters, visitor/session identifiers, browser/device and IP/network information, interaction signals and consent preferences. Configured form detection can read email and phone fields.

Raw identifiers may be received before server-side hashing. Hashed identifiers used for matching are still personal information, not anonymous data. An API response may contain fields beyond what a report displays. See the Integration Data Disclosure for platform-specific categories and actions.

• Provide accounts, subscriptions, authorized integrations, reports and support.
• Match website, CRM, payment, booking and event activity within a customer account; measure advertising outcomes and identify attribution gaps or wasted spend.
• Carry out supported campaign changes, conversion delivery and audience operations under the relevant feature configuration and authorization.
• Operate event rosters and check-in tools, and deliver configured notifications or API responses to authorized destinations.
• Generate AI-assisted analysis, recommendations or drafts using feature-specific context.
• Administer team invitations, preserve conversation and decision history, review or produce supported creative assets, and measure feature usage. Where human ad management is expressly agreed, provide the account review and campaign work within that service scope.
• Measure usage, troubleshoot, prevent abuse, secure the service, communicate about accounts and meet applicable legal obligations.

Home, Analytics, Plan, Apps, Campaigns, Creatives, Chat and Events organize the relevant features; moving data into a new screen does not create permission for a new purpose. The new dashboard preview currently uses illustrative data. Its proposed production-credit wallet, top-ups, multi-workspace purchasing and new image/video pipeline are not represented here as live services.

Enabled AI features can combine your message or brief with relevant campaign, performance, website, finding or prior-conversation context. Selected context is sent to configured AI services to produce answers, recommendations, drafts or action proposals. Conversations, outputs and associated records may be retained to provide history, support, investigate errors and record authorized actions; closing the chat does not delete them. The retention and request rules below apply.

For creative tools that are enabled, processing can include submitted assets and URLs, brand instructions, generated copy or media, review feedback, job identifiers, usage and delivery status. Configured infrastructure and creative providers receive the inputs needed for that workflow. A planned model or provider shown in a prototype is not confirmation of a production recipient. We must disclose material new recipients or uses and obtain any required authorization before enabling them.

Campaign scoring, audience matching, CRM-stage analysis and optimization may involve inferences or profiling. These support advertising decisions, and enabled automation may make campaign changes without a fresh approval for each one. They are not intended to decide an individual’s employment, credit, insurance, housing, healthcare access or similar consequential eligibility. Do not use Omesta for those decisions. Contact us about applicable objection, restriction or review rights; consent and platform restrictions still apply.

Do not submit passwords, unnecessary customer records, protected health information or other prohibited sensitive material to prompts, brand assets or creative jobs. This notice does not grant a new right to use your content for generalized AI model training. Provider retention, training settings and contractual safeguards must be assessed for the service actually used; we do not claim universal zero retention or a verified no-training arrangement for every provider.

Where a legal basis is required, it depends on the purpose: necessary performance of our contract with an individual account holder; legitimate interests in business administration, security and service operation, subject to individuals’ rights; applicable legal obligations; or consent where required for tracking, communications or advertising use. A contract with a business does not by itself authorize tracking its visitors.

Customers must establish an appropriate basis and provide required notices and choices for data they direct us to process. Omesta remains responsible for its own obligations. Connecting an account, accepting Terms or reading this notice is not an end customer’s marketing consent. A processing agreement must be separately arranged where required.

Retention depends on the record’s purpose, account relationship, customer instructions, applicable agreements, legal requirements, security needs and unresolved disputes. Categories include account and billing records, credentials, reports, tracking/matching records, rosters, support communications, actions and delivery logs, team invitations, AI conversations, creative assets, generated outputs and job or usage records for enabled tools.

Disconnecting a provider and revoking its authorization are separate from deleting historical reports, rosters, identities or logs. Reporting lookback windows are not storage-deletion limits. Account and tracking-deletion tools cover particular records and do not establish that every backup, derived record or external copy has been erased.

Our previously published notice specified 24 months for conversion/activity logs, 12 months after last activity for hashed identifiers, and deletion of cached Google data within 30 days of revocation. The Terms also contain a 30-day post-termination deletion commitment. Where those commitments apply, they remain obligations; this update does not extend them. They are not a representation that every automated purge or backup-deletion path has been verified. Contact us to confirm the status of a particular request.

Contact us to request deletion or retention details for your records. We must assess applicable obligations and confirm scope, exceptions and completion rather than treat a disconnect as complete erasure. Applicable deadlines and protections in earlier accepted agreements or notices remain relevant; this clarification does not retrospectively extend them. See Data Deletion.

Depending on applicable law and our role, you may request access, a copy, correction, deletion, portability or restriction; withdraw consent; object to certain processing; or opt out of sale, sharing, targeted advertising or certain profiling. These rights have legal conditions and exceptions.

Email support@omestasystems.com with the subject “Privacy request”, the relevant business or event and enough information to locate your records. You do not need an Omesta account to ask. Do not send passwords, full payment details or sensitive identity documents in an initial request. We may need proportionate identity or authority verification, including for an authorized agent.

If we process information for a customer, contact that business or organizer as well; we may coordinate the request with them. Where GDPR applies, the usual response period is one month from receipt, with extensions permitted in specified circumstances and notice within that first month. Other laws have different deadlines. Using email does not postpone applicable deadlines.

You may ask us to reconsider a refusal by replying “Privacy appeal” and complain to the relevant regulator where the law provides that right. We will not unlawfully discriminate against you for exercising privacy rights. Withdrawing consent does not invalidate processing that was lawful before withdrawal.

Authentication uses cookies; tracking uses cookies or browser storage for preferences, click identifiers and sessions. Optional website analytics is paused by default pending review. When enabled, Google Analytics requires a current affirmative choice in Cookie settings; Global Privacy Control keeps it off. Rejecting optional analytics does not prevent sign-in or use of the service.

The separately installed customer tracking script has a configurable strict opt-in mode (requireConsent: true). Without that setting it can track without a recorded choice. In the current customer script, a saved marketing choice is read before Global Privacy Control; unlike our website analytics control, that script does not give the browser signal unconditional priority. Customers must connect a suitable consent manager and verify the required consent and opt-out behavior before using tracking. Installing the script is not consent. Server-side and webhook integrations have separate controls and are not covered by a browser cookie choice alone.

Use browser storage/tracking controls and contact us or the relevant business to exercise applicable choices. Browser controls alone do not recall delivered data or stop independent server events. See our Cookie Policy. These implementation details do not waive requirements to obtain consent or honor applicable opt-outs.

• Infrastructure: Vercel and Supabase handle application hosting, storage, authentication and database operations. Configured storage/job services, including Inngest where enabled, may process files or job payloads.
• AI: configured OpenAI or Anthropic services can receive prompts, campaign names, performance figures, findings, website content and submitted material for user-facing features. Creatify can receive creative context/assets when that separately configured feature is enabled. Do not submit information you are not authorized to share.
• Billing and email: Stripe processes Omesta billing. Resend or a configured SMTP provider receives recipient details and message content, which may include reports or account information.
• Connected platforms: Meta, Google, TikTok, GoHighLevel, Eventbrite, Calendly, Shopify, Stripe and Square exchange supported data according to permissions, configuration and their terms. Not every connection is enabled for every account.
• Authorized access: account members, event operators, support personnel and authorized partner applications/webhook recipients may access information needed for their role. Personnel delivering expressly agreed human ad management may review relevant business instructions, campaign data, creatives and action history for that scope. External automations such as Zapier have separate permissions and recipients.

Information may also be disclosed when legally required, to address security or legal claims, or in a business transaction subject to applicable notice, consent and contractual restrictions. Contact us for deployment-specific provider information. This list does not represent that a particular DPA, residency option or vendor no-training setting has been contracted.

Our use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including applicable Limited Use requirements. This notice does not authorize uses prohibited by those requirements.

• Sign-In: account identifier, email, name and available profile image support account creation/authentication.
• Google Ads: adwords supports authorized account, campaign and performance reads and supported writes. Writes are not limited to Autopilot; available campaign tools also create or modify assets.
• Google Analytics: the separate analytics.readonly connection reads accessible property metadata and reporting dimensions/metrics.
• Search Console: the separate webmasters scope is write-capable, although the reviewed reporting connector lists sites and reads search performance.
• Data Manager: datamanager supports configured conversion and Customer Match uploads.

Google-derived account/reporting information passes through application and infrastructure providers, including Vercel and Supabase, for the connected features. Configured OpenAI or Anthropic analysis may receive campaign context and metrics. Account communications and report content may pass through the email service. We do not promise all campaign context stays inside Omesta or that only Anthropic is used.

Limited Use restrictions apply to covered Google API data and its derivations, restricting transfers, human access, advertising uses and secondary purposes. Omesta must not sell covered Google API data, use it for unrelated ad targeting or generalized AI training, or treat this notice as permission to broaden an existing grant. New uses or recipients requiring authorization need appropriate disclosure and consent before use.

Separately, customers can direct eligible first-party conversion/audience information to Google for measurement and Customer Match. Payloads can include click identifiers, hashed email/phone identifiers, event times, values, currencies and consent signals. This is distinct from Google-derived reporting data. Hashing does not remove consent requirements. Uploads must meet Google’s Customer Match policies and EU User Consent Policy where applicable.

Disconnect in Omesta and revoke access in Google Account permissions. Revocation and local credential clearing are distinct from historical deletion. For deletion, follow section 06. Google’s processing is also described in its Privacy Policy.

Configured delivery can transmit events, values, URLs, click identifiers, hashed contact details and available technical matching information to Meta, Google or TikTok. Audience features can send eligible identities for matching and targeting. These disclosures may constitute “sharing”, targeted advertising or, depending on the law and circumstances, a sale even without a cash payment. Hashing does not make them anonymous.

With the relevant Meta connection, the Eventbrite bridge can automatically forward registrations. Outcome synchronization can also forward recorded attendance and add hashed attendee identities to a Meta customer-list audience. These paths do not independently verify each attendee’s marketing consent. Website consent controls do not establish permission for those transfers.

Event names, attendance, URLs or CRM context can reveal sensitive matters such as health or religious interests. Do not send prohibited sensitive data to advertising destinations. Customers and Omesta must address applicable notice, consent, opt-out and platform restrictions; an organizer’s OAuth approval is not an attendee’s consent.

Our implementation includes authenticated access, HTTPS, scoped database access, credential handling, selected webhook checks and audit records. Contact/event information is not universally hashed; authorized users can view readable rosters. No system is guaranteed secure. This notice does not claim independent security certification, universal endpoint protection or verified encryption configuration for every external system. Report suspected incidents to support@omestasystems.com.

Omesta is a US business using cloud and platform providers that may process information in the United States and other countries. We do not promise EU-only hosting or a customer-selectable EU region. Provider locations and contractual safeguards must be confirmed for the relevant deployment.

We do not currently offer an approved standard DPA through account settings. If your proposed use requires a processing agreement or international-transfer safeguards, contact us before connecting that data. Required arrangements must be established before processing; linking this notice does not establish them. See European privacy information.

Omesta’s account service is intended for business users, not children. Customers must not use advertising features to upload children’s data or prohibited sensitive information. Do not submit medical records, government identifiers, financial-account credentials or unnecessary sensitive material to tracking or AI features. If such information or a child’s information has been collected, contact us for appropriate handling; this notice does not claim every inbound field is automatically screened.

Attribution, identity matching, traffic-quality scores, recommendations, audience selection and enabled campaign actions use automated processing. Outputs can be inaccurate. Do not rely on Omesta for eligibility decisions about individuals in employment, housing, credit, insurance, health care or similarly consequential contexts. Contact us or the responsible business about applicable objection, review or profiling rights.

Updates will be identified on this page, with notice of material changes as required by law or applicable agreements. An updated notice does not authorize a new purpose, remove required consent or retrospectively override earlier privacy commitments. Where additional consent is required, continued use alone is not a substitute.