Privacy Policy for Omniscope Cloud SaaS

Effective Date: 6 October 2026

Visokio (UK) Limited (“Visokio,” “we,” “our,” or “us”) is dedicated to safeguarding your privacy while using the Omniscope Cloud software-as-a-service platform (“Service”) hosted at https://omniscope.visokio.com. This Privacy Policy explains how we collect, use, store, and protect your personal information and data uploaded to the Service, along with your rights and obligations.

By using the Service, you acknowledge that you have been informed of the practices described in this Privacy Policy. This notice does not replace consent where consent is required by law or limit your statutory rights.

1. Scope of This Privacy Policy

This Privacy Policy applies to all users of the Service, including free trial/evaluation users and paid subscribers, and covers:

Information we collect directly from you.
Information collected automatically through your use of the Service.
Information shared with third-party services (e.g., Stripe for payments).

This Privacy Policy does not cover:

The independent practices of third-party websites, applications, or services linked to or integrated with Omniscope Cloud. Our own handling of information sent to those services remains covered.
Information you share outside the Service and which we do not receive or process. Our legal duties still apply to information uploaded in breach of the Terms.

2. Data We Collect

a. Information You Provide

Account Registration: Name, email address, and other details you submit during account setup.
Payment Details: Payment information is processed securely by Stripe. Payment-card details and payment-method tokens are handled by the third-party processor and are never stored on Visokio servers. We receive the customer and subscription identifiers, invoice details, amounts, payment status and transaction references needed to administer billing. These references are distinct from card details and payment-method tokens.
Support Requests: If you contact us for assistance, any information provided (e.g., emails, screenshots, or logs) may be retained to address your issue.

b. Automatically Collected Information

Device and Usage Data: Includes IP address, browser type, operating system, device identifiers, access times, and usage patterns.
Paid Usage Records: Paid subscriptions are billed monthly based on day-pass usage. The first successful sign-in to a subscribed user account on a UTC calendar date records one day pass; further sign-ins by the same user on that UTC date do not record another. We process the sign-in timestamps, last metered date, usage totals and subscription status needed for this billing. Free evaluation access is not charged under this paid metering arrangement.
Cookies and Tracking: Cookies and similar technologies support functions such as login, security and payment. Where optional technologies require consent, we request it before using them and provide a way to change your choice. You can also manage cookies through your browser or device settings; blocking necessary cookies may prevent some functions from working.

c. User Data Uploaded to the Service

Any content or data you upload (“User Data”) remains yours. We process it to provide the Service and carry out your instructions, including hosting, transformation, reporting, support and authorised sharing, or where required by law. We limit access to authorised people and providers with a service, security, support or legal need.
Do not upload highly sensitive or regulated data, including HIPAA-regulated health information, special-category or criminal-offence data, payment-card details, government-classified information, or core proprietary datasets containing identifiable personal information. Any exception requires Visokio’s prior written approval expressly covering that processing and the necessary safeguards; subscribing does not provide that approval. Use synthetic, properly anonymised or other non-sensitive data suitable for the workspace. Account details and credentials entered in designated configuration fields are distinct from dataset uploads.

Omniscope Cloud provides cloud-based data transformation, analysis and reporting. Data retention and deletion are explained in section 6.

If you choose to share or publish content, it may be accessed by the people you authorise or, if published publicly, by the public. Review the applicable access settings before sharing or publishing.

3. How We Use Your Data

We use the data collected for the following purposes:

Service Delivery: To authenticate your account and enable your use of Omniscope Cloud.
Service Improvement: To analyze usage trends, troubleshoot issues, and improve functionality.
Communication: To send service-related updates, notifications, or respond to your inquiries.
Legal Compliance: To comply with applicable laws, enforce our Terms and Conditions, or resolve disputes.
Billing: To administer paid subscriptions, record day-pass usage, issue monthly invoices and manage payments, cancellations and disputes.

We do not use your data for:

Selling, renting, or trading your information with third parties.
Advertising or marketing purposes without explicit consent.

Our roles and legal bases: Visokio acts as controller for account administration, billing, security and support. For evaluation account metadata, we rely on our legitimate interests in providing and protecting evaluation access. For paid accounts, we rely on performance of the subscription contract; where the customer is an organisation, managing its representatives’ details is based on legitimate interests. Security, troubleshooting and handling claims rely on legitimate interests; accounting and required disclosures rely on legal obligations. Optional processing requiring consent relies on that consent. We consider individuals’ rights when relying on legitimate interests and collect only information reasonably necessary for these purposes. Without required account or billing information, we may be unable to provide the relevant service.

For personal information in User Data, Visokio acts as processor on the customer’s instructions, or as subprocessor where the customer is itself a processor. The customer is responsible for its own lawful basis and instructions. The processing terms in section 7 of our Terms and Conditions apply. We do not use User Data to train general-purpose AI models.

4. Sharing of Data

We do not sell or rent your personal information. We disclose it only in the circumstances described below. Visokio does not “sell” personal information or “share” personal information for “cross-context behavioral advertising”, as defined by the CCPA/CPRA, collected through this Service.

Service Providers: We may share minimal data with trusted third-party providers who assist in delivering or supporting the Service. Backend computational virtual machines are hosted on Google Cloud Platform in the United States; account authorisation handles and logins are managed through Auth0 tenants located in the United Kingdom. Providers processing personal information for us are subject to confidentiality and required data-protection terms.
Payment Processing: Payment information is securely processed by Stripe as described in section 2. Stripe may also process information for its own payment, fraud-prevention and legal purposes under Stripe’s Privacy Policy (https://stripe.com/privacy).
Legal Requirements: We may disclose your information if required by law, subpoena, or other legal processes, or if we believe disclosure is necessary to protect our rights, comply with legal obligations, or prevent fraud.
Business Transfers: In the event of a merger, acquisition, or sale of Visokio’s assets, your data may be transferred to the successor organization. You will be notified of such a transfer if required by law.
With Your Consent: We may share information with third parties if you explicitly authorize us to do so.

5. User Data Responsibility

Ownership: You retain full ownership of all data uploaded to the Service.
Responsibility: You are solely responsible for the legality, reliability, and accuracy of User Data.
Access by Visokio: We process User Data only as described in sections 2 and 3, on your instructions or as required by law. Our applicable processor duties remain in force.
Data Loss: Users are encouraged to maintain independent backups. Liability is governed by section 14 of this policy and section 11 of the Terms and Conditions, subject to rights and duties that cannot lawfully be excluded.

6. Data Retention

Personal Data: Retained as long as your account remains active or as needed to fulfill the purpose for which it was collected.
User Data: Paid User Data is stored for the duration of your subscription and deleted 30 days after termination. Ordinary cancellation takes effect at the end of the current monthly billing period, and the 30 days run from that effective end date. The retention period does not extend paid access or guarantee restoration; export your content before access ends or contact support about return during the retention period. Earlier deletion may follow your valid request or necessary removal of prohibited content; limited information may be retained longer only where necessary and lawful.
Free Evaluation Data: Evaluation content may be deleted or overwritten automatically during rebuilds, resets or housekeeping without warning or a minimum retention period. The paid 30-day rule does not apply to free evaluation content.
Inactivity: For paid-user content, prolonged inactivity means 12 months of non-use. We give at least 30 days’ notice before initiating deletion for inactivity, allowing you to sign in or contact support to prevent it. Signing in while subscribed may record a billable day pass; contacting support is an alternative. This inactivity process is separate from scheduled deletion after subscription termination and does not apply to evaluation resets.
Backup Copies: System backups are retained for operational purposes but may not guarantee full restoration of deleted data. Deleted information may remain in restricted backups until removed through the applicable backup cycle; it is not used for ordinary processing, and deletion instructions are reapplied if a backup is restored. Copies held independently by other recipients are governed by their own retention obligations.
Billing, Security and Legal Records: Account, usage, invoice, support and security records are retained only as needed for their stated purposes, required accounting or tax periods, incident investigation or lawful claims. A legal retention requirement does not justify indefinite retention of all User Data.

Accidental personal-information upload: request immediate manual deletion by emailing support@visokio.com with the subject “URGENT — Omniscope Cloud data deletion”. Identify your account, project/folder, affected files and approximate upload time; do not resend the sensitive dataset. Stop the affected workflow and remove public sharing where possible. After proportionate identity/authority checks, we prioritise containment and deletion from active systems without undue delay, independently of cancellation or billing. We explain any lawful exception or backup limitation; immediate removal of every third-party or backup copy cannot be guaranteed.

7. Data Security

We implement industry-standard measures to safeguard your data. However:

No Guarantee: While we strive to protect your data, no method of storage or transmission is completely secure. This does not exclude our applicable legal duties or liability that cannot lawfully be limited.
Your Responsibility: Users are responsible for protecting their login credentials and securing their devices.

8. Efforts to Comply with GDPR and Other Regulations

We comply with the data-protection obligations applicable to our role, including GDPR, UK GDPR and CCPA/CPRA where they apply. Users remain responsible for the lawfulness of their own use of the Service. We apply appropriate technical and organisational measures and, when acting as processor, notify the customer without undue delay after becoming aware of a personal-data breach and provide assistance required by law.

For concerns regarding data protection, contact us at support@visokio.com.

9. Cross-Border Data Transfers

User Data processed on the GCP backend is hosted in the United States; Auth0 authentication tenants are located in the United Kingdom. Other provider operations and user-selected integrations may involve additional countries. By selecting this endpoint, you acknowledge the US processing location and authorise the transmissions needed to perform your instructions. This is not blanket consent under GDPR or UK GDPR and is not consent on behalf of people in your data. Where a restricted transfer requires safeguards, we use an applicable lawful mechanism, such as a relevant adequacy decision or contractual safeguards (including EU standard contractual clauses and the UK Addendum or International Data Transfer Agreement), with required assessments and supplementary measures. Details and a copy of relevant safeguards are available from support@visokio.com, subject to lawful confidentiality protections. Do not upload data here if your requirements prohibit US processing.

10. Children’s Privacy

The Service is not intended for use by children under the age of 18. We do not knowingly collect data from minors. If you believe we have inadvertently collected data from a minor, contact us immediately at support@visokio.com, and we will take appropriate action.

11. Your Rights

Depending on your location, you may have rights regarding your data, including:

Accessing your personal data.
Requesting corrections or updates.
Deleting your data, subject to applicable statutory exceptions.
Objecting to processing or requesting data portability.
Requesting restriction of processing and withdrawing consent where we rely on it, without affecting earlier lawful processing.

To exercise your rights, contact support@visokio.com. We may proportionately verify your identity or authority. GDPR/UK GDPR requests are normally answered within one month, subject to lawful extensions, and are normally free. Where we act for another controller, we refer the request to it and assist its response. You may complain to the UK Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/) or the competent EEA supervisory authority; you need not contact us first.

California rights, where CCPA/CPRA applies: You may request to know/access, obtain a portable copy, correct or delete personal information, and exercise applicable sale/sharing opt-out and sensitive-information limitation rights without discrimination. An authorised agent may submit a request with appropriate evidence of authority. Email support@visokio.com marked “California privacy request”. We acknowledge qualifying requests to know, delete or correct within 10 business days and normally respond within 45 calendar days, explaining any permitted extension. We honour applicable opt-out preference signals. Our no-sale/no-sharing practice is described in section 4.

The categories collected in the preceding 12 months, where the relevant features were used, are identifiers and contact/customer-record information, commercial information (subscriptions and invoices), internet/network activity (sign-ins and usage), and professional information voluntarily supplied. Authentication details can be sensitive personal information. Additional User Data categories are determined by customers, subject to our upload restrictions. Sources are you, your Service use, authentication providers and payment providers; purposes, recipients and retention criteria appear in sections 2–6. We have not sold or shared this Service’s personal information for cross-context behavioural advertising during that period. We use sensitive personal information only for requested services, authentication, security and other legally permitted purposes, not to infer characteristics about consumers.

12. Third-Party Services

The Service may include integrations or links to third-party tools. We are not responsible for the practices, content, or privacy policies of these third-party services. You are encouraged to review their policies before engaging with them. This does not remove responsibility for our own processing or for providers we engage as subprocessors.

AI and Bring Your Own License (BYOL): Report Ninja, AI-enabled Control Flow, AI Completion and other external-LLM features on this endpoint use your own authorised API token. No User Data is sent to an external LLM provider, such as OpenAI, unless you explicitly configure or map that token and invoke or authorise the relevant feature or workflow. An authorised scheduled workflow may make repeated requests. Depending on the feature, requests may include prompts, field names, schemas, selected data values/rows, summaries, report context or conversation history. Review selected inputs and permissions before execution.

The Service handles credentials as needed to authenticate your requests. Keep them out of shared files and revoke them if compromised. User-selected integrations, including OpenAI services and Zapier webhooks, send information to the recipients you configure. Their own terms govern their independent processing, charges, retention and training practices. BYOL does not itself guarantee local processing, zero retention or no training by the provider; deletion here may not delete provider-held copies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Users will be notified of significant changes via the Service or email, and the effective date will be updated. Where new consent is legally required, we will request it; continued use is not a substitute.

14. Limitation of Liability

To the fullest extent permitted by law:

Visokio disclaims all liability for indirect, incidental, or consequential damages related to data breaches, unauthorized access, or loss of data.
You may stop using the Service if dissatisfied, but retain all applicable rights to complain, seek a remedy or compensation, and exercise data-protection rights. Nothing in this policy excludes duties or liability that cannot lawfully be excluded. The permitted contractual limits in section 11 of the Terms and Conditions apply between the contracting parties only.

15. Contact Us

If you have questions, concerns, or wish to exercise your rights, please contact us:

Email: support@visokio.com
Postal address: Visokio (UK) Limited, 14th Floor, 33 Cavendish Square, London, England, W1G 0PW. Company number: 04580403.

For corporate security, compliance or residency requirements that this shared endpoint cannot meet, contact us about an installed instance or a private AWS, Azure or GCP deployment using Docker, under your organisation’s network and firewall control. SOC 2, ISO 27001, HIPAA and EU-only residency requirements need an appropriately configured and contracted deployment; choosing a private deployment alone is not a compliance certification.