Privacy policy
This policy explains what personal data the Omni API collects, why, how long it is kept and the rights you have. The controller is Radiant Crest Inc. (“RC Inc”, “we”). Contact: privacy@omni-api.rcinc.app.
What we collect
- Account: your email address and name, from Google sign-in or the email you enter for a sign-in code.
- API keys: a name you choose and a one-way hash of each key. We cannot read your keys after they are shown to you once.
- Usage and billing: for each API call, the time, call type, model and the amount taken from your credit; top-ups and refunds.
- Security records: network address and time of sign-in code requests and failed admin sign-ins, used to stop abuse.
- Payments: handled by Stripe. We receive a confirmation and the amount; we never see or store card numbers.
- Site visits: anonymous counts of which pages are viewed, which buttons are clicked and which site or campaign a visit came from. These counts carry no name, email, network address, device id or cookie.
- How you found us: when you create an account, the campaign tags in the link you followed (for example utm_source, or an ad click id such as gclid) and the referring site are saved with it.
What we do not keep
The prompts, files and audio you send, and the text, images, video and audio that come back, pass through the API to the model provider and back to you. We do not store them, apart from the result links shown on a task (removed after 90 days), and we never use your content to train models.
Why we use it (legal basis)
- To provide the service you signed up for (contract): your account, keys, credit and every API call.
- To keep billing records (legal obligation): payment and credit history required by tax law.
- To protect the service (legitimate interest): rate limits, abuse prevention and security logs.
- To understand which pages and campaigns work (legitimate interest): anonymous visit counts and the campaign an account came from.
- To measure advertising (consent): Google and Microsoft measurement cookies, only if you accept them.
We do not sell personal data or show advertising on this site.
Cookies and measurement
Without your consent we use only what is strictly necessary: a signed session cookie that keeps you signed in, short-lived cookies that protect Google sign-in, and a record in your browser of your cookie choice. Our own visit counts use no cookies or identifiers.
If we turn on Google Analytics, Google Ads or Microsoft Advertising measurement, a banner asks first. Those tags load only if you click Accept, and they then set cookies (such as _ga, _gcl_au and _uetsid) to measure visits and ad results, under Google’s and Microsoft’s privacy policies. If you accept, we may also send Google Analytics the value of a completed credit purchase, linked to that measurement cookie. You can change your choice at any time with the “Cookie choices” link at the bottom of every page.
Who processes your data
These service providers process data for us under contracts that require them to protect it. A named list of the AI providers that handle API requests is available on request.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website and API hosting | United States |
| Railway Corp. | Database hosting (encrypted connections) | United States (California) |
| Cloudflare, Inc. | DNS, sign-in emails and support email forwarding | Global network |
| Stripe, Inc. | Card payments and payment records | United States and EU |
| Google LLC | Google sign-in (only if you choose it); analytics and ad measurement (only if you accept) | United States |
| Microsoft Corporation | Ad measurement (only if you accept) | United States |
| AI model providers and inference marketplaces | Processing the requests you send through the API, to return a result | United States and other countries |
International transfers
Our systems run in the United States. When data about people in the EU, EEA or UK is transferred there, we rely on the providers’ Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework.
How long we keep it
| Data | Kept for |
|---|---|
| Account, keys and usage | Until you delete your account |
| Task result links and webhook addresses | 90 days |
| Sign-in codes | 7 days |
| Failed sign-in records | 30 days |
| Anonymous visit counts | 26 months |
| Billing amounts and dates | As long as tax law requires (usually 7 years), without your name or email once your account is deleted |
Your rights
You can access, correct, export or delete your data, object to or restrict its use, and withdraw consent where we rely on it.
- Download your data: Dashboard → Your data → Download my data (a JSON file).
- Delete your account: Dashboard → Your data → Delete my account. It takes effect at once.
- Anything else: email privacy@omni-api.rcinc.app. We answer within 30 days.
You may also complain to your local data protection authority. Businesses can request a Data Processing Agreement at the same address.
Security
See our security page for how we protect data. If we ever have a breach that affects your personal data, we will tell you and the relevant authority within 72 hours where the law requires it.
Children
The Omni API is for developers and businesses and is not intended for anyone under 16.
Changes
We will post changes here and email account holders about significant ones.