Privacy Policy

Last updated: October 21, 2026

This Privacy Policy explains how OmniLoop (“OmniLoop,” “we,” “us,” or “our”), a product operated by KCN Life Private Limited, collects, uses, stores, shares, and protects information when you use the OmniLoop social media management platform at omniloop.app (the “Service”). By using the Service you agree to the practices described here.

1. Who we are

OmniLoop is a social media scheduling and management tool that lets you connect your social media accounts, compose and schedule posts and first comments, publish content, manage an inbox of interactions, and view analytics. The data controller is KCN Life Private Limited (CIN: U74999DL2016PTC302465), a company registered in India with its registered office at Plot 95A, Block B, Vikas Nagar, New Delhi, Delhi 110059, India. “The Indie Earth India,” under which some of our social-platform integrations are registered, is a brand of KCN Life Private Limited. You can reach us at privacy@omniloop.app.

2. Information we collect

We collect only what we need to operate the Service:

a. Account information

When you create an OmniLoop account we collect your name, email address, and authentication details. If you sign in with Google, we receive your basic profile information (name, email, and profile image) from Google to create your account. We do not receive or store your Google password.

b. Connected social account data

When you connect a social account (for example a Facebook Page, Instagram professional account, Threads profile, YouTube channel, Google Business Profile, X, LinkedIn, TikTok, Pinterest, Bluesky, or Telegram account), we receive and store, on your instruction:

• Access tokens issued by the platform, which authorize OmniLoop to act on your behalf. These are encrypted at rest and are never shown to you or third parties.
• Account identifiers and profile metadata such as the Page or account ID, name/handle, and profile picture, used to display your accounts in the app.
• Meta Platform data obtained through the Facebook Graph API and Instagram Graph API, limited to the permissions you grant: your Pages and linked Instagram accounts (pages_show_list, instagram_basic), the ability to publish posts and media you create (pages_manage_posts, instagram_content_publish), the ability to publish the first comment you write on your own posts (pages_manage_engagement, instagram_manage_comments), and engagement/read data used for your unified inbox and analytics (pages_read_engagement, business_management).
• Threads data obtained through the Threads API, limited to the permissions you grant: your basic Threads profile (threads_basic), the ability to publish posts you create to your own Threads profile (threads_content_publish), reading replies to your own Threads posts to power your unified inbox (threads_read_replies), and hiding or unhiding replies on your own posts (threads_manage_replies).
• YouTube and Google data obtained through YouTube API Services, limited to the permissions you grant: your basic YouTube channel information and the publish status of videos you post through OmniLoop (youtube.readonly), and the ability to upload and publish videos you create to your own channel (youtube.upload). See Section 5 (YouTube API Services) for full details.

c. Content you create

The posts, captions, first comments, images, and videos you upload or schedule through OmniLoop, together with their scheduling metadata (target accounts, times, and status).

You are responsible for the content and any personal data you bring into the Service (including in your posts, audiences, and inbox), and you confirm that you have the rights and consents necessary to provide it to us for processing on your behalf.

d. Engagement and analytics data

Comments, mentions, and messages retrieved from your connected accounts to power the unified inbox, and post performance metrics (such as impressions, likes, comments, and clicks) to power analytics.

e. Usage and technical data

Basic technical information needed to run and secure the Service, such as log data, IP address, and device/browser information. We do not sell this data or use it for advertising.

When you sign up, or ask to reset a password, a Cloudflare Turnstile check runs to tell people from automated abuse. For that check, Cloudflare receives your IP address and browser signals. If you choose “Sign in with Google,” Google confirms your identity to us and we receive your name and email address.

We show prices and bill in Indian Rupees (with applicable GST) to customers in India and in US Dollars to customers elsewhere. To decide which applies, we work out your country from your IP address on our own servers, using a country database (GeoLite2 data created by MaxMind). Your IP address is not sent to a third party for this, and we do not store the result against your account.

f. Payment information

OmniLoop is a paid service. When you buy a subscription or OmniLoop Credits, our payment processor, Razorpay, collects and processes the payment and billing details needed to complete your purchase (such as card or UPI information and billing contact details). We do not store full card numbers on our servers; we keep a record of your purchases, invoices, and the payment reference needed for billing, tax, and support. See Section 4 (How we share information) for how this is shared.

g. Referral and Brand Ambassador data

If you arrive through a referral link or code, we store that referral code and basic click data (including a hashed form of your IP address) so we can attribute the referral. If you join our Brand Ambassador program, we also process the details needed to run it and to pay you: your referral code and referral history, your chosen payout method, country, and contact details, and — to detect and prevent self-referral and fraud — a hashed, non-reversible fingerprint of the IP address and payment method associated with a referral. We use this data only to operate the program, calculate and pay commissions, and prevent abuse.

h. Short link clicks

If you create a short link with OmniLoop (an omlp.link address), we record each click on it so you can see how the link performed: when the click happened, the country it came from, and the website or app it came from. We work out the country from the visitor’s IP address at the moment of the click, on our own servers, using the country database described above. We do not store the visitor’s IP address, and clicks from known automated crawlers are not counted. We keep this click history for 3 months on the Growth plan and 2 years on the Agency plan. Before a link is created, we check the address being shortened against Google’s Web Risk list of unsafe sites; this sends that address to Google, but no information about the people who click the link.

i. Mobile apps

OmniLoop’s iPhone and Android apps show the same service as omniloop.app and use the same account. If you allow notifications, your phone’s operating system gives the app a notification address (a “push token”). We store it with your account, only to send you the OmniLoop notifications you have switched on, through Apple Push Notification service or Google Firebase Cloud Messaging. We delete it when you sign out in the app, when Apple or Google tells us the app was removed, or when your login is deleted. You can turn notifications off at any time in your phone’s settings or in Settings → Notifications in OmniLoop. The apps contain no advertising or analytics tools and do not track you across other companies’ apps or websites.

j. Photos and camera

The apps access your photos or camera only when you choose a file to upload, and only the files you choose are uploaded.

3. How we use information

• To provide the Service: scheduling, publishing, first comments, inbox, and analytics.
• To publish content to the connected accounts you select, at the times you choose.
• To display your connected accounts, profile pictures, and post status in the app.
• To provide optional AI-assisted content features (such as caption and content suggestions) when you choose to use them.
• To authenticate you and keep your workspace and data secure.
• To communicate with you about the Service, including important notices.

We use Meta Platform data and YouTube API Services data solely to provide the features you use within OmniLoop. We do not use it for advertising, we do not sell it, and we do not transfer it except as described in this policy.

We may also create and use aggregated or de-identified information — which cannot reasonably be used to identify you — to operate, secure, analyze, and improve the Service. Such information is not personal data, and it does not include Meta Platform data or YouTube API Services data, which we use only as described in this policy.

4. How we share information

We share information only in these limited cases:

• Social platforms. When you publish, we send your content to the platform you selected (for example Facebook, Instagram, Threads, YouTube, Google Business Profile, X, LinkedIn, TikTok, Pinterest, Bluesky, or Telegram) so it can be posted. Your use of those platforms is governed by their own terms and privacy policies.
• Payment processor. We use Razorpay (Razorpay Software Private Limited), an India-based payment processor, to take and process payments. When you pay, your contact and payment information is shared with Razorpay to complete the transaction, under its own Privacy Policy.
• Infrastructure providers. We use Hostinger for hosting and for sending email, and Cloudflare for storing the media you upload and our database backups (Cloudflare R2) and for bot protection on sign-up (Cloudflare Turnstile). They process data on our behalf under appropriate safeguards.
• Media search. When you search for a stock photo or a GIF inside OmniLoop, the search words are sent from our servers to Pexels or GIPHY to return results. Your name, email, and account details are not included.
• AI provider. When you use OmniLoop’s optional AI content features, the prompt and content you submit for generation are sent to our AI provider, OpenAI, to return a suggestion. This is used only to provide the feature and, under OpenAI’s API terms, is not used to train their models.
• Legal. We may disclose information if required by law or to protect the rights, safety, and security of our users and the Service.

We do not sell your personal information, your Meta Platform data, or your YouTube API Services data.

5. YouTube API Services

OmniLoop uses YouTube API Services to let you connect your own YouTube channel and upload, publish, and schedule videos to it from within OmniLoop.

• Agreement to YouTube’s terms. By connecting a YouTube channel and using OmniLoop’s YouTube features, you agree to be bound by the YouTube Terms of Service.
• Google Privacy Policy. OmniLoop’s use of information received from YouTube API Services is subject to the Google Privacy Policy (https://policies.google.com/privacy), in addition to this Privacy Policy.
• Limited Use. OmniLoop’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• What we access. With your authorization via Google OAuth, and limited to the scopes you grant, OmniLoop accesses your basic YouTube channel information and the status of videos you publish through OmniLoop (youtube.readonly), and the ability to upload and publish videos that you create, to your own channel (youtube.upload). We only ever access channels you own and have connected.
• How we use it. We use YouTube data solely to provide OmniLoop’s features to you: uploading and scheduling your videos to your channel, displaying your connected channel, and showing the publish status of your posts. We do not use YouTube data for advertising, we do not sell it, we do not transfer it to third parties except to YouTube/Google to carry out the actions you request, and we do not use it to train machine-learning or AI models.
• How we store it. Access and refresh tokens for your YouTube connection are encrypted at rest and are never shown to you or to third parties. Stored YouTube data is retained only while your channel is connected.
• How to revoke access. You can disconnect your YouTube channel at any time from Connect Accounts in OmniLoop, which removes its stored tokens. You can also revoke OmniLoop’s access to your Google/YouTube account at any time through Google’s security settings at https://myaccount.google.com/permissions.
• How to delete your data. To delete your OmniLoop account and associated data, see our Data Deletion page. We fulfill data-deletion requests within 30 days, except where retention is required by law.

6. Cookies and browser storage

OmniLoop keeps what it stores in your browser to the minimum needed to run the Service. We do not use analytics or advertising trackers.

• Sign-in and preferences (browser storage). When you sign in, a sign-in token is kept in your browser’s local storage so you stay signed in. We also store interface preferences there, such as light or dark mode, sidebar layout, and an unsent draft. This is strictly necessary for the Service to work and stays on your device.
• Cookie-notice choice. When you respond to our cookie notice, we store your choice in local storage so we do not have to ask again on every visit.
• Referral cookie. If you arrive through a Brand Ambassador’s referral link, we set one first-party cookie (ol_ref) holding that referral code for 45 days, so the ambassador can be credited if you subscribe.
• Third-party cookies on specific pages. Razorpay sets its own cookies on our pricing and checkout pages for secure payment and fraud prevention, and Cloudflare Turnstile and Google Sign-In may store data in your browser on the sign-in and sign-up pages. These are governed by those providers’ own policies.

You can clear or block cookies and site storage at any time in your browser settings. Blocking them may sign you out or prevent parts of the Service from working.

Inside the OmniLoop apps, the same essential storage is used to keep you signed in; no cookie notice is shown because no optional cookies exist.

7. Data storage and security

Access tokens and other secrets are encrypted at rest using strong encryption. Your data is logically isolated per workspace so that one customer cannot access another customer’s data. We restrict internal access, and we take reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, but we work to protect your data and to promptly address issues.

You are responsible for keeping your account credentials confidential and your own devices secure, and for the accounts and content you connect to the Service. To the fullest extent permitted by law, and except for any liability that cannot be excluded under applicable law (including the Digital Personal Data Protection Act, 2023), we are not liable for loss of or unauthorized access to data that results from factors outside our reasonable control, including your own acts or omissions or the acts, omissions, or security of the third-party platforms and providers you choose to use. Our liability in connection with the Service, including in relation to your data, is subject to the limitations set out in our Terms of Service.

8. Data retention and deletion

We retain your data for as long as your account is active or as needed to provide the Service. You can disconnect any social account at any time from Connect Accounts, which removes its stored tokens from OmniLoop. You can request deletion of your account and associated data at any time — see our Data Deletion page for instructions. When you delete your account, we delete or de-identify your personal data, including the media files you uploaded, within a reasonable period (and within 30 days for data obtained through YouTube API Services), except where retention is required by law. Copies held in our routine database backups are not edited individually; they are removed as those backups expire.

9. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@omniloop.app.

Data export. To request a portable copy of your data, email privacy@omniloop.app and we will provide an export of your personal data. To delete your account and data, see our Data Deletion page.

10. Grievance Officer and India-specific rights

In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, KCN Life Private Limited has appointed a Grievance Officer to address questions, requests, and complaints about how we handle your personal data. If you have a grievance about our data practices, you may contact:

Grievance Officer: Sandeep Saini
KCN Life Private Limited
Plot 95A, Block B, Vikas Nagar, New Delhi, Delhi 110059, India
Email: privacy@omniloop.app

We will acknowledge and address grievances within the timelines required by applicable law. If a grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India. Under the DPDP Act you may also nominate another individual to exercise your rights in the event of your death or incapacity.

11. Children

The Service is intended for businesses and users aged 18 and over. It is not directed to children, and we do not knowingly collect personal information from children.

12. International users

OmniLoop serves customers in multiple regions, including India and the United States. Your information may be processed in countries other than your own — including India, the United States, and Malaysia, where our service providers operate — with appropriate safeguards in place.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you of material changes. Your continued use of the Service after an updated policy takes effect constitutes your acceptance of it, except where additional consent is required by law.

14. Contact us

For any privacy questions or requests, contact KCN Life Private Limited at privacy@omniloop.app.