Data Processing Agreement
Effective Date: March 7, 2026
Last Updated: March 7, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Invariably Digital Group (“Processor”, “we”) and the merchant organization (“Controller”, “you”) using the Omni platform.
This DPA applies to all personal data processed by Omni on your behalf, including customer records, order data, employee/user data, and data imported via third-party integrations.
1. Definitions
- Personal Data: Any information relating to an identified or identifiable natural person.
- Processing: Any operation performed on personal data (collection, storage, retrieval, use, disclosure, erasure).
- Sub-processor: Any third party engaged by the Processor to process personal data on behalf of the Controller.
2. Data Processing Purpose
We process personal data solely for the purposes of providing the services described in the Terms of Service:
- Point-of-sale and order management
- Customer relationship management (CRM)
- Inventory and fulfillment operations
- Billing and invoicing
- Reporting and analytics
- Integration sync with third-party platforms (when enabled by you)
We do not sell, rent, or share personal data with third parties for marketing purposes.
3. Controller Obligations
You are responsible for:
- Ensuring a lawful basis exists for collecting and sharing personal data with Omni.
- Providing appropriate privacy notices to your customers and end users.
- Obtaining necessary consents where required (e.g., before enabling third-party customer data sync).
- Responding to data subject rights requests (with our assistance as described below).
4. Processor Obligations
We shall:
- Process personal data only on your documented instructions.
- Ensure that persons authorized to process personal data have committed to confidentiality.
- Implement appropriate technical and organizational security measures (see Section 6).
- Assist you in responding to data subject rights requests.
- Delete or return personal data upon termination of services (subject to the retention periods below).
- Make available all information necessary to demonstrate compliance with this DPA.
5. Sub-processors
Current sub-processors:
| Sub-processor | Purpose | Data Types |
|---|---|---|
| PostgreSQL hosting provider | Database storage | All tenant data |
| Stripe | Subscription billing | Billing data (tokenized; no raw card numbers) |
| Square | Order payment processing | Billing data (tokenized; no raw card numbers) |
| SMTP provider | Email delivery | Email addresses, message content |
| MinIO / S3 provider | Object storage | Uploaded files, export archives |
| EasyPost | Shipping label and rate services | Shipping addresses, package dimensions |
| Anthropic | AI features: document reading, assistant answers, order parsing | Content you submit to an AI feature — document contents, questions, and the figures behind an answer |
We will notify you of any intended changes to sub-processors. You may object to a new sub-processor within 30 days of notification.
About the AI sub-processor
AI features send content to Anthropic to be processed, and send the answer back. Three commitments cover that content, and they are Anthropic’s own published terms rather than ours: your content is not used to train their models, which is written into their commercial terms rather than being a setting somebody can change; inputs and outputs are deleted within 30 days; and Anthropic acts as a processor, with the obligations set out in their data processing addendum. Commercial terms · Data retention · Data processing addendum
We cannot tell you nothing is retained at all. An arrangement exists under which nothing is kept once the answer returns, and Omni is not currently on it — 30 days is the commitment that applies today. AI features can be switched off for your account under Administration, then AI; with them off, no content is sent to Anthropic.
6. Security Measures
Technical
- Encryption in transit: TLS 1.2+ for all connections.
- Encryption at rest: Database-level encryption; AES-GCM field encryption for sensitive fields (MFA secrets, integration credentials, payment tokens).
- Tenant isolation: Schema-per-tenant PostgreSQL architecture — physical separation of each tenant’s data.
- Access control: Role-based access control (default roles with tenant-customizable permission matrices), enforced at the API layer.
- Authentication: JWT with httpOnly cookies, refresh token rotation with theft detection, TOTP-based MFA.
- Rate limiting: Token-bucket algorithm on authentication and API endpoints.
- Audit logging: More than 90 security event types, written append-only and readable by tenant administrators. Records are not editable through any Omni interface; they are deleted on a schedule once the retention period for the plan has elapsed — 30 days on Launch, 90 days on Grow, 2 years on Scale, 3 years on Power, 7 years on Elite.
Organizational
- Least-privilege access for all personnel.
- Production credentials managed via Docker secrets (no plaintext in configuration).
- DOMPurify sanitization of user-generated content to prevent XSS.
- Automated dependency scanning (Trivy) in CI/CD pipeline.
7. Data Breach Notification
In the event of a personal data breach, we will:
- Notify you without undue delay (and in any event within 72 hours of becoming aware).
- Provide details of the breach: nature, categories of data affected, approximate number of records, likely consequences, and measures taken.
- Cooperate with you in notifying supervisory authorities and data subjects as required.
8. Data Subject Rights
We will assist you in fulfilling data subject requests including:
- Right of access: Export tenant data via the built-in data export feature (async ZIP, CSV per table).
- Right to erasure: Tenant data deletion upon request (schema deletion after retention period).
- Right to portability: Data export in CSV format.
- Right to rectification: You can update records directly via the Omni UI or API.
9. Data Retention
| Data Category | Retention Period |
|---|---|
| Tenant data (customers, orders, inventory) | Duration of subscription + 30 days |
| Security audit logs | Launch 30 days · Grow 90 days · Scale 2 years · Power 3 years · Elite 7 years |
| Billing records | 7 years |
| Support tickets | Duration of subscription + 90 days |
| Data exports | 24 hours after generation |
| Database backups | 30 days rolling |
Upon termination, tenant data is retained for 30 days (grace period for reactivation or export), then permanently deleted. Deleted tenant data ages out of backups within the 30-day backup retention window.
10. International Data Transfers
Personal data is stored in the region where your Omni instance is deployed. If data is transferred outside your jurisdiction, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.
11. Term and Termination
This DPA remains in effect for the duration of your use of Omni services. Upon termination, we will delete all tenant data within the retention periods specified above. You may request a final data export before deletion.
12. Governing Law
This DPA is governed by the same governing law as the Terms of Service.
13. Contact
For data protection inquiries: privacy@idomni.app