Privacy Policy

1. Who we are

OmniServe is a product of Runox Technologies Limited ("we", "our" or "us"), a company registered in England and Wales (number 17080897), 48 Nowell Mount, Leeds, LS9 6HW, United Kingdom.

This policy covers two groups of people: the businesses that use OmniServe and their staff (section 2), and the people who call, message or send a form to one of those businesses through OmniServe (section 3).

• For our own customers' accounts, billing and this website, we decide how the data is used (we are the controller).
• For calls, messages and forms sent to a business that uses OmniServe, that business decides how they are used (it is the controller) and we process them on its behalf (we are its processor).

2. Businesses that use OmniServe, and their staff

What we collect

• Name and contact details (email, phone number), and your company or organisation name
• Account credentials (your password is stored only as a one-way hash)
• Billing details: what you pay and when. Card and bank details are taken by our payment providers (Stripe, Paystack), not stored by us
• What you set up: your knowledge, documents, links, App Link pages, settings and team
• How you use the service, and device, browser and IP address information

What we use it for

• To provide the service, keep it secure and support you
• To send you account emails, such as your welcome email, trial reminders, receipts and password resets
• To detect and prevent fraud and misuse, and to comply with the law

3. People who contact a business that uses OmniServe

If you tap a business's call link, use its App Link page, chat with it, or send it a form, a call-back request or a message, what you send goes to that business. The business is responsible for how it uses it; we hold and process it for the business.

What is collected

• What you type or say: chat messages, form answers (for example an application, a booking, a prayer request or an enquiry), and the name, phone number or email you give
• Your phone number, when you ring a business's phone number or ask to be called back
• Call details: when the call happened, how long it lasted and who answered
• Device and browser information, and an approximate town worked out from your IP address. The town is looked up in a database on our own servers; your IP address is not sent to anyone else for this

Calls, recordings, transcripts and AI summaries

• Calls the AI answers are transcribed, and the AI writes a short summary of the call (what you wanted, and your mood). At the start of the call you hear that it is transcribed, or recorded if recording is on.
• Call recording is off unless the business switches it on. It is a paid add-on. When it is on, you hear "This call is recorded" at the start of the call (on a radio phone-in: "This call is recorded and may be played on air"). If the notice cannot be given, the call is not recorded.
• When a business has chosen recording with transcripts, a call with a member of its team is transcribed from the recording and summarised in the same way.
• A WhatsApp voice note you send to a business is transcribed, so the business and its AI assistant can read it.
• We do not use your calls, messages, recordings or transcripts to train AI models. "Training" in the spoken notice means the business using its calls to train and check its own staff.

Radio phone-ins

When you call or message a radio station that uses OmniServe, the station's staff never see your full phone number. They see it masked, with at most its last three digits. Whether you go on air is the station's decision, and the screener asks for your agreement first.

How long it is kept

• Recordings are kept for the period the business sets, and are then deleted automatically. Unless the business chooses a shorter period, that is 30 days.
• Call transcripts are kept for the period the business chooses (30, 90 or 365 days, or until it deletes them); 90 days if it has not chosen. After that the words are deleted, and the call record and its summary stay.
• Messages, forms and call records are kept by the business in its OmniServe account until the business deletes them, or until you or the business ask us to delete them.

How to have it deleted

Ask the business you contacted: it can see and remove what you sent. Or email dpo@runox.ai with the business's name and the phone number, email or name you used, and we will delete it with the business within 30 days. If you contacted the business on Facebook or Instagram, see Deleting your data.

4. The companies that help us provide OmniServe

We use these service providers to run OmniServe. Each receives only what it needs for its part of the service. We do not sell personal data, and we do not use it for advertising.

• AI language models, to write the AI's answers, summaries and labels: OpenAI, Anthropic, Google (Gemini), DeepSeek and Groq. Which one handles a request depends on the task and on which is available. A business that connects its own AI provider's key uses that provider instead.
• Voice AI, for calls the AI answers: Ultravox.
• Transcribing recordings and voice notes: Google (Gemini), Deepgram, OpenAI or Groq.
• Calls in the browser and app (real-time audio and video): LiveKit.
• Telephone numbers and phone lines: Telnyx and Vezeti, or the phone line a business connects itself.
• Storage of recordings and files: Cloudflare R2.
• Hosting and database: Railway.
• Email: Resend, or the business's own mailbox when it connects one.
• Payments: Stripe and Paystack.
• Channels a business connects, such as WhatsApp, Facebook Messenger, Instagram, Telegram, Google or Microsoft: messages pass through those services under their own terms.

Several of these providers process data outside the United Kingdom, for example in the United States, and DeepSeek in China. Email dpo@runox.ai for the details of any of them.

5. Google and Microsoft account data

If you choose to connect a Google or Microsoft calendar, OmniServe asks for permission to read and manage the events on that calendar (Google: calendar.events and calendar.freebusy; Microsoft: Calendars.ReadWrite). We use this access only to:

• check when you are free, so appointments are only offered at open times
• create, update and cancel the appointments and meetings you or your assistant book, including their Google Meet or Microsoft Teams link and invitations to the people you invite
• show those appointments and meetings inside OmniServe

We store the access and refresh tokens needed to do this, and the details of events OmniServe creates. We do not sell this data, use it for advertising, or share it with anyone except as needed to provide these features, to comply with the law, or with your permission. People at OmniServe do not read it unless you ask us to for support, it is needed for security, or the law requires it.

OmniServe's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a calendar at any time in OmniServe (Appointments → Calendar sync), which deletes the stored tokens. You can also remove OmniServe's access from your Google Account (myaccount.google.com/permissions) or Microsoft account.

6. Facebook and Instagram data

If a business connects its Facebook Page and linked Instagram professional account, OmniServe asks Meta for permission to receive and answer that Page's and account's messages and comments (pages_messaging, pages_manage_metadata, pages_show_list, pages_read_engagement, pages_read_user_content, pages_manage_engagement, instagram_basic, instagram_manage_messages, instagram_manage_comments and business_management). We use this access only to:

• show the business the messages, comments, mentions and reviews people send it, in its OmniServe inbox
• send the replies the business's staff write, and the answers its AI assistant gives from the business's own knowledge, within Meta's messaging windows
• hide, delete or like comments when the business's staff choose to

We store the Page access token encrypted, the ids Meta gives the people who message the business, their public name, and the messages themselves. We do not sell this data or use it for advertising. The business that received the messages controls them.

To remove it: disconnect Facebook & Instagram on the Messaging page in OmniServe (the token is deleted at once), or remove OmniServe in your Facebook settings and ask for deletion. See Deleting your data for the steps and to check a request.

7. Data security

• encrypted connections (HTTPS/TLS) for all data in transit
• passwords stored only as one-way hashes
• each business's data kept separate from every other business's

8. How long we keep account data

We keep a business's account data while the account is open, and for as long as the law requires afterwards (for example, billing records). Section 3 says how long calls, recordings, transcripts and messages are kept.

9. Your rights

Under UK data protection law you have the right to:

• see the personal data held about you
• have it corrected
• have it deleted
• receive it in a portable format
• object to, or ask us to restrict, how it is used
• opt out of marketing emails

Email dpo@runox.ai. If your request is about what you sent to a business, we pass it to that business and help it answer. You can also complain to the Information Commissioner's Office (ico.org.uk).

10. Cookies

We use the cookies and browser storage needed to keep you signed in and to remember your settings. We do not use advertising cookies. You can clear them in your browser settings.

11. Contact us

12. Changes to this policy

We may update this policy. When we do, we post the new version on this page and change the "Last updated" date.