Privacy Policy

Effective November 2, 2026

OMII AI (“we,” “us,” or “our”) operates IgPoster, an AI-powered Instagram content automation platform. This Privacy Policy describes how we collect, use, and protect your information when you use our Service. By using the Service, you agree to the practices described here.

1. Information We Collect

We collect the following categories of information to operate the Service:

Account information: When you register, we collect your email address and a hashed password, managed through Supabase authentication.

Instagram account data: When you connect your Instagram Business account, we store your Instagram Page ID, username, and access tokens. Access tokens are encrypted at rest using AES-256-GCM encryption before being stored in our database.

Content you create: We store prompts, captions, AI-generated images, and post drafts that you create using the Service.

Usage data: We collect information about how you use the Service, including posts published, features accessed, and subscription status.

Billing information: Payment processing is handled entirely by Stripe. We do not store raw card numbers, CVV codes, or full payment card data. We receive and store transaction identifiers and subscription status from Stripe.

2. How We Use Your Information

We use the information we collect to operate and improve the Service, including to publish content to Instagram on your behalf using your connected account credentials, to process subscription payments and send billing-related communications, to send transactional emails about your account (such as password resets and billing receipts), and to improve the quality of AI-generated images and captions over time. We do not sell your personal information to third parties.

3. Third-Party Services

The Service relies on the following third-party providers to deliver its functionality. Each provider's own privacy policy governs their handling of data they receive:

Supabase provides database hosting, authentication and file storage. Your account data, content and uploaded images are stored on Supabase's managed infrastructure.

Vercel hosts the Service and delivers it via its global edge network. Request data may be processed by Vercel's infrastructure.

Stripe processes subscription payments. Your billing data is governed by Stripe's Privacy Policy. We never receive or store your raw card details.

Meta / Instagram receives published content through the Instagram API when you use the publishing features of the Service, and provides the account connection you authorize.

Google provides the Gemini AI models we use to generate images and to refine them. Your image prompt and any reference images you attach are sent to Google for that purpose. If you choose to sign in with Google, Google also provides your sign-in.

OpenRouter routes caption and art-direction requests to AI language models operated by third parties, including OpenAI. Your brief, brand details and, where needed, a generated image may be sent.

Replicate provides AI image generation, and receives your image prompt only if you choose that provider or it is used as a fallback when another image provider is unavailable.

Pollinations.ai provides a fallback AI image generator and receives your image prompt only when no other image provider can serve a request that has no reference images.

Sentry provides error monitoring. It receives technical data about errors and page performance, such as the page address, browser type and the error itself. We do not use session recording.

Telegram delivers operational alerts to our operator. These alerts include error titles, the affected component, and links to Sentry issues; error details may contain account or integration identifiers.

4. Data Security

We take the security of your data seriously. Instagram access tokens are encrypted at rest using AES-256-GCM before storage and are never logged or exposed in API responses. All data transmitted between your browser and our Service is encrypted in transit using HTTPS. We restrict access to your personal data to personnel and systems that require it to deliver the Service. While we implement these safeguards, no system is completely immune to security risks, and we cannot guarantee absolute security.

5. Data Retention

We retain your account data and content for as long as your account is active. Usage and application logs are retained for 90 days. If you request deletion of your account, we will delete your personal data within 30 days of receiving your request, unless we are required to retain it for legal or compliance purposes. To request deletion, contact us at hello@omii.ai.

6. Your Rights

You have the right to access, correct, or delete the personal data we hold about you. To exercise these rights, contact us at hello@omii.ai. If you are located in the European Union or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local supervisory authority. We will respond to all requests within the timeframes required by applicable law.

7. Instagram Permissions

When you connect your Instagram professional account through Facebook, we request pages_show_list and pages_read_engagement to find your managed Pages and their linked Instagram account; instagram_basic to read the connected account's profile and media; instagram_content_publish to publish content you authorize; and instagram_manage_insights to read post-performance metrics and inform future content recommendations for your account. Performance-derived guidance may be included in requests to the AI providers described above. We do not request access to private messages or ad management. You can remove the app's access through Facebook's Business Integrations settings. Revoking access prevents future publishing and performance collection until you reconnect.

8. Cookies

We use session cookies strictly necessary to maintain your authenticated session, managed through Supabase authentication. Our error-monitoring provider, Sentry, collects technical error and performance data but does not set advertising or cross-site tracking cookies. We do not use advertising cookies, cross-site tracking cookies, or any cookies that profile your browsing behavior across third-party sites. You can configure your browser to refuse cookies, but doing so will prevent you from using the authenticated portions of the Service.

9. Children's Privacy

The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a child, contact us at hello@omii.ai.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify registered users by email and update the effective date at the top of this page. We encourage you to review this policy periodically. Continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

11. Contact

For questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, contact us at hello@omii.ai. Effective November 2, 2026.