Privacy Policy

SPACE CADET d.o.o., Croatia, operates Omitted and is the controller for the processing described here. Contact us at hello@omitted.app.

• Account data, such as your email address, display name, authentication identifiers, and account timestamps.
• Subscription metadata, including plan, status, billing period, and provider customer, checkout, or subscription references. Omitted does not store full payment-card details.
• Data from the Google Business Profiles you choose to connect, including location identifiers, business details, profile fields, reviews, replies when available, and dated changes.
• Monitoring and evidence data, including calculated baselines, supported detector signals, incidents, profile snapshots, review versions, provider-event status, and delivery health.
• Operational email-delivery status. Alert content is not used for acquisition analytics.
• Limited technical and acquisition data: an anonymous random session ID, vertical, plan choice, and UTM source, medium, and campaign. Funnel records exclude review text, phone numbers, email addresses, names, GBP IDs, and incident tokens.

We use account, subscription, and connected-profile data to perform the service contract: authenticate the owner, confirm entitlement, retrieve monitoring data, detect supported patterns, preserve evidence, and provide account support.

We use limited service-health, security, and first-party funnel records for our legitimate interests in keeping Omitted reliable, preventing abuse, and understanding whether the launch journey works. We use consent where required for optional Google or Meta marketing tags. We process billing or compliance records where needed to meet legal obligations.

Detector output flags patterns for the owner to assess. It does not identify a reviewer, automatically file a dispute, remove a review, or make a legal decision about a person.

Omitted uses the owner-authorized connection to read monitoring data in V1 and does not modify the listing. We do not scrape the profile, sell Google user data, use it for advertising, or use it to build an unrelated data product.

Omitted's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use providers only for defined operating purposes:

• Clerk — authentication and account identity.
• Convex — application database and backend execution.
• Zernio — authorized provider connection, Google Business Profile data exchange, and webhooks.
• Polar — hosted checkout, subscription, and billing processing.
• Vercel — website hosting and delivery.
• Resend — operational email delivery where enabled.
• Google and Meta — optional marketing measurement only after your analytics choice and only when those tags are configured.

We may also disclose data when required by law, to protect the service and its users, or in a corporate transaction subject to appropriate confidentiality and notice obligations.

Account, connected-profile, monitoring, and evidence data is kept while the account is active. After a subscription ends, evidence is retained for up to 30 days so the owner can request an export or deletion, then scheduled for deletion unless a longer period is required by law or for a documented legal claim.

Successfully normalized webhook bodies are not retained as a separate archive. Terminal Zernio routing diagnostics are redacted after 90 days; minimal event identifiers and processing status remain to prevent duplicate processing. Pending or retryable work is retained until resolved. Delivery records are kept only as long as needed to investigate reliability or abuse. Anonymous launch-funnel records are kept for no more than 13 months. Consent and billing records may be kept for the period required to demonstrate consent, resolve disputes, or meet tax and accounting duties. Backups age out on the provider's normal protected rotation after deletion from active systems.

Request account-wide deletion in Settings. This stops monitoring and disables public incident links for all connected locations. Stored application data is removed in batches; provider cleanup is tracked separately before completion is confirmed. Export any evidence you need first. For a connected-profile deletion request or other privacy assistance, email hello@omitted.app. We will verify the request, confirm completion, and retain only records we must legally keep.

Omitted uses access controls, server-side authorization, signed provider callbacks, secret separation, transport encryption, and bounded operational logs. No internet service can guarantee absolute security; report a suspected issue to our support email.

Some providers may process data outside Croatia or the European Economic Area. Where required, those transfers rely on an applicable lawful safeguard, such as an adequacy decision or contractual transfer protections supplied by the provider.

Depending on the law that applies, you may ask for access, correction, deletion, restriction, portability, or object to certain processing. You may withdraw consent without affecting earlier lawful processing and reopen cookie choices from the footer.

Email hello@omitted.app to exercise a right. You may also complain to your competent data-protection supervisory authority. We may need to verify your identity and authority over the connected profile before fulfilling a request.

We will publish material policy changes here with a new effective date and provide additional notice when required.