LEGAL

Privacy

Last updated 12 October 2026

This notice explains what OmniSchema collects and why. It applies to the product at omnischema.app and related site addresses, and to the OmniSchema Android app.

Who we are

OmniSchema is provided by Soraflex Technologies Ltd, registered in England and Wales, company number 17485483. Registered office: 37 Roberts Avenue, Conisbrough, Doncaster, DN12 2DB. For the account details we hold about you, Soraflex Technologies Ltd is the data controller. For the business data a company stores in its workspace, that company is the controller and we process it on its behalf. We are registered with the Information Commissioner's Office (ICO), registration number ZC260597.

What we collect

Account details you give us: name, email, company name, role, site assignment.
Business data you store in lists, pages, files, and messages.
Technical logs needed to run the service: sign-in time, IP address used at sign-in, security events.
Billing details processed by Stripe. We do not store full card numbers.
If you get in touch through our website (the contact form, the chat assistant, or "We'll build it for you"): your name, email, phone number if you give it, company name and your answers. We use these to reply to you and, for "We'll build it for you", to build your system. We only add you to our newsletter if you say yes (see below).
If you asked for our founding customer code in the pop-up our website used to show: your name and email. We used them to email you the code and may follow up once about it. We only add you to our newsletter if you tick the box asking for it.
If your company shares a system, the copy holds that system's pages, lists, columns and settings for them. It never holds your rows, files, people or company settings.
Location on jobs: where a job was started and closed, recorded only at the moment the person doing the job presses Start or Close, and only if their phone or browser has been allowed to share location (it asks them first; saying no doesn't stop the job). It is not tracked at any other time.
Phone numbers and text messages a company sends to its own customers or staff.
OmniSchema People, if your company uses it: the staff records your company keeps there, such as job, pay, working pattern, qualifications and right to work checks, leave, sickness absence, timesheets, and clock in and out times (with the phone's location at that moment, only if it is allowed to share it). Sickness reasons, right to work documents and similar details are kept encrypted, only the people your company allows can see them, and every time they are opened is recorded. Your company is the controller of this data.
OmniSchema Purchasing, if your company uses it: requests to buy, approvals and their comments, purchase orders, deliveries (with any photo of the delivery note), supplier details and their bills, and who did each step. Approved bills go to your company's own accounting system if it is connected. Your company is the controller of this data.

We send occasional emails about OmniSchema: new features and tips. We only send them to people who asked: by ticking the box on our contact form (or, in the past, the founding customer pop-up), or by answering yes when our website chat asks. The box starts unticked, and saying no doesn't change how we reply to your message. We keep a record of when you said yes, where, and the words you were shown.

You can unsubscribe at any time with the link at the bottom of every newsletter email, or by emailing privacy@omnischema.app. Our newsletter is sent through SendFox, which holds your email address and first name for us.

How we use it

To provide the product, enforce plan limits, send account emails such as password resets, detect abuse, and meet legal duties. We do not sell customer data.

Who sees it

People you invite to your company, with the access you give them. OmniSchema infrastructure administrators use a separate, restricted environment and do not use ordinary customer accounts to browse customer data.

Services that help run OmniSchema

These companies process data for us, and only what they need for the job:

Hetzner (Germany): runs our servers and database.
Amazon Web Services (Sweden): stores files and images you upload.
Stripe (Ireland and the United States): plan payments.
Resend (United States): sends account and notification emails.
SendFox (United States): sends our newsletter to people who asked for it.
Sentry (Germany): error reports, so we can fix problems.
Anthropic (United States): answers questions in the in-app assistant, using only what the person asking can already see. It is not used to train AI models.
Stripe Connect: if a company takes card payments, its customers pay on Stripe's page and the money goes to that company's own Stripe account.
Xero or Intuit QuickBooks: if a company connects its accounts, the invoices and customer names it chooses to send go to that company's own Xero or QuickBooks.
Twilio (United States): delivers text messages.
MapTiler (Switzerland): map images for the jobs map. Your browser asks MapTiler for map tiles, so MapTiler sees your IP address, not your jobs.

Where data goes outside the UK, we rely on the UK's adequacy rules or standard contractual clauses to protect it.

Retention

Account and business data stays until you delete it or close the company. Soft-deleted items are kept up to 30 days, then removed. Security logs are kept to investigate incidents. OmniSchema People keeps each kind of staff record for the period your company sets there (for example, pay records for six years); removing someone makes their details unreadable for good, and closing the company removes all of its People data. Closing the company also removes all of its Purchasing data.

Your rights

You can ask to access, correct, or delete personal data we hold, or export list data from the product. Contact privacy@omnischema.app. If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk.

Cookies

We use a signed, HttpOnly session cookie to keep you signed in, and a CSRF cookie to protect forms. We do not use advertising cookies.