Privacy Policy

1. Who we are

OMGlens is provided by OMG Infotech Inc., a corporation incorporated in Delaware, USA (“OMG Infotech”, “we”, “us”).

OMG Infotech Inc.
2866 Burrows Ln, Ellicott City, MD 21043, USA
Email: hello@omglens.com

We play two roles:

• Controller for the data we need to run our business: accounts, billing, licences, usage, website enquiries and security logs.
• Processor (or “service provider”) for the documents our business customers scan. A hotel, clinic, or app developer that uses OMGlens decides whose documents are scanned and why. That customer is the controller. If you had your ID or another document scanned by one of our customers, please contact that business first; we will help them answer you.

2. Data we process

2.1 This website

• Contact form. Your name, email, organisation, the plan, interest and SDK platforms you pick, expected volume, your message and the page you sent it from. The website sends it to our sales mailbox as an email, with your address as the reply-to. The website does not save it in a database.
• Abuse protection. To allow at most 5 messages per 15 minutes, the website server keeps your IP address and the times you sent messages in its memory for up to 15 minutes.
• Theme setting. If you switch between light and dark, your choice is saved in your browser’s local storage (omglens-theme). It never leaves your browser.
• No analytics, advertising or tracking. This website loads no third-party scripts, analytics, advertising pixels or tracking cookies.
• Server logs. Like any web server, ours records the IP address, time, page requested and browser user agent of each request, for security and troubleshooting.

2.2 The OMGlens mobile app

• Your account. You can sign in with email and password, with Google, or with Apple. We store your email, name, the sign-in method, the account ID from Google or Apple, your Google profile picture link (Google sign-in only), whether your email is verified, a hashed password (email sign-in only), a hashed sign-in session token and your last sign-in time. Creating an account also creates a company account and a licence key for it.
• Scans. When you scan a document, the app sends the photo(s) to our scanning API over an encrypted (HTTPS) connection. Before upload, the app resizes the photo and removes its metadata, including any location (GPS) data. Our server reads the document with AI (see AI processing) and sends the extracted fields back to your phone. Our server does not save the photo or the extracted fields; see Retention for the short-lived exceptions.
• On your phone. Your scan history (extracted fields, document photos and face crops) is stored on your phone only, encrypted with AES-256 using keys kept in the phone’s secure storage (iOS Keychain or Android Keystore). On Android, the app’s data is excluded from cloud backup and device-to-device transfer. Signing out deletes your scans, photos, sign-in tokens and pending uploads from the phone.
• On-device checks. The phone uses Google ML Kit (Android) or Apple Vision (iOS), running on the device, to find the face photo and check that a photo shows a document before it is sent. Text the phone reads for these checks is not stored or sent.
• Reviews and corrections. When staff confirm or correct a field, the app tells us which field and what kind of change (for example “corrected”), never the value. When a person finishes reviewing a scan, the app sends only that scan’s request ID.
• Destinations you choose. If you turn them on, the app sends saved scans from your phone directly to your Google Sheet (see Google user data) or to an HTTPS address you enter. These go straight from your phone to that destination, not through our servers, and photos are never included. The API address and its secret are stored in your phone’s secure storage.
• Export. Exports are built on your phone as a ZIP file and handed to your phone’s share sheet. The temporary file is deleted afterwards.
• Permissions. The camera, to photograph documents, and your photo library, to pick a document photo you already have. iOS lists the microphone because the camera component requires it; the app does not record audio.
• No analytics or crash reporting. The app contains no analytics, advertising or crash-reporting SDKs.

2.3 The SDK and scanning API

Developers build the OMGlens SDK into their own apps. For each app that uses it, we process:

• Licence and device data: the licence key, the app’s bundle ID, the platform (Android or iOS), the SDK version and a random device ID that the SDK creates when it is first installed. If the phone’s secure storage is unavailable, the SDK uses a one-way hash of system identifiers instead (for example the Android ID or iOS vendor identifier combined with the app ID). Advertising identifiers are never used. We store, per device, this ID, platform, SDK version and when it was first and last seen, to enforce plan device limits.
• Scan requests: the document photo(s) and scan options (document type, side, language preferences). The SDK resizes photos and removes their metadata, including location, before upload. The photo is held in server memory only while it is read and is not written to disk or to our database.
• A scan log entry for every scan, successful or failed. It contains: company and licence, app bundle ID, device ID, request ID, time, document type and side, number of pages, confidence score, language hint, processing time, AI model and token counts, whether Data Encryption was applied, the number of review flags, whether rows need a person to confirm, when the scan was reviewed, and for a failed scan an error code with a fixed message we wrote for that code (for example “This document type is not supported.”), never text from the document. It does not contain the photo or the extracted field values (such as names or document numbers), and the AI’s own words and error replies from our AI provider are not stored or logged.
• Usage counts per company and month (scans, pages, failed scans, add-on use), for plan limits and billing, and daily counts of how often each field was corrected or confirmed (field names and numbers only).
• Data Encryption add-on (optional): each registered device’s public key, and for each sealed scan a wrapped key share, protected by Google Cloud Key Management Service. We do not store the sealed fields themselves; they stay with the customer. Each decryption request is logged with the scan ID, device key, result and time.

What the SDK stores on the device, and where results go next, is decided by the developer’s app. The SDK itself keeps its licence token and device ID in the phone’s secure storage and, when offline scanning is used, keeps queued photos encrypted (AES-256-GCM) on the phone for at most 72 hours.

2.4 The admin console

• Users: name, email, role, a hashed password (bcrypt), verification and last sign-in details. For OMG Infotech staff, an encrypted authenticator (two-factor) secret and hashed recovery codes.
• Company and billing: company name and email, plan, licences, registered apps (name, bundle ID, platform), invoices, and, if you add them, a billing legal name, tax ID, phone number and postal address. Card payments are taken by Stripe; we never see or store your card number.
• Account history: who changed a company’s or add-on’s status, when and why.
• Security: a session in our cache while you are signed in, and a count of failed sign-ins per email for 15 minutes.

2.5 Emails we send

We send sign-up verification codes, password-reset codes and replies to enquiries by email. We do not send marketing email.

2.6 API server logs

Our API records one log line per request: method, address, response status, time taken, company ID, IP address and app or browser user agent. Passwords, sign-in tokens and licence keys are removed from these logs. Scan photos and extracted fields are never logged.

3. Google user data

The OMGlens app uses Google APIs in two places. Both are optional.

3.1 Sign in with Google

• What we access: the email scope and the basic profile Google shares with it: your Google account ID, email address, whether it is verified, your name and your profile picture link.
• How we use it: to create your OMGlens account or sign you in.
• How we store it: in your user record in our database, as described in section 2.2. The Google token we receive is checked and then discarded.
• Sharing: not shared with anyone, except our hosting and email providers acting for us.

3.2 Google Sheets sync

• What we access: when you tap “Connect Google Sheets”, the app asks for the https://www.googleapis.com/auth/drive.file scope, which gives access to only the spreadsheet the app creates: one spreadsheet named “OMG Lens scans” in your Google account, which the app reads and writes. Google does not let the app see or open your other spreadsheets or any other file in your Google Drive. If you connected before November 2026, the app may ask you to connect again and create a new sheet; your old sheet stays in your Drive, unchanged.
• How we use it: to write your saved scans into that spreadsheet, one tab per document type: scan time, scan ID, document type, confidence, the extracted fields and, with the Explain add-on, the note. Photos are never written to the sheet.
• How it is stored: the Google access token and the spreadsheet data go directly between your phone and Google (sheets.googleapis.com). They never pass through or get stored on OMG Infotech servers. Your phone keeps the spreadsheet’s ID and link, the Google account email you connected, and which row holds each scan.
• Sharing: none. We never receive this data, so we cannot share it.
• Stopping access: disconnect the sheet in the app, sign out of the app, or remove OMGlens at myaccount.google.com/permissions.

We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it, except with your permission, for security, or where the law requires.

OMG Lens's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can read the policy at developers.google.com/terms/api-services-user-data-policy.

4. Purposes and legal bases

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

5. AI processing

• Documents are read by Google’s Gemini models on Google Cloud Vertex AI, which processes the photo on our behalf and returns the fields. Under Google Cloud’s terms, Google does not use this data to train its models.
• If the totals on an invoice do not add up, the same photo may be read a second time by a larger Gemini model. With the Explain add-on, the same AI pass also writes a short note about the document.
• AI can make mistakes. Results are suggestions for a person to check; the app asks staff to confirm fields where needed. OMG Infotech does not use the results to make decisions about anyone. The customer decides what to do with them.
• OMGlens is not an identity-verification, KYC or background-check service.

6. Processors and sub-processors

Google (for Sign in with Google and Google Sheets) and Apple (for Sign in with Apple) are not our processors: you deal with them directly under their own privacy policies. The same applies to any spreadsheet or API you connect.

7. International transfers

OMG Infotech Inc. is a US company. Our servers are in Germany, and some providers above process data in the USA or elsewhere. When personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) in our providers’ data processing terms, or on the EU-US Data Privacy Framework where the provider is certified.

8. Retention

9. Security

• All traffic between the app, SDK, admin console, website and our servers uses HTTPS.
• Scan history and photos on the phone are encrypted with AES-256, with keys in the phone’s secure storage.
• The optional Data Encryption add-on seals sensitive fields with AES-256-GCM. The key is split between the phone (in its secure hardware or keychain) and our server, whose share is wrapped by Google Cloud KMS. Opening a sealed field needs both. This is not end-to-end encryption: our server and the AI still see the photo while reading it.
• Passwords are hashed with bcrypt. OMG Infotech staff accounts use two-factor authentication.
• Our database and cache run on a private network with no public internet address.
• Sign-in attempts and scanning are rate limited, and secrets are removed from logs.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you and the authorities as the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• know what personal data we hold about you and get a copy;
• have it corrected or deleted;
• receive it in a portable format;
• object to or restrict our use of it, and withdraw consent at any time;
• not be discriminated against for using these rights.

EU, EEA and UK: these rights come from the GDPR and the UK GDPR. You may also complain to your local data protection authority.

US states (including California under the CCPA as amended by the CPRA, and Virginia, Colorado, Connecticut, Utah, Texas and others): you have the rights above. We do not sell personal data or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. If we decline your request, you may appeal by replying to our answer.

How to exercise them: email hello@omglens.com from the address on your account, or tell us which business scanned your document. We will verify your identity and answer within one month (45 days where US state law allows). You can use an authorised agent. If a business customer controls the data (see section 1), we will pass your request to them and help them answer.

You can delete the scans on your phone at any time in the app, and signing out removes them.

Deleting your account

• In the app: open Settings → Delete account. To confirm, enter your password, or sign in with Google or Apple again. You can also email hello@omglens.com from the address on your account.
• What is deleted at once: your name, email, password, Google or Apple account ID, profile picture link and sign-in sessions. Every signed-in phone and admin console session stops working immediately. Saved scans on your phone are deleted. Data you already sent to your own Google Sheet or API is in your control and is not changed.
• If you are the only person in your company account, it is closed too: the subscription is cancelled at once (no refund for the rest of the period), licence keys stop working, and its devices, scan logs, Data Encryption keys and shares (so sealed fields can no longer be opened), custom AI instructions and billing details are deleted. If other people still use the company account, an owner must first make one of them an owner, or remove them, in the admin console.
• What we keep, and why: invoices (amounts, dates, plan) and monthly usage counts, because tax and accounting law require them. They no longer carry your name or email. Our payment provider Stripe keeps its own record of the invoices it issued.
• Accounts removed in the admin console by a company admin are kept for 30 days, so a mistake can be undone, and then anonymised the same way. Database backups roll off within 30 days.
• Sign in with Apple: to also remove OMGlens from your Apple ID, open your Apple ID settings, then Sign in with Apple.

11. Children

OMGlens is for businesses and their staff aged 18 or over. We do not knowingly create accounts for, or collect data directly from, anyone under 18. If you think a child has given us personal data, email us and we will delete it. When a customer scans a minor’s document (for example a family’s IDs at hotel check-in), the customer is responsible for having a lawful basis and any guardian consent the law requires.

12. Changes to this policy

We will update this page when our practices change and change the “Last updated” date at the top. For material changes, we will also tell account owners by email or in the admin console before the change takes effect.

13. Contact

Questions or requests about privacy: hello@omglens.com, or by post to OMG Infotech Inc., 2866 Burrows Ln, Ellicott City, MD 21043, USA. See also our Terms of Service.