OmniRef

The UK supplier operating OmniRef is responsible as controller for account administration, subscription billing and service-security information. Its legal identity, registered address and privacy contact must be supplied before this notice is final.

Your contracting company normally determines the purposes and lawful basis for employee and customer information recorded in jobs. For that customer-directed information, the supplier generally acts as processor under the company’s instructions. A suitable data-processing agreement, processor list and transfer arrangements must be confirmed before relying on this as a complete UK GDPR notice.

This notice describes the current product controls; it is not an independent certification of UK GDPR compliance.

• Accounts and billing: account identifier, email, display name, company membership and role, trial dates, subscription status, Stripe customer/subscription references and invoice information.
• Field records: customer and site details, asset/nameplate information, engineer notes, pressure and temperature readings, parts, warranties, signatures, photo evidence and annotations, F-Gas movements and dossier integrity hashes.
• Voice and acoustics: device-local audio, original on-device transcripts, reviewed notes, observed-sound labels and measured spectrum features. Reviewed transcripts and diagnostic scan metadata can sync to the cloud; raw OmniVoice and DecibelCore audio stays on the source device.
• Location and operational information: permitted GPS coordinates, reported accuracy, record timestamps, sync acknowledgements, connection state and error/security information needed to operate the service. The final telemetry inventory and retention schedule require confirmation by the operator.

Account and service administration is undertaken to deliver the business contract. Where users are employees rather than contracting individuals, legitimate interests in providing, securing and supporting the employer’s service may be the appropriate basis. Billing records may also be retained to meet legal accounting obligations.

Security and troubleshooting may rely on legitimate interests, balanced against individual rights. Your company is responsible for a lawful basis and appropriate notices for its customer and employee records, including signatures, photos and location. Browser permission for the camera, microphone or GPS is a technical permission, not automatically the lawful basis under UK GDPR.

Do not enter unnecessary sensitive information. If special-category information is needed, your company must establish an appropriate Article 9 condition and instructions before processing it.

Cloud records use database Row-Level Security (RLS) and authenticated server checks to restrict access by account, company membership and permitted roles. Engineers’ private voice transcripts and acoustic scan metadata are account-scoped. Company managers may access authorised company dossiers and operational records; the service is not intended to disclose private records to competing contractors.

Offline job dossiers, F-Gas records, voice notes and new acoustic recordings use AES-256-GCM encryption with a non-exportable browser-stored key. Other browser preferences, catalogue data and the general local outbox are not all encrypted. Legacy unencrypted acoustic clips may remain guest-device records.

This is device at-rest protection, not end-to-end encryption of cloud data, and it does not protect against an attacker running code in an active same-origin session or someone using an unlocked authorised account. Cloud records must be processed in readable form to deliver the service. Transport and cloud-hosting controls depend on the configured providers; no universal encryption or absolute-security guarantee is made.

Location is requested for actions such as arrival logging, attaching photo evidence and opting into the parts radar. You may decline or revoke browser permissions; relevant records then indicate unavailable location rather than inventing it. Device-clock timestamps and GPS accuracy limitations are retained in evidence.

The parts radar is opt-in, company-scoped and limited to a 10-mile field view. Radar viewers see part availability and general distance rather than another engineer’s precise coordinates or fleet identity. The underlying location record can contain exact coordinates for distance calculations and expires after two hours; expiry of radar eligibility is not a claim that every stored or backed-up copy is immediately erased.

These features are not described as continuous background employee tracking. Company administrators must explain any workforce use and avoid disproportionate monitoring. Basic sync/network state supports queue operation; diagnostic errors may be processed for security and troubleshooting.

Lovable Cloud provides the app’s hosted authentication, database and private file-storage services. Stripe processes subscription payments and billing-portal operations; full payment-card details are not stored in OmniRef’s application tables.

Submitting a nameplate image or prompt to cloud OCR/AI sends that selected content to the configured AI service. Image enhancement happens on the device, but cloud recognition is not an offline-only process. OmniVoice transcription uses only eligible installed browser-local speech; it does not silently fall back to a cloud speech service.

Supplier and manufacturer links take you to separate services with their own privacy notices. The operator must complete the provider/subprocessor list, hosting locations, contractual safeguards and any AI retention or training terms before final publication. Those unverified terms are not promised here.

Offline data remains in browser storage until removed by you, device/browser cleanup or supported record controls. Unsynchronised data and audio may be lost if browser storage or the encryption key is cleared. Guest records are not automatically claimed or uploaded by a later signed-in user.

Cloud records are retained as required to provide the service and meet applicable legal, accounting, dispute and evidence-retention obligations. F-Gas records may require at least five years’ retention where the relevant statutory rules apply. Sealed dossiers and F-Gas receipts are append-only: correction is by a new record, not silently altering evidence.

The operator must confirm actual account-deletion procedures, backup retention, billing retention and processor deletion schedules. This notice does not promise an automatic deletion deadline that has not been implemented. Subscription cancellation is not a deletion request.

Cloud, payment or AI providers may process information outside the UK. Where a restricted transfer occurs, the controller must establish a lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and undertake the required assessment.

Specific destinations and safeguards have not yet been confirmed by the operator. We do not claim all data stays in the UK or that every transfer assessment has been completed.

Subject to the applicable conditions, individuals may request access, rectification, erasure, restriction or portability of their personal information, object to processing based on legitimate interests, and withdraw consent where consent is the lawful basis. Withdrawal does not affect earlier lawful processing. Rights may be limited where records must be retained by law.

For customer or employee job information, contact the contractor company that controls the record. For account, billing or service-security information, contact the OmniRef operator through the privacy contact to be supplied before this notice is final. Identity checks may be needed; requests normally require a response within one month, subject to lawful extensions.

You may complain to the Information Commissioner’s Office (ICO). These tools support engineer decisions; no solely automated decision producing legal or similarly significant effects is described as part of the intended field workflow.

Browser local storage and IndexedDB support sign-in, display preferences, offline records, encryption keys and sync queues. Offline caching may be available in the published app. Clearing this storage can remove essential evidence or sign you out.

This notice does not assert that third-party hosting or billing pages never use cookies or analytics. Any non-essential tracking requires an appropriate disclosure and consent arrangements where applicable. Material changes to data handling should be reflected in this notice and communicated when required.

See the Terms of Service and Refunds & Cancellation Policy for business subscription arrangements.