Privacy Policy

Effective Date: July 23, 2026

Version: 3.1

This Privacy Policy explains how Omni Reasoning collects, uses, stores, discloses, transfers, and protects personal data when you visit omniagentic.com, contact us, create an account, participate in a pilot, or use the Omni Agentic product, including Omni Agentic for GDS.

Omni Agentic is a product of Omni Reasoning.

Omni Reasoning is developed and operated by Serhii Hryhorash, an individual entrepreneur registered in Ukraine, referred to in this Privacy Policy as “Omni Reasoning,” “we,” “our,” or “us.”

This Privacy Policy applies to:

• website visitors;
• persons who contact us;
• prospective and current customers;
• users of the product;
• representatives, employees, and contractors of customers;
• participants in pilot, evaluation, demonstration, preview, or test programs;
• passengers and other persons whose personal data is processed through Omni Agentic;
• other individuals whose personal data we process in connection with our website, products, and business activities.

A company, travel agency, organization, or other legal entity that obtains or manages access to Omni Agentic is referred to as the “Customer.”

An individual who accesses or uses the website or product is referred to as the “User.”

By using the website or product, the User acknowledges that they have read this Privacy Policy.

1. Roles in Personal Data Processing

The role of Omni Reasoning depends on the context in which personal data is processed.

1.1. Omni Reasoning as Controller

Omni Reasoning acts as a controller where we determine the purposes and means of processing personal data, including where we process data for:

• operating the website;
• creating and administering accounts;
• managing product access;
• authenticating Users;
• processing inquiries;
• maintaining business communications;
• managing demonstrations and pilots;
• entering into and performing agreements;
• billing and accounting;
• managing our relationship with Customers;
• providing support;
• securing the website and product;
• preventing fraud, misuse, and unauthorized access;
• complying with legal obligations;
• protecting legal rights;
• developing and improving our products.

1.2. Omni Reasoning as Processor

Where a Customer uses Omni Agentic to process passenger data, booking data, operational data, or other data under the Customer’s control, the Customer generally determines the purposes and legal basis of that processing.

In those circumstances:

• the Customer acts as controller or another responsible party;
• Omni Reasoning acts as processor;
• Omni Reasoning processes the data on the Customer’s documented instructions;
• the parties’ respective rights and obligations may be governed by a separate Data Processing Agreement.

The Customer is responsible for ensuring that it has a lawful basis to collect, use, and provide such data to Omni Reasoning.

1.3. Independent Processing by Omni Reasoning

Even where Omni Reasoning acts primarily as a processor, we may independently process limited data where reasonably necessary to:

• maintain product security;
• prevent abuse or fraud;
• investigate incidents;
• comply with legal obligations;
• establish, exercise, or defend legal claims;
• maintain required technical, security, contractual, and audit records;
• protect Users, Customers, Omni Reasoning, and third parties.

2. Personal Data We May Process

The personal data we process depends on how a person interacts with the website, product, Customer, and third-party systems.

2.1. Website Technical Data

When you visit the website, our infrastructure and service providers may automatically process:

• IP address;
• date and time of access;
• requested pages and URLs;
• referring page or source;
• browser type and version;
• device type and characteristics;
• operating system;
• language and regional settings;
• network and technical identifiers;
• performance data;
• diagnostic data;
• security events;
• information about suspected malicious or abusive activity;
• information required to deliver and protect the website.

2.2. Contact and Inquiry Data

If you contact us by email, form, or another supported communication channel, we may process:

• first and last name;
• email address;
• telephone number, where provided;
• job title;
• organization;
• country or region;
• message content;
• communication history;
• email-signature information;
• attachments;
• product interests;
• information voluntarily provided in the communication.

2.3. Lead and Commercial Contact Data

When a person requests a demonstration, pilot, product access, or commercial proposal, we may process:

• name;
• business email address;
• organization;
• job title;
• industry;
• intended use case;
• team size;
• requested functionality;
• status of commercial discussions;
• business interaction history;
• preferred communication method;
• information required to prepare and manage a proposal or pilot.

2.4. Account Data

When an account is created or used, we may process:

• name;
• email address;
• Customer organization;
• job title or professional role;
• internal User identifier;
• Customer identifier;
• account status;
• assigned roles and permissions;
• product settings;
• authentication information;
• account-creation date;
• last-login date;
• invitation history;
• access-management history;
• accepted version of the Terms of Service;
• accepted version of this Privacy Policy;
• date, time, and technical context of acceptance.

Passwords are not stored in plain text.

Where password-based authentication is used, passwords are processed using appropriate cryptographic protection and secure credential-management practices.

2.5. Product Usage Data

When Omni Agentic is used, we may process:

• User prompts and requests;
• commands;
• instructions;
• system responses;
• outputs;
• selected operating modes;
• action confirmations;
• action rejections;
• execution settings;
• completed, interrupted, or stopped operations;
• technical results;
• errors;
• session information;
• feature usage;
• interface interactions;
• information required to provide support and resolve defects.

2.6. Execution, Audit, and Security Logs

For security, accountability, and error investigation, we may process:

• User identifiers;
• Customer identifiers;
• timestamps;
• generated commands;
• actions presented to the User;
• confirmed actions;
• rejected actions;
• execution mode;
• execution result;
• technical status;
• trace references;
• errors;
• suspension and stop events;
• configuration changes;
• login and logout events;
• authentication events;
• security events;
• attempted unauthorized access;
• rate-limit events;
• session revocation events.

2.7. Third-Party System Data

Where a Customer enables permitted interaction with a third-party system, Omni Agentic may process information displayed, entered, transmitted, or received through that system.

This may include:

• commands;
• responses from the third-party system;
• technical identifiers;
• session-related information;
• operation results;
• data supplied by the User or Customer;
• information required to perform an authorized workflow.

Omni Reasoning does not acquire ownership of or additional rights in the third-party system or its data.

2.8. Passenger and Booking Data

When Omni Agentic for GDS is used, the product may process:

• passenger first and last name;
• contact details;
• itinerary;
• travel dates;
• origin and destination;
• reservation information;
• passenger name record information;
• GDS records;
• fare information;
• ticket information;
• baggage information;
• transaction status;
• travel-document data where required;
• other information supplied by the Customer for the relevant travel operation.

The Customer must provide only personal data that is necessary, relevant, and lawfully processed for the applicable purpose.

2.9. Payment, Billing, and Contract Data

Where paid access is provided, we may process:

• Customer name;
• billing address;
• tax and registration information;
• subscription or plan information;
• invoice history;
• payment history;
• currency;
• payment amount;
• payment status;
• contract documents;
• contact details of responsible representatives.

Full payment-card details may be processed directly by a payment provider and may not be stored by Omni Reasoning.

2.10. Support Data

When support is requested, we may process:

• contact information;
• issue description;
• messages;
• screenshots;
• logs;
• diagnostic data;
• files voluntarily supplied by the User;
• support history;
• resolution status.

Users must not provide more personal data than reasonably necessary to resolve the issue.

3. Sources of Personal Data

We may obtain personal data:

• directly from the User;
• directly from the Customer;
• from an authorized Customer administrator;
• automatically through use of the website or product;
• from messages and attachments;
• through a third-party system used or selected by the Customer;
• from infrastructure and security providers;
• from public professional sources where permitted by law;
• from business partners or representatives who provide a lawful business contact;
• from contractual, payment, and billing documents.

4. Purposes and Legal Bases

We process personal data only where a valid legal basis applies.

4.1. Website Operation and Security

We process website technical data to:

• deliver website content;
• maintain availability and performance;
• prevent attacks and abuse;
• investigate technical issues;
• protect our infrastructure.

The legal basis is our legitimate interest in operating and securing the website and, where applicable, compliance with legal obligations.

4.2. Accounts and Product Access

We process account and authentication data to:

• create and manage accounts;
• authenticate Users;
• provide product access;
• assign roles and permissions;
• maintain account security;
• enforce Customer settings.

The legal basis is performance of a contract or steps taken before entering into a contract, together with our legitimate interests in access control and security.

4.3. Product and Service Delivery

We process prompts, commands, outputs, instructions, execution data, and related operational data to:

• provide Omni Agentic;
• execute User instructions;
• provide Omni Agentic for GDS functionality;
• generate and analyze commands;
• perform confirmed or otherwise authorized operations;
• provide requested features.

The legal basis is performance of a contract, steps taken at the request of the User or Customer, or the Customer’s documented instructions where Omni Reasoning acts as processor.

4.4. Logging, Audit, and Incident Investigation

We process audit, execution, and security logs to:

• verify what was presented, confirmed, and executed;
• investigate errors;
• prevent fraud and abuse;
• maintain accountability;
• resolve disputes;
• protect legal rights;
• support regulatory and contractual compliance.

The legal basis is our legitimate interest in security, accountability, service integrity, and legal protection, together with legal obligations where applicable.

4.5. Customer Data Processing

Where Omni Reasoning acts as processor, we process Customer Data:

• only on documented Customer instructions;
• to provide the contracted services;
• in accordance with the applicable Data Processing Agreement;
• subject to applicable legal obligations.

The Customer is responsible for identifying and maintaining the appropriate legal basis for its processing.

4.6. Sales, Demonstrations, and Pilots

We process lead and business-contact information to:

• respond to inquiries;
• assess requested use cases;
• arrange demonstrations;
• establish pilots;
• prepare proposals;
• manage commercial discussions.

The legal basis is steps taken before entering into a contract and our legitimate interest in developing and managing business relationships.

4.7. Billing, Taxation, and Contract Administration

We process billing, payment, tax, and contractual information to:

• issue invoices;
• process payments;
• maintain accounting records;
• administer commercial agreements;
• comply with tax and legal requirements.

The legal basis is performance of a contract and compliance with legal obligations.

4.8. Support and Communications

We process support and communication data to:

• respond to requests;
• resolve problems;
• provide service notices;
• notify Users of security matters;
• communicate material product changes.

The legal basis is performance of a contract, our legitimate interest in supporting Users and Customers, and legal obligations where applicable.

4.9. Product Improvement

We may process technical, usage, and diagnostic information to:

• identify defects;
• improve performance;
• improve reliability;
• assess feature usage;
• improve security;
• develop product functionality.

The legal basis is our legitimate interest in maintaining and improving the product.

Where possible, we use aggregated, minimized, or de-identified information.

4.10. Marketing

We may send optional product and service information:

• with consent;
• in the context of an existing business relationship;
• where another lawful basis applies.

Recipients may opt out of optional marketing messages at any time.

Service, administrative, contractual, and security messages are not marketing communications.

4.11. Legal Compliance and Claims

We may process personal data to:

• comply with law;
• respond to lawful requests;
• maintain required records;
• establish, exercise, or defend legal claims;
• protect the rights of Omni Reasoning, Customers, Users, and third parties.

The legal basis is compliance with legal obligations and our legitimate interest in legal protection.

5. Artificial Intelligence and Automated Processing

Omni Agentic may use:

• language models;
• machine-learning systems;
• algorithmic rules;
• automated classification;
• command-generation tools;
• automated execution mechanisms;
• third-party artificial-intelligence infrastructure.

Personal data may be included in inputs and outputs where necessary to provide functionality selected by the User or Customer.

5.1. Model Training

Omni Reasoning does not use Customer Data, passenger data, prompts, commands, outputs, booking data, or operational records to train general-purpose or publicly available artificial-intelligence models unless the Customer has expressly agreed to such use in writing.

Customer Data is not made available to other Customers for model training.

We may use aggregated, de-identified, or statistical information to:

• improve system performance;
• evaluate reliability;
• measure feature usage;
• detect defects;
• improve security;
• develop product functionality,

provided that such information does not reasonably identify an individual or Customer.

Where third-party AI providers are used, we apply contractual, technical, and organizational measures intended to restrict unauthorized retention, disclosure, and model training.

5.2. Automated Outputs

Automatically generated outputs are assistive and may require User review.

Customers are responsible for establishing appropriate human oversight in their workflows.

5.3. Solely Automated Decisions

Omni Reasoning does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect an individual, unless:

• the processing is expressly enabled or instructed by the Customer;
• the processing is legally permitted;
• the processing is necessary for an applicable contract or otherwise supported by a valid legal basis;
• appropriate safeguards are implemented;
• meaningful human review is available where required;
• the affected individual is provided with applicable rights and information.

Where the product supports automated or confirmed execution, the Customer remains responsible for determining whether the workflow may produce legally or similarly significant effects and for implementing any required human intervention.

6. User Confirmations and Action Records

Where the product requires confirmation of an action, we may record:

• the action presented to the User;
• the User identifier;
• the Customer identifier;
• date and time;
• confirmation or rejection result;
• selected execution mode;
• technical relationship between the confirmation and execution;
• execution result;
• error or interruption status.

This information is processed to:

• maintain security;
• verify whether the executed action matched the presented action;
• investigate errors;
• resolve disputes;
• demonstrate accountability;
• comply with contractual and legal requirements.

7. Cookies and Similar Technologies

The website and product may use strictly necessary cookies or similar technologies to:

• maintain sessions;
• support authentication;
• store language and interface preferences;
• prevent abuse;
• deliver requested functionality;
• route and balance traffic;
• protect against attacks.

We do not currently use advertising cookies, third-party behavioral advertising trackers, or optional marketing cookies unless clearly disclosed through the relevant interface and this Privacy Policy.

If optional analytics, advertising, or marketing technologies are introduced, we will update this Privacy Policy and implement an appropriate consent mechanism before their use where required by law.

Users may restrict cookies through browser settings, but doing so may prevent some product functionality from operating correctly.

8. Analytics and Product Improvement

We may analyze technical and usage information to:

• measure availability;
• detect defects;
• evaluate performance;
• understand feature usage;
• plan improvements;
• maintain security.

Where reasonably possible, we use aggregated, minimized, pseudonymized, or de-identified data.

We do not treat irreversibly anonymized information as personal data to the extent permitted by applicable law.

9. Service Providers and Subprocessors

We may engage service providers that help us operate, deliver, secure, and support the website and product.

These may include providers of:

• hosting;
• cloud infrastructure;
• content delivery;
• security and attack protection;
• authentication;
• email;
• monitoring;
• logging;
• backup and recovery;
• support tools;
• payment processing;
• artificial-intelligence infrastructure;
• software infrastructure.

Such providers may process personal data only to the extent necessary to provide their services and subject to applicable contractual and security obligations.

The website is currently delivered and protected using Cloudflare infrastructure.

Email communications may be processed by our email service provider.

Where applicable, Customer Data may be processed by approved subprocessors used to provide Omni Agentic.

An up-to-date list of material subprocessors may be published separately, provided under a Data Processing Agreement, or made available to Customers on request.

10. Disclosure of Personal Data

We may disclose personal data to:

• the Customer on whose behalf the User acts;
• authorized personnel and contractors;
• service providers and subprocessors;
• professional advisers;
• auditors;
• insurers;
• competent authorities where disclosure is legally required;
• parties to a legal dispute;
• prospective purchasers, investors, or successors in a corporate transaction;
• third parties acting on the lawful instruction of the User or Customer.

We do not sell personal data.

We do not disclose personal data to independent advertisers for cross-context behavioral advertising unless such activity is expressly disclosed and lawfully authorized.

11. Third-Party Systems

Omni Agentic may interact with third-party systems selected, configured, or used by the Customer.

Processing performed independently by those third parties is governed by:

• the Customer’s agreement with the provider;
• the provider’s privacy policy;
• Customer configuration;
• applicable law.

Omni Reasoning does not control the independent processing purposes of a third-party provider.

The Customer is responsible for determining:

• whether data may lawfully be transferred;
• whether Users have the required permissions;
• whether the selected interaction or integration is permitted;
• what notices must be provided to passengers and other individuals;
• what consents or other legal bases are required.

12. International Processing and Transfers

Omni Reasoning, Customers, and service providers may operate in different countries.

Personal data may be processed outside the country in which the individual is located.

Where required by applicable law, international transfers are protected using appropriate safeguards, which may include:

• adequacy decisions;
• Standard Contractual Clauses;
• Data Processing Agreements;
• contractual transfer provisions;
• supplementary technical and organizational safeguards;
• other lawful transfer mechanisms.

The use of globally distributed infrastructure may result in data being routed or processed in more than one jurisdiction.

Information about applicable transfer safeguards may be requested by contacting us.

13. European Union Representative

Where required by applicable data-protection law, including Article 27 of the General Data Protection Regulation, Omni Reasoning will designate a representative in the European Union.

Where such a representative is appointed, the representative’s identity and contact details will be published in this Privacy Policy or otherwise made available to affected individuals and competent supervisory authorities.

Until a representative is legally required and formally designated, privacy inquiries may be directed to Omni Reasoning using the contact details in Section 28.

14. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

When determining retention periods, we consider:

• the nature and sensitivity of the data;
• the purpose of processing;
• the duration of the Customer relationship;
• account activity;
• security requirements;
• audit requirements;
• potential disputes;
• contractual requirements;
• mandatory accounting and tax periods;
• Customer instructions;
• backup and recovery requirements.

In particular:

• website and security data is retained for periods required for delivery, diagnosis, abuse prevention, and protection;
• lead data is retained during the business relationship and for a reasonable follow-up period;
• account data is retained while the account is active and for a necessary period after closure;
• action and audit logs are retained for security, accountability, audit, and dispute-resolution purposes;
• communications are retained for business, support, and legal purposes;
• billing, payment, tax, and contractual records are retained for legally required periods;
• passenger, booking, and operational data is retained in accordance with product settings, Customer instructions, contractual commitments, and applicable law.

Data may be retained longer where:

• required by law;
• a legal dispute exists;
• an incident is under investigation;
• retention is necessary to protect legal claims;
• immediate deletion from a backup is technically impracticable.

Data in backups is deleted or overwritten through the applicable backup-retention cycle and is protected from ordinary production access.

15. Return and Deletion of Customer Data

Upon termination of the relevant services, the Customer may request the return or deletion of Customer Data, subject to:

• available product functionality;
• the applicable agreement;
• the Data Processing Agreement;
• applicable law;
• documented Customer instructions;
• technical limitations.

Omni Reasoning may retain limited information where necessary for:

• compliance with law;
• accounting and taxation;
• security;
• fraud prevention;
• legal claims;
• demonstrating that deletion was completed.

Aggregated or irreversibly de-identified data may be retained where it no longer identifies an individual or Customer.

16. Data Security

We use appropriate technical and organizational measures intended to protect personal data against:

• unauthorized access;
• accidental or unlawful destruction;
• loss;
• alteration;
• unauthorized disclosure;
• misuse;
• unauthorized execution;
• compromise of confidentiality, integrity, or availability.

These measures include, where appropriate:

• role-based access control;
• least-privilege access;
• authentication controls;
• multi-factor authentication;
• encryption in transit;
• encryption at rest;
• secure credential storage;
• environment separation;
• audit logging;
• security monitoring;
• backup and recovery;
• vulnerability management;
• dependency and patch management;
• secure software-development practices;
• access reviews;
• incident-response procedures;
• data minimization;
• personnel confidentiality obligations;
• supplier security controls.

Access to production data is limited to authorized persons who require access for legitimate operational, security, support, or legal purposes.

No method of transmission, storage, or processing can guarantee absolute security.

Users and Customers are also responsible for:

• protecting their accounts;
• protecting their devices;
• maintaining credential confidentiality;
• using appropriate access controls;
• providing data lawfully;
• promptly reporting suspected incidents.

17. Security Incidents

Where a personal-data or security incident is identified, we may:

• investigate the incident;
• contain affected systems;
• restrict access;
• revoke sessions;
• disable functionality;
• preserve relevant evidence;
• restore systems and data;
• notify the Customer;
• notify a competent authority;
• notify affected individuals where required by law;
• implement corrective and preventive measures.

Where Omni Reasoning acts as processor, we will notify the relevant Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data, subject to the applicable Data Processing Agreement.

Customers must provide reasonable information and cooperation where an incident relates to their Users, configuration, credentials, instructions, or data.

18. Individual Rights

Depending on location and applicable law, an individual may have the right to:

• receive information about processing;
• request access to personal data;
• receive a copy of personal data;
• correct inaccurate data;
• complete incomplete data;
• request deletion;
• request restriction of processing;
• object to processing;
• receive data in a portable format;
• withdraw consent;
• object to direct marketing;
• request human intervention where applicable;
• express a point of view regarding an automated decision;
• contest an automated decision where applicable;
• lodge a complaint with a competent supervisory authority.

These rights may be limited by:

• applicable law;
• the rights of other persons;
• contractual obligations;
• security requirements;
• the need to retain information for legal claims;
• the role of Omni Reasoning as processor acting on Customer instructions.

We may request information necessary to verify the identity and authority of the person making the request.

19. Requests Relating to Customer Data

Where Omni Reasoning processes personal data on behalf of a Customer, requests relating to that data should generally be directed to the relevant Customer.

In those circumstances, Omni Reasoning may:

• refer the requester to the Customer;
• forward the request to the Customer;
• provide reasonable assistance to the Customer;
• take action on the Customer’s documented instructions.

Omni Reasoning will not independently modify or delete Customer Data where doing so would conflict with lawful Customer instructions or an applicable agreement, unless required by law.

20. Marketing Communications

We may send information about products and services:

• with consent;
• within an existing business relationship;
• where another lawful basis applies.

Recipients may unsubscribe from optional marketing communications.

Unsubscribing from marketing does not prevent us from sending:

• service notices;
• account messages;
• contractual communications;
• billing communications;
• legal notices;
• security notifications.

21. Children

The website and product are intended for professional and business use.

They are not intended for independent use by children.

We do not knowingly collect children’s personal data for account creation or marketing.

A Customer may process data relating to a minor passenger as part of a lawful travel operation.

In such circumstances, the Customer is responsible for:

• establishing a valid legal basis;
• providing required notices;
• obtaining any required consent or authorization;
• applying appropriate safeguards.

If we become aware that a child’s personal data was provided unlawfully, we may restrict processing or delete the data.

22. Special Categories of Personal Data

Users and Customers must not provide special-category or highly sensitive personal data unless processing is:

• necessary;
• lawful;
• supported by the relevant product functionality;
• covered by appropriate safeguards;
• authorized by an applicable agreement.

Such data may include:

• health information;
• biometric data;
• genetic data;
• political opinions;
• religious or philosophical beliefs;
• trade-union membership;
• information concerning sex life or sexual orientation;
• other categories receiving enhanced protection under applicable law.

Where a travel operation objectively requires such data, the Customer is responsible for identifying the appropriate legal basis and implementing additional safeguards.

23. Required Data

Certain personal data may be required to:

• create an account;
• provide product access;
• authenticate a User;
• perform an instruction;
• complete an operation;
• maintain security;
• enter into or perform a contract;
• comply with law.

Where required data is not provided, the relevant account, feature, workflow, or service may be unavailable.

Optional data is identified through the relevant interface or the context of the request.

24. External Links

The website and product may contain links to third-party websites and services.

We are not responsible for:

• third-party content;
• third-party security;
• third-party availability;
• third-party privacy practices;
• independent processing performed by third parties.

The third party’s own privacy policy applies when a person accesses its website or service.

25. Corporate Transactions

In connection with:

• a reorganization;
• investment;
• financing;
• sale of a business;
• transfer of a product;
• sale of assets;
• merger;
• acquisition;
• insolvency;
• similar corporate events,

personal data may be disclosed to relevant participants, advisers, purchasers, investors, or successors, subject to applicable confidentiality and data-protection requirements.

26. Changes to This Privacy Policy

We may update this Privacy Policy where necessary due to changes in:

• the website;
• the product;
• processing activities;
• service providers;
• subprocessors;
• infrastructure;
• security practices;
• business model;
• applicable law.

The updated version will be published on this page with a revised effective date and version number.

For material changes, we may:

• display a notice;
• send a message to Users or Customers;
• require renewed acknowledgment or consent where required by law.

The revised Privacy Policy applies from its stated effective date.

27. Related Documents

This Privacy Policy should be read together with:

• the Terms of Service;
• any applicable commercial agreement;
• any applicable Data Processing Agreement;
• product-specific terms;
• product documentation;
• security documentation;
• notices displayed through the product interface.

Where this Privacy Policy conflicts with a Data Processing Agreement, the Data Processing Agreement takes priority in relation to the processing of Customer Data.

28. Contact

To protect personal data, we may request information necessary to verify:

• identity;
• authority;
• the relationship to the relevant account, Customer, or data;
• the scope of the request.

29. Complaints

Individuals may contact Omni Reasoning to raise a privacy concern or attempt to resolve a complaint.

Depending on applicable law, an individual may also lodge a complaint with a competent data-protection or supervisory authority.

Contacting Omni Reasoning does not limit any right to lodge a complaint or pursue another remedy available under applicable law.