Privacy Policy

OHMYGEN.IO PRIVACY POLICY

Effective date: 29 October 2026
Last updated: 29 October 2026
Version: 1.1

This policy explains what personal data we collect when you visit ohmygen.io, use the OhMyGen app at app.ohmygen.io or write to us, what we use it for, who we share it with, how long we keep it, and which rights you have.

OhMyGen is a service for businesses. Our Terms of Service cover the agreement itself. This policy covers personal data.

1. WHO WE ARE

The data controller is:

Gamoba ApS
CVR 44101653
Vestergade 19C, 1st floor
8000 Aarhus C
Denmark
Email: contact@ohmygen.io

When you put personal data about other people into OhMyGen, for example a photo of an employee or the comments people write to your social media accounts, you decide what happens to it. For that data your business is the controller, and we process it on your behalf (Terms of Service, section 19).

2. WHAT WE COLLECT

2.1 Your account

When you sign up: your name, your email address, and the company and brands you set up. Sign-in itself is handled by Clerk.

2.2 Billing

When you buy a subscription: your billing name and address, your VAT number if you give one, your email address, the plan, the amount and the payment status. You enter your card details directly with Stripe. We never see or store your full card number.

With the checkout we also record your IP address and your browser's user agent. They are passed on to Meta only if you have accepted marketing cookies (section 7).

2.3 Your content

What you put into the app, or ask it to fetch: your website address and what we read from your website (texts, product information, images, logo and colours), your product catalogue, the photos and files you upload, your brand descriptions and rules, the posts we generate for you, and the social media accounts you connect. We never receive your social media passwords. You connect your accounts through Zernio (section 4).

If you use the inbox, we also process the comments and direct messages people send to your connected accounts, and the replies you write.

2.4 Using the app

To run the service and keep its costs under control, we log every call to an AI provider: which person in your company started it, which feature, which model, how many tokens it used, what it cost and whether it succeeded.

The app also reports errors to Sentry. We have set it up to leave out names, email addresses, IP addresses and the contents of requests.

2.5 Visiting ohmygen.io

When you visit the website, our hosting provider processes technical data such as your IP address, your browser type, the pages you request and the time. We use the country that follows from your IP address only to decide whether to ask for your cookie consent first (section 7).

If you try the free generator, we read the public content of the website address you enter and create example posts from it. We keep a record of which websites have used the free trial, so that each website can use it once.

2.6 The welcome offer form

If you enter your email address in the offer form on our website, we store your address, the discount code you received, which page you signed up on and, if you ticked the box, your consent to receive emails from us, with the wording you agreed to and the time.

2.7 When you write to us

If you email us, we receive your email address, your name if you give it, and what you write.

3. WHY WE USE YOUR DATA, AND ON WHAT LEGAL BASIS

Each purpose, with its legal basis under the GDPR:

• Providing the service (your account, generating and publishing content, the inbox, support): performance of our contract with you, art. 6(1)(b). If you are not the customer yourself but work for one, the legal basis is our and your employer's legitimate interest in providing the service you use at work, art. 6(1)(f).
• Taking payment and keeping our books: performance of the contract, art. 6(1)(b), and our legal obligation to keep accounting records, art. 6(1)(c). The Danish Bookkeeping Act requires us to keep them for 5 years.
• The free generator: steps you ask us to take before a possible contract, art. 6(1)(b).
• Security, preventing abuse and fraud, logging errors and controlling costs: our legitimate interest in keeping the service safe, stable and affordable, art. 6(1)(f).
• Analytics and marketing cookies, ad attribution, reporting a purchase to Meta, and marketing emails: your consent, art. 6(1)(a). You can withdraw it at any time. Withdrawing does not affect processing that took place before.
• Visitors outside the EU/EEA, the UK and Switzerland: analytics and marketing are switched on from the start. The legal basis is our legitimate interest in measuring our website and our advertising, art. 6(1)(f), and you can object at any time via Cookie settings. If your browser sends a Global Privacy Control (GPC) signal, we treat it as that objection from the start.
• Documenting cookie consent: our legal obligation to be able to show that consent was given, art. 6(1)(c) together with art. 7(1).
• Improving OhMyGen with your content: only if you have given us permission under section 15 of the Terms of Service.
• Answering your questions and requests: our legitimate interest in answering you, art. 6(1)(f), or our contract with you if you are a customer.

4. WHO RECEIVES YOUR DATA

We do not sell personal data. We use the providers below to run OhMyGen. They process data on our behalf and only for the purpose stated.

If your company uses its own API keys with Anthropic, OpenAI or Google, the material for those calls goes to the provider under your company's own agreement with them. We store your keys encrypted.

Our own staff can open a customer account to help you or to fix an error. Every such access is logged.

5. TRANSFERS OUTSIDE THE EU/EEA

Some of our providers are based in, or process data in, countries outside the EU/EEA, mainly the USA. When personal data is transferred to such a country, the transfer is based either on an adequacy decision from the European Commission, such as the EU-US Data Privacy Framework for companies certified under it, or on the European Commission's standard contractual clauses.

You can ask us which safeguard applies to a particular provider.

6. HOW LONG WE KEEP YOUR DATA

• Your account and your content: as long as your company has an account with us. When you ask us to delete your company's data, we delete your brands, products, posts, images, uploads, logo and templates, and disconnect your social media accounts from Zernio. We keep only what the law requires us to keep.
• Billing records: 5 years from the end of the financial year they belong to, as the Danish Bookkeeping Act requires.
• The log of AI calls: 90 days.
• Error reports: until Sentry deletes them at the end of its retention period.
• Cookie consent records: 24 months.
• The free trial record: the address of each website that has used the free trial, so that it can only be used once.
• The welcome offer email: until you withdraw your consent or ask us to delete it.
• Emails to us: as long as we need them to help you and follow up.
• Cookies and browser storage: see the duration of each one in the list in section 7.

7. COOKIES AND CONSENT

We use cookies and similar technologies, such as local storage and session storage in your browser. They fall into four categories: necessary, preferences, analytics and marketing. The list at the end of this section shows each one, who sets it, how long it lasts and what it does.

Where we ask first. If you visit from the EU/EEA, the UK or Switzerland, we ask for your consent before we use anything that is not necessary. Until you answer, only the necessary ones are used. If we cannot tell which country you are visiting from, we ask.

Everywhere else. Analytics and marketing are switched on from the start, and you can switch them off at any time. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a choice of only the necessary cookies, until you choose otherwise under Cookie settings.

Changing your mind. You can change or withdraw your consent at any time via Cookie settings at the bottom of every page. Your answer applies for 12 months, and then we ask again.

Google Consent Mode. Google Tag Manager loads on every page and is told which categories you have accepted. Without your consent, Google's tags set no analytics or marketing cookies, but they may send Google signals without cookies, which Google uses for aggregated measurement.

How we document your answer. Each time you answer the cookie dialog, we log a pseudonymous consent ID, your choice, the language and the page you answered on, your country and the time. We do not log your IP address. The consent ID is shown in the cookie dialog, so you can quote it if you want us to find your answers. We keep the log for 24 months.

Our own ad attribution. If you have accepted marketing and arrive from an ad or a link with campaign details, we store them in your browser (ohmygen_sporing): the utm fields, Google's or Meta's click ID, the landing page and the page you came from. If you then buy a subscription, they are sent with the purchase, so we know which campaign it came from. The purchase is also reported to Meta through its Conversions API, with your email address in hashed form, your IP address, your browser's user agent and the click ID.

8. YOUR RIGHTS

Under the GDPR you have the right to:

• get access to the personal data we hold about you;
• have incorrect data corrected;
• have your data deleted;
• have the processing restricted;
• receive the data you have given us in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interest, and to direct marketing at any time; and
• withdraw your consent at any time, without affecting processing that took place before.

To use your rights, write to contact@ohmygen.io. We answer within one month.

You can complain to the Danish Data Protection Agency:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
www.datatilsynet.dk

You can also complain to the data protection authority in the country where you live or work. In Italy, that is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

9. CHILDREN

OhMyGen is made for businesses and is not aimed at children. We do not knowingly collect personal data about children. If you believe a child has given us personal data, write to us and we will delete it.

10. CHANGES TO THIS POLICY

We update this policy when the way we process personal data changes. The version and the date at the top show which version applies. If we make important changes, we will tell our customers.

11. CONTACT

Questions about this policy or your personal data: contact@ohmygen.io, or by post to Gamoba ApS, Vestergade 19C, 1st floor, 8000 Aarhus C, Denmark.