Omni Data Processing Addendum for Pro accounts

Last updated: 19 October 2026

1. Who and what

This addendum forms part of the Omni Terms of Service between Vital Alchemy LLC, 1032 E Brandon Blvd 4545, Brandon, FL 33511, USA ("Omni", "we") and each customer on a Pro or founding Pro plan ("you") who uses Omni to store or process personal data about other people, such as clients ("Client Data"). It applies automatically, with no signature needed, and takes precedence over the Terms where they conflict for Client Data.

For Client Data you are the controller and Omni is your processor under Article 28 GDPR (and the UK GDPR where it applies).

2. Details of the processing

• Subject and duration: hosting and processing Client Data for as long as your Pro account exists.
• Nature and purpose: storing client charts in your Library, receiving client intake forms, calculating charts, and building reports and presentations you ask for.
• Types of data: names, birth date, time and place, email addresses, notes you write, chart results, and anything a client enters into an intake form you send.
• Data subjects: your clients and other people whose charts you enter.

3. Our commitments

We will:

1. process Client Data only on your documented instructions, which are your use of the Pro features and these terms, unless the law requires otherwise, in which case we tell you first where the law allows;
2. make sure everyone with access to Client Data is bound to confidentiality;
3. apply the security measures in section 6;
4. use only the sub-processors in section 5, and tell you by email or in the app at least 14 days before adding or replacing one, so you can object and, if we cannot resolve the objection, end your Pro plan with a pro rata refund;
5. help you answer requests from your clients exercising their GDPR rights, using the tools in the app (edit, export, delete) and by email support;
6. tell you without undue delay, and within 72 hours, after we become aware of a personal data breach affecting Client Data, with the information we have;
7. help you with data protection impact assessments and consultations with authorities where that concerns our service;
8. delete Client Data when you delete it in the app or close your account, within 30 days, with backup copies removed within a further 90 days, unless the law requires us to keep it;
9. give you the information needed to show compliance with Article 28, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year, at your cost, in the first instance by written questionnaire.

4. Your commitments

You confirm that you have a lawful basis to enter Client Data into Omni and that you have told your clients, in your own privacy notice, that you use Omni.

5. Sub-processors

Vercel Inc. (hosting and file storage, USA); Upstash Inc. (database, USA); Amazon Web Services (email sending, USA); Resend Inc. (backup email, USA); PostHog Inc. (error tracking, EU); Google LLC (place and time zone lookups, sent without client identity); GeoNames (place lookups, Switzerland).

6. Security measures

Encryption in transit (TLS); access-controlled database with credentials kept in the hosting provider's secret store; signed, expiring sign-in links and secure cookies; administrative access limited to Luciano Armani; separation of each account's data by account key; backups with limited retention; regular review of access.

7. Transfers outside the EU

Where Client Data leaves the EU or EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework for certified US sub-processors) or on the EU Standard Contractual Clauses (Commission Decision 2021/914), module 2 between you and Omni and module 3 between Omni and its sub-processors, which are incorporated by reference.

8. Liability and law

Liability under this addendum follows the Terms. Where the Standard Contractual Clauses apply, they govern for the transfer they cover, under the law of Ireland.

Contact for this addendum: luciano@omnicharts.app.