Skip to main content
This page is the single public answer to “what does Omniflow do with data?” — customer records, operator records, anonymous telemetry, and anything that reaches an AI provider or MCP server. Each section links to the page that documents its subject in full; this page exists so the retention picture doesn’t have to be assembled by reading five pages at once, and it names the one place where documented retention isn’t yet enforced rather than leaving that to be discovered.

​
What Omniflow holds and why

Customer data. Identity, contact channels, orders, wallet, referrals, support history, and consent — owned by the customer, exportable and deletable from their own account. See Personal data and privacy for exactly what a customer can see, download, and request removed, and what’s kept regardless. Operator and audit data. Every authentication, authorization, configuration, and financial action an operator takes is append-only audited with the actor, target, reason, and timestamp. See Security for what the trail records and who can read it. Anonymous telemetry. One daily heartbeat: an installation identifier, build version, service name, OS, and CPU architecture. Nothing that could identify a customer, an amount, or a domain. See Anonymous telemetry for the exact event and how to verify what’s sent. AI and MCP data. Nothing reaches a configured AI provider or MCP server without passing through a single redaction gateway first. See AI privacy for what’s stripped and AI governance for the data-flow inventory — a table of every source, what leaves, and where it’s retained.

​
Retention defaults

Operator sessions, customer sessions, magic links, and customer security events are not swept by the retention worker. The windows above are the documented design; nothing calls the purge routine that would enforce them, so these tables grow without bound today. This does not create an access risk — an expired session cannot authenticate regardless of whether its row still exists, because validation is by deadline, not by row presence — but it is a real storage and hygiene gap, stated here rather than implied to be handled. See Security for the underlying detail.
Retention only runs on the worker process. An installation running only api and bot accumulates all of the above with no cleanup at all — see Jobs and queues.

​
Telemetry contract and opt-out verification

The exact JSON body, the complete “never collected” list, and the collector’s own validation rules are documented in full at Anonymous telemetry. In short: set APP_TELEMETRY_ENABLED=false and every telemetry request stops — the page documents the exact log line that confirms it, so the opt-out is something you can verify rather than something you have to trust.

Threat model

What’s at risk on each surface and the mitigation that actually exists.

Personal data and privacy

The customer-facing export and deletion screen.