Privacy Policy

1. Overview and Data Controller

omnikitbolt (“we”, “us”, or “the Service”) is a browser-based image optimisation platform operated by omni kit, an individual based in Italy. This Privacy Policy explains what personal data we collect about you, why and on what legal basis we process it, who we share it with, and the rights you hold over it.

We are committed to processing personal data lawfully, fairly, and transparently in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Italian Personal Data Protection Code (Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018), and other applicable data protection laws.

The data controller for all personal data processed in connection with the Service is:

2. Image and File Processing — What Leaves Your Device and What Does Not

For the vast majority of tools, your images never leave your device.

The following tools process all image data entirely within your web browser using local CPU and browser APIs. No image data is transmitted to omnikitbolt's servers or to any third party at any point during processing:

• Compress (JPG, PNG, WebP, GIF, AVIF)
• Convert to WebP
• HEIC Converter
• Batch Resize
• Crop & Ratio
• Watermark
• Film Filters
• EXIF Viewer
• Find Duplicates
• Photo Cull
• PDF to Image
• Batch Rename
• Web Optimize
• Blog Ready

AI tools: limited and temporary transmission to Google Gemini

The following tools require a signed-in account and send data to Google's Gemini 2.5 Flash API for AI analysis. In each case, only a reduced-resolution thumbnail (maximum 512 pixels on the longest side) is transmitted, not the full original file:

• AI Rename — generates a descriptive, SEO-friendly filename from the visual content of the thumbnail.
• AI Alt Text — generates an accessibility description from the visual content of the thumbnail.
• AI Photo Sort / AI Organize — categorises images by visual content for batch organisation.
• Transcribe — sends the audio file (not a thumbnail) to Google Gemini for speech-to-text conversion.

omnikitbolt does not retain any copy of the thumbnail or audio file after the API call to Google Gemini completes. The thumbnail or audio exists transiently in server memory solely for the purpose of making the API request and is not logged, cached, or stored.

Google's handling of data submitted to the Gemini API is governed by Google's own privacy policy and the Gemini API Additional Terms of Service. We are not responsible for Google's data handling practices. You should review Google's documentation before using AI tools if you have concerns about the data you are submitting.

The legal basis for transmitting thumbnail data to Google Gemini is the performance of the contract with you (Article 6(1)(b) GDPR) — specifically, the provision of the AI tool features you have requested.

2b. omnikitbolt Browser Extension

The omnikitbolt browser extension ("omnikitbolt — Image Tools") provides the same image tools inside your browser's side panel. Like the website, all image processing (compression, conversion, cropping, watermarking, blurring, EXIF/GPS cleaning) and archive extraction (RAR, 7z, ZIP) happen locally in your browser. Your images and files are never uploaded to our servers.

The extension can read the images of a web page only after you explicitly open the panel or trigger an action on that page. Those images are processed on your device and are never transmitted to us.

Authentication and quota. For bulk actions only (download, compress or rename many images at once), the extension contacts your own omnikitbolt account at omnikitbolt.com to check your daily image quota and Pro status. This request relies on your existing omnikitbolt login session (a first-party authentication cookie sent by your browser) and transmits only a count of images; it does not send the images themselves, your password, or your browsing history. This is the single item of data that leaves your device, and only to omnikitbolt itself. We do not sell or share it with third parties.

3. Optional Cloud Storage Integrations

omnikitbolt offers optional integrations with Google Drive and Dropbox to allow you to import files directly from your cloud storage into the browser for processing.

• Google Drive — Files are accessed via the Google Picker API using the drive.readonly OAuth scope. omnikitbolt reads only the files you explicitly select. We do not browse your entire Drive, store your files, or retain your Google access token beyond the active browser session.
• Dropbox — Files are accessed via the Dropbox Chooser widget. Only the files you explicitly select are loaded into your browser. omnikitbolt does not store your Dropbox credentials or retain your files.

Once imported, files are processed locally in your browser in exactly the same way as files you upload directly. No additional data is transmitted as a result of using these integrations (except for AI tools, where the thumbnail-only policy described in Section 2 applies).

4. Account Data

A signed-in account is required to use AI tools and to access Pro plan features. When you create an account, we collect and store the following personal data:

• Your email address
• Your display name and profile picture URL (as provided by your OAuth provider: Google or GitHub)
• The authentication method used (Google OAuth, GitHub OAuth, or magic link email)
• Account creation timestamp and last sign-in timestamp
• Daily AI operation counts (used to enforce plan usage limits)
• Plan status (Free or Pro), subscription start date, and Stripe customer ID (if you subscribe to Pro)

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) — specifically, the provision of the Service and the enforcement of plan limits under these Terms of Service.

We do not sell your personal data to any third party. We do not use your email address for marketing communications without your prior explicit consent or a separate legal basis under applicable law.

5. Authentication and Session Management

Authentication is handled by NextAuth.js. You may sign in using Google OAuth, GitHub OAuth, or email (magic link). When you sign in via Google or GitHub, we request only the minimum OAuth scopes necessary for identity verification: your email address and public profile information. We do not request access to your Google Drive, Gmail, GitHub repositories, or any other services beyond what is needed to authenticate your identity.

Session tokens are stored as secure, HTTP-only, same-site cookies and expire after 30 days of inactivity or immediately upon sign-out. These cookies are strictly necessary for authenticated access to the Service and are set on the legal basis of contract performance (Article 6(1)(b) GDPR).

The specific session cookies set by NextAuth are:

• next-auth.session-token — stores your authenticated session. Required for login to function. Expires after 30 days of inactivity or on sign-out.
• next-auth.csrf-token — cross-site request forgery protection token. Session-scoped.
• next-auth.callback-url — stores the redirect URL during the OAuth flow. Session-scoped.

6. Payment Processing

Payment processing for Pro plan subscriptions is handled entirely by Stripe, Inc. When you subscribe to Pro, you provide your payment details directly to Stripe through their hosted payment interface. omnikitbolt does not receive, process, or store your full card number, CVV, bank account details, or any other raw payment credentials. The only payment-related data we store is your Stripe customer ID and your subscription status (active, cancelled, trialing, etc.), which are necessary to determine your plan entitlements.

Stripe processes your payment data as an independent data processor subject to PCI DSS compliance. Stripe's handling of your payment information is governed by the Stripe Privacy Policy.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) for processing related to subscription management; compliance with a legal obligation (Article 6(1)(c) GDPR) for retention of payment records required by Italian and EU tax law.

7. Analytics

Vercel Analytics (always active, cookieless)

We use Vercel Analytics to collect anonymised, aggregated page view data and web vital metrics (such as page load times). Vercel Analytics is cookieless and does not use fingerprinting or any other technique to identify individual users. No personally identifiable information is transmitted. This service is active for all users without requiring cookie consent and operates on our legitimate interest in maintaining and improving the Service (Article 6(1)(f) GDPR).

Google Analytics 4 (GA4) — behind cookie consent

We use Google Analytics 4 to understand how users interact with the Service. GA4 may collect your IP address (which Google partially anonymises), browser type, device type, geographic region, pages visited, and events such as tool usage. GA4 sets persistent cookies to distinguish users across sessions. GA4 is only activated after you grant cookie consent through our consent banner.

Legal basis: Your consent (Article 6(1)(a) GDPR), which you may withdraw at any time by updating your cookie preferences.

Meta Pixel (Facebook Pixel) — behind cookie consent

We use the Meta Pixel to measure the effectiveness of our advertising campaigns on Meta platforms (Facebook and Instagram). The Pixel may collect your IP address, browser information, the URL of pages you visit, and actions you take on the Service (such as signing up or starting a trial). The Pixel sets persistent cookies in your browser. The Meta Pixel is only activated after you grant cookie consent.

Legal basis: Your consent (Article 6(1)(a) GDPR), which you may withdraw at any time. You may also manage Meta's use of your data through Meta's cookie controls.

Meta Conversions API (server-side)

In addition to the client-side Meta Pixel, we also use Meta's Conversions API to send certain conversion events (such as account registration and subscription purchase) directly from our server to Meta for advertising attribution purposes. This server-side integration transmits:

• Your hashed (SHA-256) email address
• Your IP address (hashed before transmission)
• The event type (e.g., “CompleteRegistration”, “Subscribe”)
• A timestamp and event ID for deduplication with the browser-side Pixel

The Conversions API is activated only when you have granted cookie consent. Your email and IP address are hashed before transmission and Meta receives only the hashed values, not the originals. Despite hashing, this constitutes processing of personal data and is subject to your consent.

Legal basis: Your consent (Article 6(1)(a) GDPR).

Google Ads — behind cookie consent

We use Google Ads conversion tracking (via the Google tag / gtag.js) to measure the effectiveness of our Google advertising campaigns. Google Ads may collect your IP address and set cookies to attribute conversions (such as Pro plan subscriptions) to ad clicks. Google Ads tracking is only activated after you grant cookie consent.

Legal basis: Your consent (Article 6(1)(a) GDPR).

8. Advertising (Free Plan)

Users on the Free plan may see advertisements served by Google AdSense. Google AdSense uses cookies and similar tracking technologies to display advertisements that may be personalised based on your browsing history, interests, and inferred demographics. AdSense is only activated after you grant cookie consent through our consent banner.

You can manage your ad personalisation preferences at any time through Google Ad Settings or by opting out of personalised advertising via the Digital Advertising Alliance opt-out.

Users on the Pro plan do not see AdSense advertisements.

Legal basis: Your consent (Article 6(1)(a) GDPR).

9. Email Communications

Email delivery is handled by Resend, Inc., a transactional email service provider. We use Resend to send two categories of email:

Transactional emails

These emails are necessary for the operation of the Service and your account. They include: account verification and magic link sign-in emails, password change notifications, subscription confirmation and payment receipts, subscription cancellation confirmations, and material notices about changes to these Terms or our Privacy Policy. These emails are sent on the legal basis of contract performance (Article 6(1)(b) GDPR) and cannot be unsubscribed from while you have an active account.

Marketing emails

If you have opted in to marketing communications, or where permitted by applicable law (such as the soft opt-in provision for existing customers under the Italian Privacy Code and the ePrivacy Directive), we may send you product updates, new feature announcements, tips, and promotional offers. These emails are sent on the legal basis of your consent or legitimate interest (Article 6(1)(a) or (f) GDPR). You may unsubscribe from marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting us at omni@omnikitbolt.com. Unsubscribing from marketing emails does not affect your receipt of transactional emails.

Resend processes your email address and email delivery data as a data processor on our behalf. Resend's privacy practices are described in the Resend Privacy Policy.

10. Cookie Policy

We use a cookie consent banner to give you control over non-essential cookies. The categories below explain which cookies we set and on what basis.

You may withdraw or change your cookie consent at any time by clicking “Cookie Settings” in the footer of any page. You may also disable cookies through your browser settings, but doing so may impair the functionality of certain features of the Service. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

11. Third-Party Data Processors and Sub-Processors

The following third-party services may process personal data in connection with the Service. All international transfers of personal data outside the EEA are made on the basis of Standard Contractual Clauses (SCCs) adopted under Article 46(2)(c) GDPR, adequacy decisions, or other appropriate safeguards under Chapter V of the GDPR.

12. Data Retention

• Account data (email address, display name, profile picture, usage counts, plan status) is retained for as long as your account remains active. Upon account deletion, this data is permanently and irreversibly erased within 30 days of your deletion request, except where retention is required by law.
• Image thumbnails and audio files (AI tools) are not stored by omnikitbolt in any persistent storage. They exist transiently in server memory only for the duration of the API call to Google Gemini and are immediately discarded after the response is received.
• User-uploaded files (client-side tools) are processed entirely in your browser and never transmitted to or stored on omnikitbolt's servers. There is no retention period because no server-side copy is ever created.
• Payment records (Stripe customer ID, subscription history, invoice data) are retained for the period required by applicable Italian tax and accounting law — generally 10 years from the date of the transaction under Article 2220 of the Italian Civil Code — even after account deletion.
• Email marketing records (consent records, unsubscribe records) are retained for as long as necessary to demonstrate compliance with applicable email marketing law.
• Analytics data is retained in accordance with the retention policies of the respective third-party analytics providers (e.g., GA4 default retention: 14 months).
• Server access logs (generated by Vercel) contain transient IP addresses and request metadata and are retained for the period specified in Vercel's data retention policy.

13. Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with equivalent data protection laws, you have the following rights in relation to your personal data:

• Right of access (Article 15 GDPR) — You may request a copy of the personal data we hold about you, along with information about how we process it, the categories of data processed, and the recipients to whom it has been disclosed.
• Right to rectification (Article 16 GDPR) — You may request that we correct inaccurate or incomplete personal data we hold about you without undue delay.
• Right to erasure / ‘right to be forgotten’ (Article 17 GDPR) — You may request the deletion of your personal data where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object to processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. This right is subject to legal obligations to retain data (e.g., tax records).
• Right to data portability (Article 20 GDPR) — You may request your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV) and, where technically feasible, request that we transmit it directly to another data controller.
• Right to restriction of processing (Article 18 GDPR) — You may request that we limit our processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or have objected to processing pending verification of legitimate grounds.
• Right to object (Article 21 GDPR) — You may object at any time to the processing of your personal data based on our legitimate interests (Article 6(1)(f) GDPR), including for direct marketing purposes. Upon receiving an objection to direct marketing, we will cease processing immediately.
• Right to withdraw consent (Article 7(3) GDPR) — Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Rights related to automated decision-making (Article 22 GDPR) — omnikitbolt does not make solely automated decisions that produce legal or similarly significant effects about you.

To exercise any of these rights, contact us at omni@omnikitbolt.com. We will acknowledge your request within 72 hours and respond substantively within 30 days. Where requests are complex or numerous, we may extend the response period by a further two months, in which case we will notify you within the initial 30-day period.

We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, as permitted by Article 12(5) GDPR.

If you believe we have not adequately addressed your rights, you have the right to lodge a complaint with your competent supervisory authority. In Italy, the supervisory authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority). EU residents may also contact the supervisory authority in their country of habitual residence.

14. Children's Privacy

The Service is not directed at or intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have inadvertently collected personal data from a child under 16 without verifiable parental consent, we will take prompt steps to delete that data from our systems.

If you are a parent or legal guardian and you believe your child under 16 has provided personal data to us, please contact us immediately at omni@omnikitbolt.com and we will take appropriate action.

15. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include HTTPS encryption for all data in transit, HTTP-only and same-site session cookies, server-side rate limiting on API endpoints, input validation and sanitisation, and access controls on systems that process personal data.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we use commercially reasonable efforts to protect your personal data, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (Article 33 GDPR) and, where required, will notify affected users without undue delay (Article 34 GDPR).

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, applicable law, or our data practices. When we make material changes — particularly changes that expand the categories of data we collect, change the legal basis for processing, or introduce new third-party processors — we will update the “Last updated” date at the top of this page and, where required by applicable law or where the change materially affects your rights, notify registered users by email or by a prominent notice within the Service at least 14 days before the change takes effect.

Continued use of the Service after the effective date of an updated Privacy Policy constitutes acceptance of the revised policy. If you do not accept material changes to this policy, you must stop using the Service and may request deletion of your account.

17. Contact and Data Subject Requests

For privacy-related questions, requests to exercise your GDPR rights, or any other data protection enquiries, please contact us:

• Email: omni@omnikitbolt.com
• Data controller: omni kit, Italy
• Website: omnikitbolt.com

Please include your name, email address associated with your account, and a clear description of your request or concern. We may need to verify your identity before processing certain requests to protect against fraudulent access to your data.