This Privacy Policy describes how OMD Growth (“we,” “us,” or “our”) collects, uses, stores, shares, and protects your information when you use Atlas ReportingOS (the “Service”), accessible at reportingos.com.
By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Account Information
When you create an account, we collect your full name, email address, company or organization name, and billing information. Payment details are processed securely by our third-party payment processor and are not stored on our servers.
1.2 Data from Connected Platforms
Atlas ReportingOS connects to third-party platforms on your behalf through OAuth 2.0 authorization. When you connect a platform, we access and process data from that service solely to deliver the features you have enabled. Connected platforms may include:
- Google services - Google Analytics, Google Ads, YouTube Analytics, Google Sheets, Google Forms
- Meta services - Meta Ads (Facebook Ads, Instagram Ads), Facebook Pages, Instagram
- CRM platforms - e.g., HubSpot, Close, GoHighLevel
- Lead capture tools - e.g., Typeform, JotForm
- Data hubs - e.g., Airtable
- Payment platforms - e.g., Stripe
We only request the minimum OAuth scopes necessary to deliver the features you have enabled. You can review and revoke any integration at any time from your account settings.
1.3 Google API Data
Google API Services User Data Policy Compliance: Atlas ReportingOS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When you connect Google services (such as Google Sheets, Google Analytics, YouTube Analytics, Google Ads, or Google Forms), the following applies:
- Access: We access only the data necessary to provide the reporting and analytics features you have requested. We request only the minimum OAuth scopes required.
- Use: Google user data is used solely to provide and improve user-facing features of the Service that are visible to you. We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising. We do not use Google user data to determine creditworthiness or for lending purposes.
- AI/ML restrictions: We do not use Google user data to train generalized (non-personalized) artificial intelligence or machine learning models. Any AI processing of Google user data is limited to producing outputs you have explicitly requested within the Service.
- Storage: Google user data is stored on encrypted servers with tenant-level isolation. OAuth tokens are encrypted at rest and never stored in plaintext.
- Sharing: We do not sell, rent, or trade Google user data to any third party, including advertising platforms, data brokers, or information resellers. Google user data is not shared with third parties except: (a) as necessary for our infrastructure providers to host and operate the Service under strict contractual obligations, (b) with your explicit consent, or (c) as required by applicable law.
- Human access: No one at Atlas ReportingOS can read your Google user data unless (a) you have given us affirmative agreement to view specific data for support purposes, (b) it is necessary for security or legal compliance, or (c) the data has been aggregated and anonymized for internal operations.
1.4 YouTube API Services
If you connect YouTube Analytics, your use of that integration is also subject to the YouTube Terms of Service. You may review Google’s privacy practices at the Google Privacy Policy. You may revoke Atlas ReportingOS’s access to your YouTube data at any time via the Google Security Settings page.
1.5 Meta Platform Data
When you connect Meta services (such as Meta Ads, Facebook Pages, or Instagram), the following applies:
- Access: We access only the data necessary to provide the reporting and analytics features you have enabled, using the permissions you grant during the OAuth authorization flow.
- Use: Meta user data is used solely to provide the reporting features of the Service. We do not use Meta user data for purposes unrelated to the Service.
- Sharing: We do not sell, rent, or trade Meta user data. We do not share Meta user data with third parties except as described in Section 3 of this Privacy Policy.
- Retention and deletion: Meta user data is retained only while the integration is active. When you disconnect a Meta integration, associated data is deleted within 30 days. See Section 5 for full deletion details.
Our handling of Meta user data complies with the Meta Platform Terms and the Meta Developer Policies.
1.6 Usage Data
We automatically collect certain technical information when you interact with the Service, including your IP address and approximate geolocation, browser type and operating system, pages visited and features used, timestamps and session duration, and referring URLs.
1.7 Cookies and Similar Technologies
We use cookies and similar tracking technologies to maintain sessions, remember preferences, and analyze usage patterns. You can manage cookie preferences through your browser settings. Essential cookies required for the Service to function cannot be disabled.
2. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Providing, operating, and maintaining the Service | Performance of contract |
| Syncing and processing data from connected platforms | Performance of contract; Your consent |
| Generating AI-powered reports and business insights | Performance of contract |
| Communicating with you about your account or the Service | Performance of contract; Legitimate interest |
| Improving, developing, and testing the Service | Legitimate interest |
| Ensuring security and preventing fraud or abuse | Legitimate interest; Legal obligation |
| Complying with legal obligations | Legal obligation |
We do not use your data, including data obtained from Google APIs, for any purpose not listed above. We do not sell your data to any third party. We do not use your data to serve advertisements.
3. How We Share Your Information
We do not sell, rent, or trade your personal information or any data obtained through connected platform integrations. We may share data with the following categories of recipients only as described below:
- Infrastructure and service providers: Third-party vendors who assist in operating the Service (hosting, monitoring, payment processing). These providers are contractually bound to use your data only as instructed by us and are prohibited from using your data for their own purposes.
- AI processing: To generate reports and insights, data from your connected platforms may be processed through AI services. We minimize the personal information sent to AI providers and use anonymization where feasible. No Google user data is shared with AI providers beyond what is strictly necessary to produce the outputs you explicitly request within the Service. AI providers are contractually prohibited from using your data to train their models.
- Legal requirements: We may disclose information if required by law, regulation, legal process, or enforceable governmental request, or in good-faith belief that disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.
4. Data Storage and Security
4.1 Storage
Your data is stored on secure servers managed by reputable infrastructure providers. We implement tenant-level data isolation so that your data is logically separated from other users of the Service.
4.2 Security Measures
We employ industry-standard security practices, including:
- Encryption of data in transit (TLS 1.2+) and at rest
- Secure OAuth 2.0 token storage with encryption at rest
- Role-based access controls for internal systems
- Regular security reviews and vulnerability assessments
- Logging and monitoring for unauthorized access attempts
4.3 Breach Notification
In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable regulations. We will also notify relevant platform partners and regulatory bodies as required.
5. Data Retention and Deletion
We retain your information only for as long as necessary to fulfill the purposes described in this policy:
- Account data: Retained while your account is active. After account deletion, all personal data is deleted within 30 days, except where retention is required by law.
- Connected platform data: Synced data is retained for as long as the integration is active. When you disconnect a platform, associated synced data is deleted within 30 days.
- OAuth tokens: Access and refresh tokens are deleted immediately upon disconnection of an integration or deletion of your account.
- Usage logs: Retained for up to 12 months for analytics and security purposes, then permanently deleted.
How to request deletion: You can delete your account and all associated data at any time. See Section 10 - Requesting Data Deletion for full details and instructions.
6. Your Rights
Depending on your jurisdiction, you may have the following rights:
- Access: Request a copy of the data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data.
- Portability: Request your data in a structured, machine-readable format.
- Restriction: Request that we restrict processing under certain circumstances.
- Objection: Object to processing based on legitimate interest.
- Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any right, email welcome@omdgrowth.com. We will respond within 30 days.
7. OAuth Integrations and Token Handling
The Service uses OAuth 2.0 to connect to third-party platforms. When you authorize a connection:
- You are redirected to the third-party platform’s authorization page to grant permission.
- We receive an access token and, where applicable, a refresh token.
- Tokens are encrypted at rest, stored in isolated infrastructure, and never logged in plaintext or shared with other parties.
- You can revoke access at any time from your Atlas ReportingOS account settings, or directly from the connected platform’s security settings (e.g., Google Account Permissions).
We do not store your passwords for any connected platform.
8. In-Product Privacy Notices
In addition to this Privacy Policy, we display contextual privacy notices within the Service when you connect a new platform integration, when you authorize access to a new data scope, and when we make material changes to data handling. These notices ensure you understand what data is being accessed and how it will be used at the moment you make a decision.
9. International Data Transfers
OMD Growth is based in Egypt. Your data may be processed on servers located outside your country of residence. Where applicable, we implement appropriate safeguards, including standard contractual clauses, to ensure your data remains protected in accordance with applicable data protection laws.
10. Requesting Data Deletion
All users, regardless of location, may request deletion of their data at any time, free of charge, and without needing to provide a reason. You do not need to meet any preconditions to request deletion.
To request deletion of your data, you may:
- Use the self-service option in your Atlas ReportingOS account settings to delete your account and all associated data.
- Email welcome@omdgrowth.com with the subject line “Data Deletion Request.”
Upon receiving your request, we will:
- Delete all personal data and connected platform data associated with your account within 30 days.
- Immediately revoke all OAuth tokens for connected integrations.
- Send you a confirmation email once deletion is complete.
If you connected Meta services (Facebook, Instagram, or Meta Ads) and wish to delete data obtained through Meta, you may also submit a request through our data deletion callback endpoint. When you remove Atlas ReportingOS from your Meta account, we automatically receive and process the deletion request. You will receive a confirmation code and a URL where you can check the status of your deletion request.
Note: Certain data may be retained beyond 30 days only where required by applicable law (e.g., tax or financial record-keeping). In such cases, the retained data is limited to what is legally required and is deleted promptly once the retention period expires.
11. California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act and the California Privacy Rights Act provide you with additional rights regarding your personal information:
- Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties with whom it is shared.
- Right to Delete: You may request that we delete your personal information, subject to certain legal exceptions.
- Right to Correct: You may request that we correct inaccurate personal information.
- Right to Opt Out of Sale or Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights.
To exercise your California privacy rights, email welcome@omdgrowth.com with the subject line “California Privacy Request.” We will verify your identity before processing your request and respond within 45 days.
12. Children’s Privacy
The Service is designed for use by businesses and is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete that information promptly. If you believe a child has provided data to us, contact welcome@omdgrowth.com.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, including changes to how we access, use, or share Google user data, we will notify you via email and request your consent before processing your data in a new way. Your continued use of the Service after non-material changes constitutes acceptance of the updated policy.
14. Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or your data, contact us:
- Legal entity: OD Consulting, doing business as OMD Growth
- Responsible person: Omar Darwish, CEO
- Email: omar@omdgrowth.com
- Website: reportingos.com