Privacy Notice

Version network-2026-10-01-v3 · Effective when this network release first becomes publicly available.

1. Controller and scope

OMNILION GROUP LTD, company 17442958, 41 Trowbridge, Stoke-on-Trent, ST2 0JJ, United Kingdom, is the controller for personal information used to operate this business network. Contact hello@omnilion.co.uk. This notice covers the Platform, not the separate cleaning website. Participating businesses may be independent controllers for their own team and business contacts.

2. Information and sources

We handle account name and email, password authentication records, verification and recovery records, sessions, account and organisation IDs, team roles and invitations; business profile name, category, town, coverage, About and offer/need descriptions, optional business logo and cover, plus an optional named representative and role added by the business owner; separately published personal representative name, title, About, photo and cover chosen by that person; one-way business and hashtag follows and their timestamps, follower and following counts, connections, shared business messages, introduction proposals and confirmations; professional posts with text, uploaded images or limited MP4 video, their file metadata and audience choices, likes, comments, reposts and private business saves; network event and read-status metadata; Terms version and acceptance time; reports, reasons and moderation/admin decisions; support and privacy requests; and technical IP and security/rate-limit records needed to operate the service. Information comes from you, your inviting business, other participants and reporters.

Do not submit guest details, entry codes, payment credentials, unnecessary personal data or special-category information. Work and evidence functions and UK seller reporting have separate Work Terms and Work Privacy Notice available in those journeys. OMNILION does not process the underlying job payment. Subscription processing is described in the Membership Terms and payment privacy information. Advertising analytics and map/place-search integration are not active.

3. Purposes and lawful bases

We use account, membership and acceptance records to provide your requested account and network service: performance of a contract where you are the contracting individual, otherwise legitimate interests in providing the business's service. Profiles, discovery, business follows, connections, messages, introductions, posts and network notifications support the requested professional network on the same bases.

Security, rate limiting, reports, human moderation and privileged audit records support our legitimate interests in protecting users, preventing abuse, maintaining accountable decisions and defending claims, and legal obligations where applicable. Privacy rights requests are processed to comply with legal obligations. Our interests are balanced against the individual's rights and reasonable expectations. You may object to legitimate-interest processing. We do not rely on blanket consent for essential account processing or make solely automated decisions with legal or similarly significant effects. Verification, recovery, invitation and security emails are operational messages, not a marketing subscription.

Service-use measurement (updated 12 October 2026): we use limited account and service-use records and aggregate statistics to understand registration and participation and improve the service. This supports our legitimate interest in improving the professional network. We count account milestones once and keep those markers only with the account; anonymous registration-start records are removed after 30 days. This measurement is not used for advertising or cross-site profiling and adds no analytics cookies. You may object through the rights routes below.

4. Visibility and recipients

Only explicitly published descriptive business and person profile fields, including profile images and covers, are public. An owner should add a representative only with their knowledge and permission. Follow relationships are between businesses; follower and following counts and the followed-business list may be visible in the network. Following never opens private messages, work or client information. Posts labelled for OMNILION businesses, including attached media, are also accessible through a public permalink and may be previewed by external sharing services; connection-only posts require a permitted current connection. Comments and reposts follow the source post’s audience. A saved post is recorded privately for the saving business; sharing or reposting does not give anyone access beyond the post’s chosen audience. A post is not private correspondence. Owners and invited current members of a participating business share its messages and permitted records. Changing membership or profile visibility changes access; previously viewed information may already have been copied by its recipient.

Authorised operators access relevant account/business metadata, reported posts or conversation context, privacy requests and audit records for support, security and moderation. They are not unrestricted customer users. We may disclose data to advisers, courts, regulators or authorities where law requires or where necessary for a lawful claim. We do not sell private messages or use them for advertising.

5. Service providers and international processing

Cloudflare provides hosting, security and D1 database processing. Resend sends account verification, recovery and invitation emails and processes recipients, email content and delivery metadata. Their staff and subprocessors may process data internationally, including in the United States; we do not promise UK-only or EU-only processing. Network images and video are stored under a separate access-controlled namespace in the EU R2 bucket; work evidence remains separately governed by the Work Privacy Notice. Automatic evidence deletion remains disabled.

Provider agreements include data-processing terms. Applicable international-transfer safeguards include contractual clauses with the UK Addendum and, where applicable, recognised adequacy arrangements. Cloudflare's data-processing terms and Resend's data-processing terms explain safeguards and subprocessors. Contact us for information or a copy of the relevant safeguards. The provider documents do not imply absolute security or an independent approval of OMNILION.

We use verified sessions, current company membership checks, restricted publication and operator audit records. No internet service can guarantee absolute security. Tell us promptly about suspected unauthorised access.

6. Essential cookies

The Platform uses the secure, HttpOnly Better Auth session cookie (__Secure-better-auth.session_token) to maintain sign-in, normally for up to seven days with renewal during use. A current session and verification are still checked by the server. We do not use advertising or analytics cookies in this release, browser local storage, automatically loaded third-party maps or the private staging gateway cookie. These essential sign-in/security cookies are used when you request account access. External links only contact the linked site when you choose to follow them.

7. Retention and deletion

Account and profile data are kept while the account or business is active. Unpublishing removes directory display, while private records remain. After account/business closure we review and ordinarily delete or anonymise residual account/profile records within 24 months. Follows, connections, messages and introduction records are reviewed for deletion or anonymisation within 24 months after the relationship ends or its last exchange, subject to a continuing documented business need, another participant's rights or a legal claim.

Deleting a post immediately hides it; residual posts and routine reports are reviewed for deletion or anonymisation within 24 months of business closure or report resolution. Relevant serious abuse, legal-claim and administrative/Terms acceptance records may be retained for up to six years after closure or final resolution, where justified. Expired sessions and one-time tokens cannot be used; residual authentication, invitation, security and notification-read records are reviewed and removed when no longer needed for their security or operational purpose.

These are operator-managed review and retention criteria, not a claim of automatic deletion. Production has no evidence-deletion cron. A reviewed erasure request considers purpose, law, shared records, claims and any documented hold; we explain data retained and review the justification. Provider recovery copies may persist until overwritten under the provider's applicable recovery lifecycle and are not used to restore erased data into ordinary use without preserving the deletion decision. We do not assert a separately verified 30-day backup expiry. Contact us for a case-specific request.

8. Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability, and object to legitimate-interest processing. Where consent is used, you may withdraw it without affecting earlier lawful processing. Use Your data for scoped downloads and reviewed export/deletion/correction requests, or email hello@omnilion.co.uk for any right. We may verify identity and consider other people's rights and legal duties. We normally respond within one month, with any lawful extension explained.

You may complain to the UK Information Commissioner's Office at ico.org.uk or 0303 123 1113. We welcome the opportunity to address the concern first, but this is not required.

9. Eligibility and changes

The service is intended for adult business representatives. A declaration of being 18 or over is not verified age assurance. Contact us if a child is using the service or you believe their information has been submitted. Material privacy changes will be explained before new processing where required; the current version remains available here.

You can save or print this page for your records.