Global Privacy Policy

OMNIA SHIELD SUITE

Document version 3.2 — updated 14 October 2026

This notice describes how OMNIA SHIELD SUITE processes personal data and technical information when the app is used. OMNIA is designed around data minimisation, transparency and predominantly local processing.

1. Data controller

Andrea Merluzzo
Email: info@omniashield.com
Website: omniashield.com

2. Local-first principle

Security analysis is performed mainly on the device. Whenever technically possible, SMS, notifications, analysed content, detailed results, operational history, preferences and counters remain local.

The app does not directly access email accounts or complete conversations in third-party apps. Notification-based modules analyse only information made available by Android after the user voluntarily grants Notification Access.

OMNIA may download public threat-intelligence feeds. Matching against URLs, domains and indicators found in user content takes place on the device; such content is not sent to feed providers for verification.

3. Data processed on the device

Depending on enabled modules and granted permissions, OMNIA may locally process:

call-related technical data made available by the Android Call Screening role;
notification title, sender, source app and preview;
URLs, domains and technical indicators extracted from notifications;
data relating to the single contact voluntarily chosen through the Android picker for trusted contacts or SOS; separately, if the user enables local WhatsApp matching, OMNIA uses READ_CONTACTS to check on-device whether a number exposed by a notification is present in the address book. The address book and numbers are not uploaded or sent to servers. Alert Contacts are managed separately through OMNIA pairing;
installed-app metadata such as app name, package, version, source, signing certificate and declared permissions, only after explicit consent to the feature. Checks are local, do not open or upload APK files, and do not by themselves determine that an app is malware;
location requested for SOS, Travel Protection or an authorised Personal Safety session;
country, region or city selected or detected on request;
files or content voluntarily shared with OMNIA;
when the relevant feature is enabled and authorised, the appearance of newly added photos and videos on the device, without automatically analysing their content;
optional SOS video/audio recorded locally after manual activation;
settings, consent choices, switch state, counters and risk results;
language, theme and other local preferences.

4. Consent, Android permissions and Everyday Security

OMNIA requests permissions and special access only when required for the selected feature.

Android's READ_CONTACTS permission is requested only if the user enables local WhatsApp number matching against the address book. Installed-app visibility (QUERY_ALL_PACKAGES) supports local metadata scanning after explicit consent; it does not provide access to APK contents. Broad app visibility is declared separately to Google Play.

For Everyday Security, enabling automatic protection requires:

explicit consent shown in the app;
Android Notification Access;
the ability to enable or disable individual automatic controls.

Withdrawing consent or permission stops or limits dependent features. Android access is not used for new purposes without new information and, where required, renewed consent.

For Network Protection, OMNIA creates a local VPN interface on the device and checks compatible DNS requests. The requested domain is checked locally against risk rules; if it is not blocked, the DNS request is forwarded to the active network's resolver (for example, the router or carrier resolver), not to an OMNIA VPN server. That resolver therefore receives the domain needed to resolve the request. OMNIA does not route the remaining Internet traffic through its own servers. Some encrypted DNS requests or direct-IP connections may not be checked.

5. Trusted Alerts

Trusted Alerts is optional and separate from SOS and Family Guardian.

When enabled and paired with up to 3 Alert Contacts, OMNIA may transmit through Firebase/FCM only minimised metadata required for an authorised alert, such as:

module;
category;
risk level;
date/time;
technical alert or event identifier.

Original SMS, email, chat or notification text, as well as images and media files analysed locally, is not included or transferred to the Alert Contact. A recipient may use the Free version of OMNIA to receive automatic alerts. If a recipient does not have OMNIA, the app may prepare an SMS that requires manual confirmation and uses the user's own mobile plan.

6. SOS, location, camera and microphone

SOS is separate and manually initiated. During a user-started Personal Safety session with location consent, OMNIA may keep a foreground location service running and store the latest valid location, timestamp and accuracy on the device. Collection depends on Android permissions, session state and device limits; continuity after reboot or system-enforced termination is not guaranteed. If the user configures a trusted contact, explicitly enables automatic alerts and grants Android SEND_SMS permission, after three unanswered reminders OMNIA may send an SMS through the SIM to that contact only. The message may include the latest valid location only when the user has also consented to location. Carrier charges may apply; coverage, device, Android or carrier conditions can prevent or delay delivery, which OMNIA cannot confirm. This alert does not replace emergency services. Manual sharing occurs only after a user action through the app they choose.

If SOS Recording is enabled on an eligible plan, camera and/or microphone access is requested contextually. Recordings are stored locally and are not automatically transmitted by OMNIA.

When the user chooses to share information through SMS, WhatsApp, maps or another service, subsequent processing is governed by the selected external service.

7. Necessary remote data: License Engine, Firebase and Support ID

For Trial, Free plan, licences, add-ons, purchases, transfers and authorised devices, the following may be processed remotely:

pseudonymous technical device identifier;
Firebase or equivalent technical identifier;
pseudonymous OMNIA Support ID used for support and complimentary licences;
plan, entitlement and licence status;
first activation date and Trial state;
Family slots;
technical transfer tokens and references;
product identifiers, purchase tokens and verification status;
status and expiry of the monthly Personal Safety subscription, when purchased, to verify and maintain access during the paid period;
technical logs strictly necessary for security, abuse prevention and licence administration.

These data are not intended to include the original content of communications analysed locally.

8. Google Play and purchases

Google Play manages payments, receipts, refunds and purchasing accounts. OMNIA receives only technical data needed to verify entitlement and does not receive full payment-card details.

Basic, Premium, Family and the add-ons listed on the Plans page are one-time non-consumable purchases. The monthly Personal Safety subscription is a separate product: where available in the user's Play country, it unlocks Personal Safety and, if not already included in the Basic plan, Network Protection through the local VPN. Google Play displays the local price, billing period and any introductory offer or trial before purchase. The app does not receive full payment-card details.

The general 14-day Trial described in the Terms of Use is separate from any Google Play free trial for the subscription. The general Trial does not by itself create a subscription.

9. Purposes and legal bases

Remote processing may be carried out, as applicable, to:

perform the requested service;
manage Trial, licences, purchases and transfers;
prevent fraud, abuse and unauthorised access;
deliver Trusted Alerts enabled by the user;
handle support requests;
comply with legal obligations.

The legal basis may be performance of a contract/service, consent, legitimate interests in security and abuse prevention, or legal obligation, depending on applicable law.

10. Recipients and technical providers

OMNIA does not sell personal data and does not use it for behavioural advertising.

Limited data may be processed by necessary technical providers, including Google Play and Firebase/Google Cloud services, under their respective roles and terms. Other recipients are involved where selected by the user for sharing or where required by law.

11. International transfers

Because some technical providers operate globally, necessary technical data and metadata may be processed in countries other than the user's country.

Where required by law, international transfers must rely on a valid mechanism, such as adequacy decisions, standard contractual clauses, the Data Privacy Framework where applicable, equivalent arrangements or other legally recognised safeguards. OMNIA limits transfers to data required for the remote service being used.

Content that remains solely on the device is not transferred by OMNIA.

12. Retention

Local data remain on the device until deleted by the user, app data are cleared or the app is uninstalled, subject to any system backups outside OMNIA's control.

Remote Trial, licence, purchase, device and security data are retained as necessary to maintain entitlement, manage transfers, prevent abuse, handle disputes and comply with legal obligations. Support communications are retained as necessary to resolve the request.

13. Security and data breaches

OMNIA uses reasonable technical and organisational safeguards, including encrypted channels, access controls and pseudonymous identifiers. No system can guarantee absolute security.

Where a personal-data breach is subject to notification duties, OMNIA will assess and handle notices to authorities and affected individuals under applicable law.

14. User rights

Depending on the jurisdiction, users may have rights to:

access/know;
rectification/correction;
deletion;
restriction or objection;
portability;
withdraw consent;
opt out of sale or sharing for advertising purposes, where applicable;
limit certain uses of sensitive information, where applicable;
lodge a complaint with the competent authority;
non-discrimination for exercising privacy rights, where applicable.

To exercise rights relating to remote data: info@omniashield.com. Do not send passwords, OTPs or unnecessary data.

Data stored solely on the device can be deleted directly through the app or Android settings.

15. International privacy framework

OMNIA uses this notice as a global baseline. Depending on the user's location, the nature of processing and statutory thresholds, applicable laws may include:

EU/EEA GDPR;
UK GDPR and Data Protection Act;
Brazil's LGPD;
Canada's PIPEDA and applicable provincial laws;
Australia's Privacy Act / Australian Privacy Principles;
Japan's APPI;
the Republic of Korea's PIPA;
Singapore's PDPA and similar local laws;
India's Digital Personal Data Protection Act and Rules;
U.S. state privacy laws, including California's CCPA/CPRA where statutory conditions are met.

This list is illustrative and not exhaustive; national, state or provincial laws in served markets may also apply. Applicable law depends on the user's location, the activities carried out and the data processed, so rights and obligations may vary. This global notice does not replace mandatory local provisions or assert that one rule applies in every country.

16. Children

OMNIA is not designed for independent use by children under 13. Young Protection and Family features must be configured and used by a parent, guardian or other authorised person where required by law.

Where local law requires verifiable parental consent or a higher minimum age for particular processing, that requirement must be met before the relevant feature is enabled. OMNIA must not be used for covert or unlawful surveillance.

17. Changes

This notice may be updated because of technical, regulatory or provider changes. The version and update date are shown at the top.

18. Contact

Controller: Andrea Merluzzo
Email: info@omniashield.com
Website: omniashield.com

19. Data collected through the website

The omniashield.com website may collect data voluntarily provided by users through contact or application forms, including full name, email address, optional organisation and message content.

For investor applications, these data are used only to assess the request, reply to the applicant and, where appropriate, manage possible access to the private presentation. Submitting the form requires explicit acknowledgement of the privacy notice; access to the private area is not granted automatically.

Form data are stored on server infrastructure that is not publicly accessible and may be processed by technical providers required for hosting and email delivery. They are retained for the time necessary to manage the request and any subsequent relationship, subject to legal obligations and applicable deletion requests.

To exercise privacy rights regarding data submitted through the website: info@omniashield.com.