OMI Privacy Policy

Effective date: TBD (set on publication) Last updated: 2026-05-17 Status: DRAFT — pending review by external counsel

This Privacy Policy explains how Paper Plane LLC ("Paper Plane", "we", "us", or "our"), a Puerto Rico limited liability company, collects, uses, shares, and protects personal information when you use the OMI mobile applications, the OMI smart-kitchen hub, and the related backend service (collectively, the "Service").

If you are reading this in Spanish, see Aviso de Privacidad, which is the controlling Spanish-language version for residents of Puerto Rico, Mexico, and other Spanish-speaking jurisdictions.

1. Who we are

For users in the European Economic Area, the United Kingdom, or Switzerland, Paper Plane LLC is the data controller and may be contacted at the same address.

2. What we collect

We collect only what the Service needs to function. We do not sell personal information, and we do not use personal information for cross-context behavioral advertising.

Information you provide

Information we collect automatically

We do not use cookies for advertising. We do not include any advertising SDK.

3. How we use your information

We use personal information to:

1. Provide the Service — authenticate accounts, sync pantry items across devices, run product identification, generate recipes, send alerts.
2. Communicate with you — verify your email, send password resets, deliver evening check-ins and alerts you have opted into.
3. Improve quality — detect crashes, measure performance, identify failure modes in product identification.
4. Enforce limits + abuse prevention — apply rate limits, track usage of AI features for cost attribution, investigate misuse.
5. Comply with law — respond to lawful requests, defend legal claims, comply with retention obligations.
6. Train OMI's own machine-learning models — ONLY if you have explicitly opted in via Settings → Privacy → "Use my photos to improve OMI". This setting is OFF by default. Without your consent, your photos are used only to identify the product you scanned and are then deleted on the unconfirmed retention schedule below.

4. Legal bases (GDPR / UK GDPR users)

5. How we share your information

We share personal information only with the categories of recipients listed here and only as needed to deliver the Service.

Sub-processors

We have a Data Processing Agreement (or equivalent) with each sub-processor, or we are in the process of executing one before the Service launches publicly.

Legal disclosures

We disclose personal information when we have a good-faith belief that the law requires it, when we need to defend our rights, or when we need to protect the safety of users or the public. We do not voluntarily disclose data to law enforcement without a valid legal process.

6. International data transfers

Our servers and sub-processors are based primarily in the United States. When we transfer personal information of users in the European Economic Area, the United Kingdom, Switzerland, or other jurisdictions with cross-border-transfer restrictions, we rely on the European Commission's Standard Contractual Clauses (or the equivalent UK or Swiss mechanism) and on additional safeguards documented in our internal Records of Processing Activities.

7. How long we keep your information

Active legal holds (regulatory inquiry, dispute) override deletion until the hold is lifted.

8. Your rights

Regardless of where you live, you may request:

• Access — a copy of the personal information we hold about you
• Correction — to fix inaccurate or incomplete information
• Deletion — to delete your account and the personal information associated with it, subject to legal-hold exceptions
• Portability — a structured, machine-readable export of your data
• Restriction or objection — to limit how we use your information
• Consent withdrawal — to withdraw any consent you previously gave (e.g. ML-training opt-in)
• Non-discrimination — for California residents, the right to exercise your rights without service degradation

Send requests to support@paperplanellc.com with "DSR" in the subject line, or use Settings → Privacy in the app. We acknowledge within 48 hours and fulfill within 21 days, subject to identity verification.

California (CCPA / CPRA)

In addition to the rights above, California residents have:

• The right to know the categories and specific pieces of personal information collected
• The right to know the categories of sources, business purposes, and third parties to whom information was disclosed
• The right to opt out of "sales" or "sharing" of personal information — we do not sell or share personal information as those terms are defined under the CCPA / CPRA
• The right to limit the use of sensitive personal information — we do not collect sensitive personal information for purposes other than providing the Service

European Economic Area / United Kingdom / Switzerland

You have the right to lodge a complaint with your local supervisory authority. We will cooperate fully with any such authority.

Puerto Rico + México (LFPDPPP-style "Derechos ARCO")

See the Aviso de Privacidad for the Spanish-language explanation of Acceso, Rectificación, Cancelación, and Oposición.

9. Children

The Service is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact support@paperplanellc.com and we will delete it.

10. Security

We use industry-standard measures to protect personal information, including:

• TLS 1.2+ for data in transit
• Password hashing with bcrypt
• Session tokens stored in the iOS Keychain and Android EncryptedSharedPreferences, never in plain shared storage
• Audit logging of administrative actions
• Principle of least privilege for service accounts

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and the appropriate regulator within the timeframes required by applicable law (typically 72 hours under the GDPR, without unreasonable delay under U.S. state laws).

11. AI-generated content

OMI uses third-party AI services to identify products from photos and to generate recipes. AI output can be wrong. Always confirm allergens, ingredients, weights, and dietary information before consuming food prepared based on OMI recommendations. OMI is not a substitute for professional nutritional or medical advice. See the in-app disclaimer and the Terms of Service for further detail.

12. Changes to this Policy

We will update this Policy when our practices change or when the law requires. Material changes will be announced at least 14 days before they take effect, in-app and at the email address on file. The "Last updated" date at the top of this document always reflects the current version.

13. Contact

Paper Plane LLC Privacy contact: support@paperplanellc.com Postal: c/o registered agent, Puerto Rico (address on file with the PR Department of State)

This document is a working draft prepared by the OMI iOS engineering team for review by external counsel. It is not yet effective and must not be relied on by any user until publication.