Who is responsible for your data
The operator of this deployment is Panagiotis Mimilidis. Contact privacy@onlymecrm.com for privacy questions.
Your agency or workspace decides which creator and fan records it imports and who can use them. Its responsibilities and the application operator’s controller or processor role must be documented in the actual service agreement. The workspace must have permission and a lawful basis to process the records it adds.
Information the application uses
- Account information: name, email, profile image, password hash, verification and reset records, and encrypted authenticator setup when enabled.
- Security information: sign-in sessions, IP address, browser or device description, last activity, access permissions and audit events.
- Workspace information you or your team provide: creator profiles, platform handles, fan profiles, conversations, notes, scripts, media, assignments, campaigns, imported revenue and compliance records.
- Preferences saved on your device, including appearance and workspace settings. See cookies and browser storage for their purpose and lifetime.
How that information is used
The application uses these records to provide account access, protect sessions, organize the workspace, show reports, prepare messages and maintain an audit trail. Authorized team members can access records according to their role, work area and creator assignments.
Creator media and private conversations can contain sensitive personal information. The workspace must limit collection, establish the appropriate legal basis, and meet any additional conditions for sensitive data. The operator must publish the legal basis for each purpose before live use; these pages do not establish a basis on the operator’s behalf.
Providers and information sent outside this application
- Hosting, database, file storage and backups are selected by the deployment operator. Their names, locations and retention policies still need to be published for this deployment.
- Google sign-in is configured. Choosing it sends you to Google and supplies your verified email, name and profile image to this application.
- Transactional email is available only if the operator configures an email service. The selected service receives recipient addresses and the contents of verification, reset or workspace emails that are sent.
- Password breach checking is enabled. When enabled, the server sends only the first five characters of a password’s SHA-1 hash to Have I Been Pwned’s Pwned Passwords service, rather than the password or full hash.
- When a configured AI feature is requested, the provider can receive the prompt and the context described in that feature. Message reply suggestions can include the creator’s stage name and voice settings, fan notes and spend context, and recent conversation text. Review what you share before using a provider.
- Connecting a platform or opening a managed creator browser involves that platform and the configured browser service. Saved browser state can include platform login cookies; forgetting that saved session removes its reusable state. Proxy tests contact the configured connectivity test service.
- Public Windows installer files are served by GitHub. Following the download link sends request data, such as your IP address and browser information, to GitHub. See GitHub's Privacy Statement.
This version does not include advertising pixels, third-party website analytics or session replay. Server and hosting access logs may still contain technical request information. External providers have their own policies; the operator must confirm contracts, subprocessors and any international transfer safeguards before enabling them for live personal data.
Retention and deletion
The sign-in cookie expires after 7 days; this does not automatically delete account or session database records. Workspace data remains in the configured database or storage until an authorized removal or the operator’s retention process applies. A complete schedule for accounts, audit logs, uploads, inactive workspaces and backups has not yet been supplied.
Signing out clears this application’s scoped private browser settings through its sign-out flow. It does not erase the workspace’s server records, backups, or data held by a connected platform.
OMA Assistant lets you delete your stored questions, answers and unapplied task proposals. Shared knowledge and tasks already created stay in place. Minimal request metadata is retained to preserve daily usage limits and prevent duplicate paid requests; unresolved requests require a provider-history check before closure. Deletion does not cancel a provider request or delete the provider’s records. When the agency review worker runs, it removes question and answer content older than 30 days while retaining unresolved request metadata. The operator must review the remaining metadata and audit retention in its full retention schedule.
Access, correction, export and erasure requests
Depending on the circumstances and applicable law, you can request access, correction, erasure, restriction or portability, object to processing, withdraw consent where used, and complain to your supervisory authority. The EDPB explains these rights.
Send your request to privacy@onlymecrm.com. For fan or creator records, contact the workspace that holds them. Include enough information to locate your record, without sending passwords or authenticator keys.
Authorized compliance staff can use Data requests to record and process requests. Exports create a JSON bundle. Confirmed fan erasure removes the linked fan and related conversation records from the live database; creator and other requests require manual handling. Recording a request alone does not erase data, and backups and connected providers require the operator’s separate process.