Privacy Policy
Omfang AB — omfang.io
Effective date: 1 June 2026
1. Introduction
Omfang AB ("Omfang", "we", "us") operates Manifest, a hosted API that converts webpages into a structured JSON action manifest for use by AI agents ("the Service"). This Privacy Policy explains what data we collect, why we collect it, how we protect it, and your rights under the General Data Protection Regulation (GDPR).
This policy applies to all users of the Service, including the API, SDKs (Python, JavaScript), the MCP server, and the dashboard at app.manifest.omfang.io. If you have questions, contact us at max@omfang.io.
2. Data Controller
Omfang AB Organisationsnummer: 559958-2819 Email: max@omfang.io Website: omfang.io
3. Personal Data We Collect
3.1 Account and Identity Data
When you create an account, we collect your email address [CONFIRM: and name, if collected via Supabase signup]. This data is used to identify you, authenticate your login, and communicate with you about your account. Legal basis: performance of contract.
3.2 API Keys and Authentication
When you create an API key, we generate and store a hashed representation of the key associated with your account. The plaintext key is shown to you once at creation and is not recoverable by us afterward. Legal basis: performance of contract.
3.3 API Request Logs
We log API requests made under your account, including the target URL submitted for extraction, request timestamp, response status, and call counts. This data is used for billing, rate-limit and usage-cap enforcement, debugging, and abuse prevention. It is linked to your account and API key. [CONFIRM retention period — e.g., request logs retained for X days/months]. Legal basis: legitimate interests (billing, service integrity, and abuse prevention) and performance of contract.
3.4 Signup Attribution Data
When you sign up via a referral link (?ref= parameter), we record the referral source against your account to understand which channels drive signups. Legal basis: legitimate interests (product and growth analytics).
3.5 Submitted URLs and Extracted Page Data
The core function of the Service is to fetch a webpage you specify and return a structured JSON manifest describing its interactive elements (buttons, forms, fields, and the dependencies between them). To do this, we:
Load the submitted URL using an automated browser (Playwright/Chromium), and
Process the resulting page structure with a large language model to produce the manifest.
Manifest output is cached for a limited period (currently up to 6 hours) keyed to the URL, so that repeated requests for the same page don't require re-fetching or re-processing it. Where the /manifest/from-dom endpoint is used, the page content is supplied directly by your own authenticated content script rather than fetched by us, and cached manifests are scoped per-user (via cache_scope) to prevent cross-account leakage on pages that require authentication.
Submitted URLs and the pages they resolve to may be pages you do not own or control (for example, a customer's website or a third-party site your agent interacts with). We process this content solely to generate and return the manifest to you; we do not use it to train models, and we do not share it with any party other than the sub-processors listed in Section 4, who process it solely to provide the Service. Legal basis: performance of contract.
You are responsible for ensuring you have the right to submit a given URL to the Service and for how you use the resulting output — see the Terms of Service for details.
3.6 Dashboard Usage Data
We collect standard product-analytics data on how you use the dashboard (pages viewed, features used) via Google Analytics. This is used to understand product usage and improve the Service. Legal basis: legitimate interests.
3.7 Website Cookies and Analytics
The Omfang marketing website (omfang.io) uses Google Analytics to measure traffic. Analytics cookies are only set with your consent via the cookie banner. You can withdraw consent at any time.
4. Sub-Processors
We share data with the following third-party processors to operate the Service. Each processor has signed a Data Processing Agreement or is bound by equivalent contractual protections, and is subject to adequate data protection safeguards.
Anthropic (United States) — AI language model processing (Claude Sonnet) used to generate manifest output from page content. Standard Contractual Clauses apply.
[CONFIRM: Zhipu AI / GLM (jurisdiction) — AI language model processing (GLM 5.3-Flash) used for [specific extraction step, if applicable]. Include only if this model actually processes customer/page data in production, and confirm jurisdiction and safeguards.]
Hetzner Online GmbH (Germany) — Infrastructure hosting for the API backend, database, and browser automation. Located within the EEA.
Supabase (United States/EU, depending on project region) — Authentication and user management. Standard Contractual Clauses apply where applicable.
Stripe (United States/Ireland) — Payment processing and subscription billing. Adequacy decision / SCCs apply.
Vercel (United States) — Hosting for the dashboard frontend. Standard Contractual Clauses apply.
Google (United States/Ireland) — Analytics (GA4) for the dashboard and marketing site. Adequacy decision / SCCs apply.
5. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy. Key retention periods:
Account data (email): retained for the life of your account, deleted within 30 days of account closure.
API keys: deleted immediately on revocation.
API request logs: [CONFIRM retention period].
Cached manifest data: retained for up to 6 hours per URL, then expired automatically.
All other account data: deleted within 30 days of account closure.
6. Your Rights Under GDPR
As a data subject, you have the following rights:
Right of access — you may request a copy of the personal data we hold about you.
Right to rectification — you may request correction of inaccurate data.
Right to erasure — you may request deletion of your personal data, subject to our legal obligations.
Right to restriction — you may request that we restrict processing of your data in certain circumstances.
Right to data portability — you may request your data in a machine-readable format.
Right to object — you may object to processing based on legitimate interests.
To exercise any of these rights, contact us at max@omfang.io. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, www.imy.se).
7. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:
API keys stored in hashed form, not plaintext.
Encrypted connections (HTTPS/TLS) for all API and dashboard traffic.
Access to production systems restricted to authorised personnel only.
Per-user cache scoping to prevent cross-account data exposure on authenticated-page manifests.
Automated data deletion for time-limited retention categories (e.g., manifest cache).
8. International Transfers
Some of our sub-processors are based outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, we ensure adequate protection through Standard Contractual Clauses approved by the European Commission, or rely on an adequacy decision where applicable.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email or via the platform when material changes are made. The current version is always available at omfang.io/privacy.
10. Contact
For any questions about this Privacy Policy or how we handle your data:
Omfang AB Email: max@omfang.io Website: omfang.io Address: Östra Farmvägen 19BA, 21216, Malmö, Sweden
