Connecting a bank account and an accounting system to something is a real act of trust, and the question of what happens to that information afterwards deserves a straight answer rather than a link to a policy.
This page is the plain-English version. The privacy policy is the binding one, and where the two ever differ, the policy is right.
What is read, and why
Omnyra reads from the tools you connect — see connected tools. Each connection is one you make deliberately, and each article explains what that particular one brings in.
The purpose is narrow: answering questions about your business. A figure is only worth anything if it traces back to a real record, which is why the records are read at all rather than estimated.
Is it used to train AI models
No. Financial data and text are processed by third-party AI services to produce insights and answers, and those providers are under contract not to use your data to train their general models.
Worth being precise about the distinction, because it is the one people mean:
- Your data is processed to answer your questions. That is the product.
- Your data is not used to make a model that other people then benefit from.
Is it sold
No. Personal information is not sold. That is stated plainly in the policy and is not a matter of interpretation.
Who can see it inside your business
Your workspace is the boundary. Data belonging to one business is not shared with another, and within your own workspace what each person can open is decided by their role — see roles and permissions.
That is the control worth using. If a bookkeeper should not see payroll, the role is what stops them, not an agreement not to look.
Who else it reaches
Vendors under contract who do a specific job: the AI services described above, the infrastructure the platform runs on, and error and performance monitoring. All of them under confidentiality and security obligations.
Beyond that, only where the law requires it, or in the event of a merger or sale — in which case the same protections carry over.
How long it is kept
For as long as it takes to run the service, meet legal obligations, and settle any disputes. Aggregated or de-identified data may be kept for analytics after that, which is data that no longer identifies anyone.
Your own obligations for keeping business records are a separate matter and usually longer — see record retention.
What happens if you disconnect a tool
Disconnecting stops the flow. It does not automatically remove what was already brought in — that stays in your workspace until you delete it or ask for it to be deleted.
Some records may be kept where the law requires it or where removing them would break the audit trail on figures that have already been reported.
Getting it out, or getting it removed
Reports and records can be exported at any time.
Depending on where you are, you may also have the right to see what is held, correct it, or have it deleted. California has specific rights under the CCPA. Those requests go through support rather than a settings toggle, because they need identity checked first.
Where the authoritative answers are
The privacy policy and the terms. This article summarises them for the common questions; it does not replace them, and it is not legal advice about your own obligations to your customers — that is privacy and data protection.