This notice explains what information Om Concepts collects when you use this website, why we collect it, who we share it with, and the rights you have over it. Plain English, founder-signed, reviewed regularly.
Who we are
Om Concepts is a sole proprietorship operated by Alex Colon in the Lehigh Valley, Pennsylvania. We build marketing systems, custom software, and AI agents for small and mid-sized businesses. For the purposes of GDPR and similar laws, Om Concepts is the data controller for information collected through this site.
Reach us at alex@omconcepts.net or (484) 632-0822. Om Concepts is based in the Lehigh Valley, Pennsylvania. For privacy requests, email is the fastest path.
Information we collect
- Contact form submissions: name, email, optional phone, business name, service interest, project goals, budget range if provided, and any UTM parameters attached to your visit.
- Guide downloads: name, email, and optional company.
- Agent endpoint inputs: prompts you send to agent demonstrations, plus a hashed IP for rate-limiting. We keep a minimized audit record of each run and strip personal details from stored prompts.
- Automated request metadata: IP address, user agent, referer, and timestamps, used for rate-limiting, abuse prevention, and security monitoring.
- Cookies: first-party UTM cookies for campaign attribution and Google Analytics cookies when analytics is enabled. See /cookies for the full list.
How we use information
We use the information above for the following purposes. The lawful basis under GDPR is listed for visitors in the EU, UK, and similar jurisdictions.
- Respond to inquiries and deliver requested content like guides. Basis: performance of a contract or pre-contract steps at your request.
- Maintain the security of the site, prevent abuse, and enforce rate limits. Basis: legitimate interests in keeping the service available and safe.
- Measure aggregate traffic and campaign performance. Basis: consent where required, otherwise legitimate interests in understanding how our site is used.
- Send transactional confirmations and, where you opt in, occasional nurture emails. Basis: consent.
- Operate agent demonstrations and keep auditable receipts of their outputs. Basis: performance of the service you requested and legitimate interests in provenance and accountability.
- Meet legal obligations such as tax, accounting, and responding to valid legal requests. Basis: legal obligation.
Service providers and sub-processors
We use a small set of vendors to run the site and to deliver work to clients. We do not sell your personal information to any third party, and we do not share it for cross-context behavioral advertising. We disclose data to these service providers only as necessary to operate our services, on their standard data processing terms. A current named list with data shared and country of processing is maintained at /sub-processors. The categories below cover vendors we use today and classes of vendor we may use as features expand.
- Analytics providers: aggregate traffic analytics and tag management to understand site usage.
- Email delivery providers: transactional and nurture email services that send confirmations, replies, and opt-in sequences on our behalf.
- Customer communication and SMS providers: platforms for lead follow-up, appointment reminders, and two-way messaging when a client opts in to SMS.
- Payment processors: services that handle card payments and payment method storage for any paid engagement, invoice, or future checkout flow.
- Accounting and bookkeeping integrations: platforms used for invoicing, client receivables, and financial record-keeping.
- CRM and marketing automation providers: systems used for lead intake, nurture, and customer records.
- Scheduling and calendar providers: tools for booking, availability, and meeting links.
- AI and language-model providers: model APIs used to power agent demonstrations and internal workflows. Inputs are minimized and sanitized receipts are stored.
- Hosting and cloud infrastructure: edge hosting, CDN, storage, and logging providers that serve the site and process request metadata.
- Automation and workflow platforms: integration glue used to route data between the systems above.
- Voice, video, and transcription: conferencing and meeting-transcription services used for discovery calls and client work, where participants are notified before recording.
Cookies
We use a minimal set of cookies. A dedicated cookies notice lives at /cookies. The short version:
om_utm_source,om_utm_medium,om_utm_campaign,om_utm_term,om_utm_content: first-party attribution cookies. 30-day expiry.SameSite=Lax._ga: Google Analytics client identifier. Third-party. 2-year expiry._ga_*: Google Analytics session state. Third-party. 2-year expiry._gid: Google Analytics daily visitor identifier. Third-party. 24-hour expiry.
Data retention
We retain personal information only as long as necessary for the purposes described in this notice or to meet legal obligations. Approximate windows:
- Lead and guide submissions: up to 24 months after last contact, then archived or deleted on request.
- Agent endpoint audit records: up to 12 months for abuse monitoring and quality review.
- Server and edge logs: short-term, typically no more than 30 days.
- Analytics data: up to 14 months.
- Transactional email delivery logs: short-term, per our email provider's defaults.
Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to certain uses. California residents have rights under the CCPA and CPRA, including the right to know, delete, correct, and opt out of “sale” or “sharing.” Residents of Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), and other US states with comprehensive privacy laws have substantially similar rights, and we extend the same process to any US visitor who requests it. Pennsylvania residents receive the same response path under this notice.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. To exercise a right, email alex@omconcepts.net. We respond within 30 days and will verify your identity before acting on requests about specific data. You can also complain to your local data protection authority.
AI-assisted processing
We may use AI-assisted tools to process inquiries, draft replies, triage leads, and generate internal summaries. Human review happens before any substantive reply is sent. If you would prefer your inquiry be handled without AI assistance, email alex@omconcepts.net and we will route it to a human-only workflow. AI-assisted outputs attached to a lead or published artifact are logged with a minimized audit record so the processing is auditable.
Voice agent interactions
If you use the voice agent on /voice, the call audio, the transcript, and the AI-generated summary are stored in our Fireflies workspace. We review every transcript. You can request deletion of the transcript and recording by emailing alex@omconcepts.net. The voice agent is an optional path; the contact form and calendar booking are fully functional without it.
International transfers
Om Concepts is based in the United States, and our sub-processors store and process data in the US. If you access the site from outside the US, your information will be transferred to and processed in the US. For transfers from the EU, UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards offered by our sub-processors as the legal basis for transfer.
Children
This site and our services are directed at businesses and professionals. We do not knowingly collect information from children under 13 in the US, or under 16 in the EU and UK. If you believe we have collected information from a child, email alex@omconcepts.net and we will delete it.
Security
All site traffic is served over HTTPS. Admin access to every vendor platform we use is protected by multi-factor authentication with least-privilege roles. We do not write plaintext personal information into application logs. See /security for our full security posture and incident response commitments.
Changes to this notice
We update the “Last updated” date at the top of this page whenever this notice changes. For material changes that expand how we use your information, we will notify affected contacts by email or post a notice on the site for at least 30 days before the change takes effect.
Contact
Questions, requests, or concerns about this notice go to alex@omconcepts.net. Om Concepts is based in the Lehigh Valley, Pennsylvania. Written requests can be sent to the same email. A human will write back.
Questions about something else? Start a conversation.