Privacy

This notice explains what information Om Concepts collects when you use this website, why we collect it, who we share it with, and the rights you have over it. Plain English, founder-signed, reviewed regularly.

Who we are

Om Concepts LLC is a Pennsylvania limited liability company operated by Alex Colon in the Lehigh Valley. On this site we go by Om Concepts. We build marketing systems, custom software, and AI agents for small and mid-sized businesses. For the purposes of GDPR and similar laws, Om Concepts LLC is the data controller for information collected through this site.

Reach us at alex@omconcepts.net or (484) 632-0822. Om Concepts is based in the Lehigh Valley, Pennsylvania. For privacy requests, email is the fastest path.

Information we collect

• Contact form submissions: name, email, optional phone, business name, service interest, project goals, budget range if provided, and any UTM parameters attached to your visit.
• Networking contact exchange: name, email and/or phone, optional company and connection note, submission time, and the separate email and text follow-up permissions you choose. Details you share through Alex's digital card are stored in Notion for maintaining the connection. Sharing does not subscribe you to a newsletter or automatically send you a message.
• Guide downloads: name, email, and optional company.
• Agent endpoint inputs: prompts you send to agent demonstrations, plus a hashed IP for rate-limiting. We keep a minimized audit record of each run and strip personal details from stored prompts.
• Automated request metadata: IP address, user agent, referer, and timestamps, used for rate-limiting, abuse prevention, and security monitoring.
• Cookies: first-party attribution cookies for first-touch and latest-touch campaign measurement, Google Analytics cookies after analytics opt-in, and cookieless Metricool analytics after opt-in. Vercel Web Analytics provides always-on cookieless operational measurement. See /cookies for the full list.

Optional website voice

When you choose Talk and start a voice session, your microphone audio, that session's transcript, and relevant public website context are sent to OpenAI to provide the conversation. Earlier typed chats are not automatically included. You can mute, end the session, or use Type.

Before voice starts, we ask you to agree to private text transcript storage. With your agreement, Om saves the voice captions in Upstash for Alex to review the conversation, improve the assistant, and understand your needs. These text transcripts are available only in our private session dashboard and expire no later than seven days from the start of the call, including calls whose closure is unresolved. Captions may be incomplete or inaccurate. Om does not save audio recordings. You can use Type instead without agreeing to voice transcript storage.

We separately keep limited usage and security records in Upstash: a hashed IP address, Om and OpenAI session identifiers, receipt identifiers, model name, hashes of agent instructions, timestamps, reserved and measured duration, session status, and closure reason. Captions remain available in your browser when you return to Type. A proposed inquiry or booking summary is submitted only after you review it and take the corresponding action. Voice transcripts are not copied to Notion or included in inquiry notification emails. To request access or early deletion, contact alex@omconcepts.net.

OpenAI's own data controls apply to its processing. Disabling session recording does not disable all provider abuse-monitoring retention. Please keep confidential or sensitive information out of the conversation. See OpenAI's data controls.

How we use information

We use the information above for the following purposes. The lawful basis under GDPR is listed for visitors in the EU, UK, and similar jurisdictions.

• Respond to inquiries and deliver requested content like guides. Basis: performance of a contract or pre-contract steps at your request.
• Maintain the security of the site, prevent abuse, and enforce rate limits. Basis: legitimate interests in keeping the service available and safe.
• Measure aggregate traffic and campaign performance. Google Analytics and Metricool rely on your analytics opt-in. Cookieless operational measurement relies on our legitimate interest in understanding site reliability and basic usage.
• Send transactional confirmations and, where you opt in, occasional nurture emails. Basis: consent.
• Operate agent demonstrations and keep auditable receipts of their outputs. Basis: performance of the service you requested and legitimate interests in provenance and accountability.
• Meet legal obligations such as tax, accounting, and responding to valid legal requests. Basis: legal obligation.

Service providers and sub-processors

We use a small set of vendors to run the site and to deliver work to clients. We do not sell your personal information to any third party, and we do not share it for cross-context behavioral advertising. We disclose data to these service providers only as necessary to operate our services, on their standard data processing terms. A current named list with data shared and country of processing is maintained at /sub-processors. The categories below cover vendors we use today and classes of vendor we may use as features expand.

• Analytics providers: aggregate traffic analytics and tag management to understand site usage, including Google Analytics and Metricool after analytics opt-in, plus Vercel's cookieless operational measurement.
• Email delivery providers: transactional and nurture email services that send confirmations, replies, and opt-in sequences on our behalf.
• Customer communication and SMS providers: platforms for lead follow-up, appointment reminders, and two-way messaging when a client opts in to SMS.
• Payment processors: services that handle card payments and payment method storage for any paid engagement, invoice, or future checkout flow.
• Accounting and bookkeeping integrations: platforms used for invoicing, client receivables, and financial record-keeping.
• CRM and marketing automation providers: systems used for lead intake, nurture, and customer records.
• Scheduling and calendar providers: tools for booking, availability, and meeting links.
• AI and language-model providers: model APIs used to power agent demonstrations and internal workflows. Inputs are minimized and sanitized receipts are stored.
• Hosting and cloud infrastructure: edge hosting, CDN, storage, and logging providers that serve the site and process request metadata.
• Automation and workflow platforms: integration glue used to route data between the systems above.
• Voice, video, and transcription: conferencing and meeting-transcription services used for discovery calls and client work, where participants are notified before recording.

Cookies

We use a minimal set of cookies. A dedicated cookies notice lives at /cookies. The short version:

• om_attribution_first and om_attribution_latest: first-party JSON snapshots for first-touch and latest-touch attribution. Each can include UTM values, the landing path, and a capture timestamp. 30-day expiry. SameSite=Lax.
• _ga: Google Analytics client identifier. First-party. 2-year expiry.
• _ga_*: Google Analytics session state. First-party. 2-year expiry.
• _gid: Google Analytics daily visitor identifier. First-party. 24-hour expiry.
• Google Analytics 4 and Metricool load only after analytics opt-in and only on the production site at omconcepts.net. Google Signals and Google Ads personalization are disabled. Advertising consent states remain denied. Metricool records visits without setting cookies.
• Vercel Web Analytics: always-on cookieless operational measurement. It does not store an identifier in your browser.

Data retention

We retain personal information only as long as necessary for the purposes described in this notice or to meet legal obligations. Approximate windows:

• Lead and guide submissions: retained while relevant to operating the business, reviewed periodically, and deleted on request.
• Other agent endpoint audit records: retained while useful for abuse monitoring and quality review, reviewed periodically, and deleted on request.
• Website voice text transcripts, with your agreement: up to seven days from the start of the call, independently of session closure.
• Website voice usage and security records in Upstash: expire seven days after closure or safe cancellation is recorded. Unresolved session records have no automatic expiration and remain while we verify closure or safe cancellation.
• Server and edge logs: short-term, typically no more than 30 days.
• Analytics data: up to 14 months.
• Transactional email delivery logs: short-term, per our email provider's defaults.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to certain uses. California residents have rights under the CCPA and CPRA, including the right to know, delete, correct, and opt out of “sale” or “sharing.” Residents of Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), and other US states with comprehensive privacy laws have substantially similar rights, and we extend the same process to any US visitor who requests it. Pennsylvania residents receive the same response path under this notice.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. To exercise a right, email alex@omconcepts.net. We respond within 30 days and will verify your identity before acting on requests about specific data. You can also complain to your local data protection authority.

SMS program

Om Concepts SMS is an opt-in program for conversational and transactional messages: replies to your inquiry, appointment confirmations and reminders, and quote or project status updates. You are only enrolled if you explicitly opt in by checking the unchecked SMS consent box on the concierge or consultation review, or on /contact and submitting the form with your phone number. Each opt-in is timestamped in our records.

Concierge and consultation reviews offer a separate optional email permission for this inquiry and requested services. Both email and text choices start unchecked. What you say to Om records a preference; only the choices you confirm when sending record permission. We retain those choices, their wording, version, source and time with your inquiry. Sending a brief does not enroll you in newsletters or broadcasts. Ask Alex at alex@omconcepts.net to stop inquiry follow-up emails.

Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out at any time, or reply HELP for help. You can also email alex@omconcepts.net to opt out without texting back. We do not share, sell, or rent your phone number or consent record to any third party for their marketing, and opting in never gives any third party permission to message you. The sharing described anywhere in this notice excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties. The full SMS Terms & Conditions, message types, frequency, carrier disclosures, and the automated-messaging disclosure are published at /sms.

AI-assisted processing

We may use AI-assisted tools to process inquiries, draft replies, triage leads, and generate internal summaries. Human review happens before any substantive reply is sent. If you would prefer your inquiry be handled without AI assistance, email alex@omconcepts.net and we will route it to a human-only workflow. AI-assisted outputs attached to a lead or published artifact are logged with a minimized audit record so the processing is auditable.

The concierge chat on this site runs on third-party AI model providers. Your messages are sent to those providers for processing, and a provider may use conversation content to improve its models under its own terms. Keep confidential details out of chat. The current provider list lives at /sub-processors.

Voice consultation

When you start a consultation, OpenAI processes audio, captions and the context needed to respond. Delegated Responses requests follow OpenAI API retention terms; this is not a zero-retention service. Om Concepts keeps unsent typed conversation and draft content in the current browser tab and active server requests. If you agree and start voice, voice captions are saved privately for Alex for up to seven days from the start of that call, as described above. Earlier typed messages and draft fields are not added to this saved voice transcript. Session limits and operational metadata are stored separately.

Only your explicitly approved brief, contact details and next-step preference are sent to our Notion inquiry records and Alex notification. We do not send the raw transcript with that inquiry. Approved payloads awaiting delivery are retained in a recovery outbox for up to seven days; non-content deduplication metadata lasts 30 days. Completed inquiry and notification records follow the retention periods described above. Contact alex@omconcepts.net for access or deletion requests. Booking and the contact form remain available without using the consultation.

International transfers

Om Concepts is based in the United States, and most of our named sub-processors store and process data in the US. Metricool, our website analytics vendor, operates from Spain in the European Union. If you access the site from outside the US, your information will be transferred to and processed in the US or the EU as described on our sub-processor list. For transfers from the EU, UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards offered by our sub-processors as the legal basis for transfer.

Children

This site and our services are directed at businesses and professionals. We do not knowingly collect information from children under 13 in the US, or under 16 in the EU and UK. If you believe we have collected information from a child, email alex@omconcepts.net and we will delete it.

Security

All site traffic is served over HTTPS. Admin access to every vendor platform we use is protected by multi-factor authentication with least-privilege roles. We do not write plaintext personal information into application logs. See /security for our full security posture and incident response commitments.

Changes to this notice

We update the “Last updated” date at the top of this page whenever this notice changes. For material changes that expand how we use your information, we will notify affected contacts by email or post a notice on the site for at least 30 days before the change takes effect.

Contact

Questions, requests, or concerns about this notice go to alex@omconcepts.net. Om Concepts is based in the Lehigh Valley, Pennsylvania. Written requests can be sent to the same email. A human will write back.

Questions about something else? Start a conversation.