How Osintial handles your information

01 At a glance

02 Who this policy covers

This policy covers three groups of people:

• Users: anyone with an Osintial account, including members of a team or organisation workspace.
• Visitors to osintial-ai.com, including people who join the early-access waitlist.
• People who appear in monitored content: authors of public posts, and people mentioned or shown in them. Section 11 is written for you.

Osintial is operated by OSINTIAL INC., a Delaware corporation, 850 New Burton Road, Dover, Delaware 19904, United States ("Osintial", "we", "us"). We are the controller of the personal information described here. Telegram, X, Meta, TikTok, Google, Apple and the other platforms mentioned in this policy have their own privacy policies, which govern your accounts with them.

03 Information we collect

3.1 Information you give us

• Account. Your email address, a password (we store only a salted hash, never the password itself), a username and, optionally, a display name. If you turn on two-factor authentication, either one-time codes are sent to your email or you use an authenticator app; the authenticator secret is stored encrypted.
• Phone number. If you sign in with Telegram or link a Telegram account, we store the phone number of that Telegram account. Telegram delivers the sign-in code to you; we do not send SMS ourselves.
• Sign in with Google or Apple. We receive a stable account identifier, your email address and, on first sign-in, your name. Apple may give us a private relay address instead of your real email; that is your choice in Apple's dialog.
• Waitlist. The email address you enter on osintial-ai.com and the browser you used.
• Billing. Payments are handled by Stripe. We keep your plan, the dates it renews or ends, and Stripe's customer and subscription identifiers. We never receive your full card number.
• Support. Whatever you include when you write to us.

3.2 Content you create in Osintial

• Subjects. The free-text description of what you want to monitor, the sources and scope you attach to it, any example posts you mark as good or bad matches, its display name and its notification settings.
• Reference images. You can attach one image from your photo library to a subject. It is stored with the subject and shown, together with each new image from your sources, to an AI vision model that answers a single question: do these two images look similar, show the same place, or appear to show the same person. This is a one-off visual comparison. We do not create, store or search facial-recognition templates or any other biometric identifier. You are responsible for having the right to use any image you upload. Reference images are deleted with the subject and are not included in data exports.
• Research agent. The questions you ask, the full conversation, the tool results the agent gathered, saved reports and standing questions. Conversations belong to your user account and are not visible to other users.
• Cases, watchlists and notes you keep in the app.
• Posts you publish. Text and media you compose to publish through a connected account. Drafts stay on your device until you send them.

3.3 Accounts you connect

You never have to connect an external account to use Osintial. When you do, this is what happens.

• Telegram account. Linking your phone number creates a Telegram session for your account on our servers, authorised by the code Telegram sends you. We use that session only to list your chats and channels so you can pick sources, to join public channels you select, to publish posts to channels you choose, and to deliver a sign-in code to your Telegram "Saved Messages" when you sign in on a new device. We do not use your account to monitor content, and we do not read or store your private conversations. The session appears in Telegram under Settings › Devices, where you can end it at any time; you can also disconnect it in Osintial Settings.
• Osintial Telegram bot. When you start the bot, we store the identifier of that chat so we can send alerts, the morning brief and agent replies there, and we read the messages you send to the bot.
• X, Facebook, Instagram, TikTok, WhatsApp. Connecting one of these through its authorisation flow gives us access credentials, which we store encrypted, along with the account's name or identifier. We use them only to publish what you ask us to publish and to read back the result (post identifiers and errors). Content you publish is subject to that platform's terms.

3.4 Information collected automatically

• Device and session. The app or browser generates a random device identifier. We store a hash of it, bound to your session, so a session token cannot be reused from another device. On the web the session token lives in an HttpOnly cookie; on mobile it lives in the device's secure storage. Web sessions expire after 7 days without use and after 180 days in any case.
• Push notifications. With your permission, the app registers an Expo push token and your platform (iOS or Android). Alerts travel through Expo's push service and Apple's or Google's notification service, so the notification text, which can include a short excerpt of the matched post, passes through those services.
• Logs. Our servers and hosting provider record the IP address, browser or app version, requested address and time of each request. We use these for rate limiting, abuse prevention and troubleshooting. We also keep a security log of sign-ins, password and two-factor changes, connected-account changes, account deletion and administrator actions, with the IP address and browser used.
• Usage metering. We count subjects, sources, agent runs and AI usage per account to enforce plan limits and manage our costs.
• Mobile app. The app sends its version, platform and update channel to Expo's update service to fetch over-the-air updates. The app contains no advertising identifier, no analytics SDK and no crash-reporting SDK, and it never asks for your location. Photo library access is requested only when you attach a reference image or publish media, and only the image you pick is uploaded. The "location" shown on some image alerts refers to where a monitored image was taken, derived from the image's own metadata or inferred by AI; it has nothing to do with your device.
• Cookies and local storage (web). We set a session cookie (HttpOnly), a small cookie that records whether the session is persistent, and a device-identifier cookie that lasts one year. The browser's local storage caches your recent alerts, subjects, translations and view preferences so pages load faster. All of these are strictly necessary; we use no advertising or analytics cookies. The web app loads fonts from Google Fonts, the Google Identity Services script for Sign in with Google, and map tiles from CARTO when you open a location map. Each of those providers receives your IP address in order to serve the request.

3.5 Public content we monitor

The service runs on content that is publicly available: posts, comments, images, video, transcribed live-stream audio, and profile details such as channel names, handles and profile pictures, from public Telegram channels and groups, public X, Facebook, Instagram and TikTok accounts, YouTube live streams and news feeds. Sources are chosen by our users or curated by us. We do not collect content that is not publicly accessible, and we do not collect private messages.

Each source is fetched once and shared across the service. Every new post is translated, transcribed or described where needed, compared against every enabled subject by an AI model, grouped into events, and, where it matches, shown only to the customer whose subject matched. This content can include personal information about people who are not Osintial users; section 11 explains their rights.

04 How we use it, and on what basis

We do not make decisions about you by automated means that have legal or similarly significant effects. Alerts are information for a human to review.

05 AI processing

Osintial is built on AI models run by third-party providers, which act as our processors. We describe them here by role; a current list of providers is available on request. This is what each role sees:

• Language and vision models: subject descriptions, monitored posts and images, your questions to the research agent and the conversation around them, reference images, and images sent for text extraction and object labels.
• Embedding and translation models: monitored content, and alert text you ask to have translated.
• Speech-to-text: the audio track of monitored videos and live streams.
• Web search: search queries derived from monitored content, for fact-checking and source credibility.
• Cloud vision services, where enabled: monitored images, for text detection and landmark recognition.

Some models also run on our own servers, including text embeddings and optical character recognition, and involve no third party. Under our agreements with them, the providers of the language, vision, embedding and translation models we use do not use this content to train their models. The other providers process it only to provide their service to us.

06 Who we share it with

Service providers that host or process data on our behalf, under contracts that limit what they may do with it:

Platforms you connect or publish to. When you link an account or publish a post, Telegram, X, Meta, TikTok or WhatsApp receives what is needed to do that, under their own privacy policies.

Your organisation. If your account was created for you by an organisation, that organisation's administrators can manage it and see the work in it.

Osintial staff. A small number of administrators can open a customer's account in a read-only mode to help with support and troubleshooting. Those views cannot change anything and are recorded in the security log.

Legal and safety. We disclose information when the law requires it, to respond to a valid legal process, or when necessary to protect the rights, safety or property of our users, the public or Osintial.

Business transfers. If Osintial is acquired or merges with another company, your information transfers with it. We will tell you before a different privacy policy applies.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

07 Where it is stored

Our database, cache and application servers are in the United States. The service that holds connected Telegram sessions runs in the Netherlands. Our service providers may process data in other countries where they operate.

If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of your personal information outside those areas rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, including the EU-US Data Privacy Framework where a provider is certified. If you are in Israel, transfers abroad are made in accordance with the Privacy Protection (Transfer of Data Abroad) Regulations. You can ask us for details of the safeguards in place.

08 How long we keep it

09 Security

All traffic is encrypted in transit. Passwords are stored as Argon2 hashes. Authenticator secrets and connected-account credentials are encrypted at rest. Sessions are bound to the device that created them and, on the web, held in HttpOnly cookies. Every request is checked against the account that owns the data, so one customer cannot see another's subjects, alerts, conversations or private chats. Sign-in and sensitive endpoints are rate-limited, and sensitive actions are written to a security log. Staff access is limited to what a task requires.

No system is perfectly secure. If you believe you have found a vulnerability or that your account has been accessed without permission, write to amitaym@osintial-ai.com.

10 Your rights and choices

In the app. Settings › Privacy lets you export everything associated with your account as a file and delete your account. Settings › Account lets you change your email, password and two-factor method. Connected accounts and alert channels can be disconnected in Settings. Notification and photo permissions are controlled in your device settings. Agent conversations can be deleted one by one.

Without the app. If you no longer have access to the app, you can request the deletion of your account and its data at osintial-ai.com/delete-account. That page also lists exactly what is deleted, what we keep and why, and how long it takes.

By email. For anything else, write to amitaym@osintial-ai.com. We will verify that the request comes from you and respond within one month, or sooner where the law requires it. We will not treat you differently for exercising your rights.

If you are in the EEA, the UK or Switzerland, you have the right to access your personal information, to have it corrected or erased, to restrict or object to its processing (including processing based on our legitimate interests), to receive it in a portable format, and to withdraw consent at any time without affecting what was done before. You can also complain to your data protection authority.

If you are in California, you have the right to know what personal information we collect and how we use and disclose it, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information to infer characteristics about you. We do not respond to "Do Not Track" signals because there is no agreed standard for them.

If you are in Israel, you have the right under the Protection of Privacy Law, 5741-1981 to review the information we hold about you and to ask us to correct or delete it.

If you live somewhere else, you may have similar rights under local law; email us and we will help.

11 People who appear in monitored content

If you publish on a public channel or account that one of our users monitors, or you are mentioned or shown in such a post, Osintial may hold a copy of that post. We process it on the basis described in section 4: our customers' legitimate interest in following public events for journalism, security and research, using only information you or someone else made public. We never contact people identified in monitored content, and we never use this content for marketing.

You can write to amitaym@osintial-ai.com to ask whether we hold content about you, to object to its processing, or to ask for it to be removed. We will act on a valid request unless a legal exemption applies, for example where the content is held for journalistic purposes, is needed for an ongoing safety matter, or is needed to establish or defend legal claims. You can also complain to your data protection authority.

12 Children

Osintial is a professional tool and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

13 Changes to this policy

When we change this policy we will publish the new version here with a new effective date. If a change materially affects how we use your personal information, we will also tell you in the app or by email before it takes effect.

Version history. v1.1 (16 September 2026): added the account-deletion page (osintial-ai.com/delete-account) and the 14-day grace period to sections 1, 8 and 10. v1.0 (15 September 2026): first published version.

14 Contact

Operator

OSINTIAL INC., a Delaware corporation

Address

850 New Burton Road, Dover, Delaware 19904, United States

Email

amitaym@osintial-ai.com

Website

osintial-ai.com