Privacy Policy

1. Who this is about and who controls it

This policy covers anyone who visits Onaxai or creates an account. The data controller is [Company Legal Name], [registered address] (“Onaxai,” “we,” “us”). For questions or requests about your data, see Contact below.

2. What we collect

Account information

• Your name and email address, and a password (stored as a one-way hash we cannot read, never in plain text).
• If you sign in with Google, the identifier and name Google gives us for that sign-in — we never see your Google password.
• If you turn on two-step sign-in, the secret your authenticator app uses, encrypted at rest.

What you send and what is made for you

• The messages you send in a chat, and the model’s replies.
• Files you upload, and images, audio or video a model generates for you — the files themselves, and details about them (size, type, which message or request they belong to).
• If you turn on memory, specific things a model learned about you from a chat, or that you wrote yourself, kept so later chats can use them. This is off by default, and you can see, edit, and delete everything it holds at any time, from Settings.
• The onboarding survey answers you give, if you answer it (it can be skipped).

Usage and billing

• How much of your allowance each reply or generation used, which model or media type it was, and when — kept as a history so you can see your own usage and so we can investigate billing questions, suspected fraud, or abuse.
• Payment history: what plan you are on, what you were charged and when, and your Stripe customer reference. Your card number and similar payment details are never sent to or stored by Onaxai — Stripe handles them directly, under its own privacy policy.

Technical information

• The devices you are signed in on: a browser/device label, the IP address used to sign in, and when it was last active, so you can see and end sessions you do not recognize.
• Standard server logs (IP address, time, the page or endpoint requested) kept briefly for debugging and security.

We do not collect more than this. In particular, we do not run advertising trackers, we do not buy data about you from data brokers, and we do not use your conversations to train our own models.

3. Why we use it, and on what basis

• To provide the service — running your chats, generating your media, keeping your account signed in. (Performance of our contract with you.)
• To bill you — processing payments and keeping the records a business is required to keep. (Contract, and legal obligation.)
• To keep Onaxai secure — detecting and responding to abuse, fraud, and security incidents. (Our legitimate interest, balanced against yours.)
• To support you — answering questions you send us about your account.
• To improve Onaxai — aggregated, non-identifying statistics about how features are used (for example, which models are popular). We do not read your individual chats for this.
• Where you have asked us to — memory across chats, which is off until you turn it on, and the onboarding survey, which you can skip.

4. Who we share it with

We do not sell your personal data. We share it only with the services that make Onaxai work, each acting on our instructions and bound to keep it confidential:

• A model-routing provider — routes the chat messages you send to the model you chose, and back.
• A media-generation provider — generates images, audio and video you ask for.
• Stripe — processes payments and holds your payment method and billing history on its own systems.
• Google — if you choose “Continue with Google,” to confirm who you are.
• Our hosting and storage providers — who run the servers Onaxai runs on and store the files you upload or that are generated for you.

Sending a message to a model necessarily sends its content to the lab that made that model (for example, Anthropic for a Claude model, OpenAI for a GPT model), through our model-routing provider. Each of those labs processes what you send under its own terms for API use, which generally do not permit using API traffic to train their models, but we encourage you to avoid putting anything you would not want a third party to see into a prompt either way.

We may also disclose data where the law requires it, to enforce our Terms of Service, or to protect the rights, property, or safety of Onaxai, our users, or others — and, if Onaxai is ever acquired or merges with another company, to that company, under the same obligations this policy describes.

5. International transfer

Our providers operate in multiple countries, so your data may be processed outside the country you live in, including in the United States. Where that requires a safeguard under the law where you live (for example, standard contractual clauses under the GDPR), we and our providers put one in place.

6. How long we keep it

While your account is open, we keep what this policy describes for as long as it is useful to you and to running the service. If you close your account, most of what you made is deleted right away; what billing and fraud prevention need stays, pseudonymously, for up to 2 years. The full detail is in our Data Deletion Policy, which this section defers to rather than repeat.

7. Your choices and rights

• Access and correction — your name and email are editable from Settings at any time. For a copy of other data we hold about you, write to us at the address below.
• Memory — turn it on or off, and view, edit or delete anything it has learned, from Settings.
• Devices — see every device signed in to your account, and sign any of them out, from Settings.
• Deletion — close your account from Settings at any time; see the Data Deletion Policy for what that does.
• Regional rights — if a law where you live gives you rights beyond these (for example, the GDPR’s rights to erasure, portability, or to object to processing, or the CCPA’s right to know and to opt out of a “sale” of data, which we do not do), write to us and we will handle your request under that law.

8. Security

We take reasonable technical and organizational measures to protect your data. See our Security Policy for the specifics. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

9. Cookies and similar technology

Onaxai itself does not use tracking cookies. Signing in uses a token kept in your browser’s local storage, not a cookie. See our Cookies Policy for the full detail, including the third-party cookies Stripe and Google may set when you use their pages or buttons.

10. Children

Onaxai is not directed at, and is not knowingly used by, anyone under 18 (or the age of majority where they live). If we learn an account belongs to someone younger, we will close it. If you believe a child has given us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the product changes. For a material change, we will tell you before it takes effect, the same way described in our Terms of Service.

12. Contact

Questions, requests, or concerns about your data: privacy@onaxai.xyz.