Privacy Policy

onneta. is operated by Onneta Inc, a Delaware corporation (the "Company", "we", "us"). We are the controller of the personal data described in this policy.

This policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have. It covers the website at onneta.com, our web and mobile apps, and projects hosted on onneta.app and actl.app and connected custom domains.

Contact: [email protected].

We collect only what we need to run the Service.

Account information

• Your name, email address, and/or phone number.
• Your sign-in method and identifiers from Google or Apple if you use social sign-in (we receive your verified email and name — we do not receive your Google/Apple password).
• A hashed password if you sign up with a password (we never store your password in plain text).
• Passkey (WebAuthn) public-key credentials if you set one up.
• Your chosen @handle, display name, preferred language, and currency.

Project content

• The prompts and instructions you give the AI, the content, data, and code of your projects, and files or images you upload as attachments (up to a per-file size limit). Images may be sent to the AI for it to "see" them.

Payment and wallet data

• Your wallet balance and transaction history, top-ups, deductions, and invoices.
• A payment-processor customer identifier (Stripe) and limited card metadata such as the card fingerprint and brand, used to run payments and detect abuse. We do not store your full card number — card details are handled by our payment processor.
• Wallet top-up records.

Usage, AI-cost, and technical data

• How you use the Service, including AI edits, builds, publishes, and the number of AI tokens consumed and their cost (used to charge your wallet and to operate and improve the Service).
• Device and connection data such as IP address, browser/app type, and timestamps, used for security, anti-abuse, fraud prevention, and diagnostics.
• Log and diagnostic data, including crash and error logs.

Push-notification subscriptions

• If you enable notifications, we store your device's push subscription (endpoint and keys) so we can send you notifications. You can turn this off in your device or browser.

Referral data

• We used to record who referred you when you signed up through a referral link. We have stopped recording this; previously recorded entries are retained for our records only and are not used to grant any bonus.

We do not intentionally collect special-category data (such as health, religion, or precise GPS location), and we ask you not to put such data into projects unless you have a lawful basis to do so.

We use your data to:

• Provide, operate, host, and maintain the Service and your projects.
• Run the AI that builds and edits your projects.
• Process payments, manage your wallet, apply credits, and send invoices.
• Communicate with you about your account, transactions, security, and support.
• Secure the Service and prevent fraud and abuse (including detecting duplicate accounts and payment-card abuse).
• Analyze and improve performance, features, and the user experience.
• Comply with legal, accounting, and regulatory obligations.

Where the law requires a legal basis, we rely on: performing our contract with you (to provide the Service and process payments), our legitimate interests (to secure and improve the Service and prevent abuse), your consent (for example, push notifications and non-essential cookies), and compliance with legal obligations.

To build and edit your projects, we send your prompts, relevant project content, and uploaded attachments to our specialized AI provider. This is necessary to provide the core function of the Service. We use the AI provider to process this content on our behalf, subject to their terms and security commitments.

We do not sell your personal data. We share it only with service providers who help us run the Service, under contracts that require them to protect it and use it only for us:

If all columns are not visible, scroll the table horizontally. You can also focus it and use the arrow keys.

We may also disclose data if required by law, to protect our rights, users, or the public, or in connection with a corporate transaction (with continued protection of your data). The current list of providers may change; we will keep this section up to date.

Our servers and some providers are located outside your country (for example, in the EU/EEA and the US). When we transfer your data internationally, we take steps to ensure it remains protected in line with this policy and applicable law.

• Account and project data: for as long as your account is active. When you delete a project or your account, we delete or anonymize the associated data within a reasonable period, except for limited backups that expire on a rolling basis.
• Billing and transaction records: kept as long as required for accounting, tax, and legal purposes.
• Security and log data: kept for a limited period for anti-abuse and diagnostics.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (you can edit most profile data in-app).
• Delete your account and personal data ("right to be forgotten"), subject to data we must keep by law.
• Export / port your project content.
• Object to or restrict certain processing, and withdraw consent (for example, turn off push notifications).

To exercise any of these, contact [email protected]. You can also delete your account from within the app; see Section 10 for the deletion request route required by the app stores. If you believe we have mishandled your data, you may contact us and, where available, your local data-protection authority.

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand and improve how the Service is used. Essential cookies are required for the Service to work; you can control non-essential cookies through your browser or, where offered, an in-app control.

You can delete your account and its data at any time from within the app, or by emailing [email protected] with the subject "Delete my account". We will process deletion within a reasonable time, keeping only what we are legally required to retain (such as billing records). This is the account-deletion route referenced in our Google Play and Apple App Store listings.

The Service is for users 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

We use reasonable technical and organizational measures to protect your data, including encryption in transit, hashed passwords, isolated per-project build environments, and access controls. No system is perfectly secure, but we work to protect your data and to respond to incidents.

We may update this policy from time to time. If we make material changes, we will provide reasonable notice (in-app or by email). The "Last updated" date at the top shows the current version.