ONYX

Privacy Policy

Effective July 20, 2026

1. Data We Collect

To provide our premium intelligence platform, we collect the following information:

  • Account Data: Email address, display name, and hashed credentials managed via our secure authentication provider (Supabase).
  • Product Data: Content you create within the platform, including watchlists, pinned assets, portfolios, strategies, AI chat threads, and uploaded files.
  • Billing Data: Processed securely via Stripe. We do not store or ever see your full credit card numbers.
  • Technical Data: Standard technical logs (IP addresses, user agent strings, request metadata) strictly necessary to run, debug, and secure the service.
  • Cookies: Essential session cookies for authentication. Please see our Cookie Policy for details.

2. How We Use Your Data

We use your data solely for operating the product, personalizing your workspace, processing subscriptions, preventing abuse, and improving platform reliability.

AI Features: When you use our AI research assistant, the specific queries you submit (and relevant active workspace context) are sent to our model providers (e.g., Google, Groq) to generate responses. We do not allow these providers to use your personal data to train their models.

3. Third-Party Processors

We rely on the following third-party infrastructure providers, each used under its standard terms and data-processing agreement:

  • Supabase: Database hosting and secure authentication.
  • Cloudflare: Edge hosting, CDN, and security routing.
  • Stripe: Payment processing.
  • Alpaca & Partners: Market data quotes and authorized account connectivity.
  • Google & Groq: Generative AI model inferences.

4. Brokerage Connections

If you choose to connect a live brokerage account, we store the OAuth tokens required to act on your instructions. These tokens are encrypted at rest. We never store your brokerage username or password. You may revoke this connection at any time in your Settings or directly with your broker.

5. Your Data Rights (GDPR & CCPA)

We respect your privacy globally. Depending on your jurisdiction (such as the EU under GDPR, or California under CCPA/CPRA), you have the right to:

GDPR Rights:

  • Right to Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate data.
  • Right to Erasure (Right to be Forgotten): Request deletion of your account and associated personal data.
  • Right to Restriction: Request that we restrict the processing of your personal data.

CCPA/CPRA Rights:

  • Right to Know: Request details about the categories and specific pieces of personal data we have collected about you.
  • Right to Delete: Request the deletion of personal information we have collected from you.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Do Not Sell or Share My Personal Information: We do not sell your personal information to data brokers or advertisers, nor do we share it for cross-context behavioral advertising.

To exercise any of these rights, email us at the address below.

6. Retention and Deletion

We retain your data while your account remains active. If you delete your account in your Settings (or request deletion via email), we will hard-delete your personal data within 30 days, excepting only the minimal records we are legally required to retain for tax, billing, or security auditing purposes.

7. Security

All data is encrypted in transit using industry-standard TLS. Sensitive secrets, including broker OAuth tokens, are encrypted at rest with AES-256-GCM (authenticated encryption) before they are written to storage. While we take extreme measures to secure your data, no system is perfectly secure. Please report any security concerns immediately.

8. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact our privacy team: onyxintelligenceai@gmail.com