Privacy Policy

1. Who We Are

OnyorAI LLC (“OnyorAI,” “we,” “us,” or “our”) is a limited liability company incorporated in the State of Iowa, United States (EIN: 41-4695593), with its principal place of business at 3700 Grand Avenue, Des Moines, IA 50312, USA.

We operate onyorai.com and provide AI-powered document digitization and data extraction services. This Privacy Policy describes how we collect, use, store, protect, and share personal data when you use our website or services.

This policy applies to all visitors to onyorai.com, all registered account holders, and all clients who submit documents to us for processing. It covers both our role as a Data Controller (for your account and billing data) and our role as a Data Processor (for personal data contained in documents you submit for processing).

For details on our obligations as a Data Processor under the GDPR, please see our GDPR Compliance Statement and Data Processing Agreement.

2. Data We Collect and Why

2.1 Account and Contact Data

When you register an account or contact us, we collect:

• Identity data: First name, last name, company name
• Contact data: Email address, phone number, mailing address
• Account credentials: Hashed password (we never store plaintext passwords)
• Communications: Emails, support messages, and chat logs between you and our team

Legal basis (GDPR): Contract performance (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) in maintaining secure account records.

2.2 Payment and Transaction Data

When you place an order, we collect:

• Order details: plan selected, price paid, date, order reference number
• Billing address and VAT/tax number (where applicable)
• Payment method type (e.g., Visa, Mastercard) and last 4 digits — we never store full card numbers, CVV codes, or bank account details

All payment card data is processed exclusively by Stripe, Inc. (PCI DSS Level 1 certified) and is never transmitted to or stored on OnyorAI systems. Stripe’s privacy policy is available at stripe.com/privacy.

Legal basis (GDPR): Contract performance (Article 6(1)(b)); Legal obligation for tax records (Article 6(1)(c)).

2.3 Document Data (Submitted for Processing)

When you submit documents for processing, those documents may contain personal data about third parties (your customers, patients, employees, etc.). In this context, you are the Data Controller and OnyorAI is the Data Processor. We process document content exclusively to deliver your contracted output and for no other purpose.

What we do with your documents:

• Receive and temporarily store documents in encrypted form on our secure servers
• Apply AI extraction and human QA review to produce your structured output
• Deliver the output to you via our secure portal, email, or integration
• Permanently delete all source documents within 72 hours of delivery
• Delete processed output files from our portal 30 days after delivery

We never use your documents for AI model training, benchmarking, product improvement, or any purpose other than delivering your order. We never share document content with any third party except our vetted sub-processors strictly necessary for delivery (listed in Section 5).

Legal basis (GDPR): Contract performance (Article 6(1)(b)). For special category data (health, biometric, etc.), explicit consent from the Controller pursuant to Article 9(2)(a).

2.4 Website Usage Data

When you browse onyorai.com, we automatically collect certain technical data:

• Log data: IP address (anonymized), browser type and version, operating system, referring URL, pages visited, time and date of visit, time spent on pages
• Analytics data: Aggregated, anonymized visitor behavior via Google Analytics (IP anonymization enabled — Google does not receive full IP addresses)
• Cookie data: As described in our Cookie Policy

Legal basis (GDPR): Legitimate interests (Article 6(1)(f)) for security and basic analytics; Consent (Article 6(1)(a)) for non-essential cookies.

2.5 Data We Do Not Collect

We do not collect or process:

• Social media profile data or social login credentials
• Location data beyond country/region for pricing and tax purposes
• Biometric or facial recognition data
• Data from children under 18 (our services are for businesses and adult individuals only)
• Any data for advertising profiling or sale to third parties

3. How We Use Your Data

We use your personal data only for the following purposes:

• Service delivery: Processing your document orders and delivering structured output
• Account management: Creating and maintaining your account, verifying your identity, and managing authentication
• Billing and payments: Processing charges, issuing invoices, managing subscriptions, and handling refunds
• Customer support: Responding to your inquiries, resolving issues, and improving service quality
• Legal compliance: Meeting our tax, accounting, anti-money laundering, and other legal obligations
• Security and fraud prevention: Monitoring for unauthorized access, fraudulent transactions, and abuse of our systems
• Service communications: Sending transactional emails such as order confirmations, delivery notifications, and receipts
• Marketing communications (with consent): Sending newsletters or product updates only if you have opted in — you can unsubscribe at any time
• Website improvement: Using anonymized analytics to understand how visitors use our site and improve its performance

We do not use your data for automated decision-making or profiling with legal or similarly significant effects on you.

4. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy. Our retention schedule is:

Data Category	Retention Period	Reason
Source documents uploaded for processing	Deleted within 72 hours of delivery	Minimum necessary for service
Processed output files (client portal)	30 days from delivery, then permanently deleted	Client download window
Client account data (name, email, etc.)	Duration of active account + 3 years after closure	Contract, legal compliance
Payment and invoice records	7 years from transaction date	Iowa tax law, legal obligation
Support correspondence	3 years from last interaction	Legitimate interest (disputes)
Website access logs	90 days (anonymized after 30 days)	Security monitoring
Marketing opt-in records	Until consent withdrawn + 1 year	Consent audit trail

Upon account deletion, we will erase all personal data within 30 days, except data we are legally required to retain (such as payment records for tax purposes) or data that is necessary to resolve open disputes.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data to any third party. We share data only with the following categories of recipients and only to the extent necessary:

5.1 Sub-Processors (Service Delivery)

Provider	Country	Purpose	Data Shared
OpenAI, L.P.	USA	AI document extraction via API (zero retention; no training on client data)	Document content for processing only
Amazon Web Services	USA/EU	Encrypted cloud hosting and storage	Encrypted files; no plaintext access
Stripe, Inc.	USA/EU	Payment processing	Billing name, email, payment method
Google LLC	USA	Analytics (anonymized) and Fonts CDN	Anonymized page view data; no document data

All sub-processors are bound by data processing agreements with confidentiality and security obligations at least equivalent to those in this policy.

5.2 Legal and Regulatory Disclosures

We may disclose personal data to law enforcement, courts, regulators, or other authorities where we are legally required to do so by a valid court order, subpoena, or binding legal obligation. We will notify you of such requests where permitted by law.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of OnyorAI’s assets, your personal data may be transferred to the acquiring entity. We will notify you at least 30 days before any such transfer and you will have the opportunity to request deletion of your data before the transfer takes effect.

6. Your Rights

Depending on your location, you have the following rights regarding your personal data:

6.1 Rights for EU / EEA / UK Residents (GDPR & UK GDPR)

• Right of Access (Art. 15): Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data where no longer necessary or where you withdraw consent
• Right to Restriction (Art. 18): Request that we limit processing of your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a machine-readable format to transfer to another provider
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing at any time
• Right to withdraw consent: Withdraw any consent-based processing at any time without affecting prior lawful processing

To exercise any of these rights, email contact@onyorai.com with subject “Data Rights Request.” We will respond within 30 calendar days (extendable to 90 days for complex requests, with notice). We will verify your identity before acting on any request.

6.2 Rights for California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, our business purpose, and the categories of third parties we share it with
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale/Sharing: OnyorAI does not sell or share personal information for cross-context behavioral advertising. No opt-out is required.
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: Request that we limit our use of sensitive personal information to service delivery purposes only
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To submit a CCPA request, email contact@onyorai.com with subject “CCPA Privacy Request.” We will respond within 45 days (extendable to 90 days with notice). You may designate an authorized agent to make requests on your behalf by providing written authorization.

CCPA Disclosure — Personal Information Sold or Disclosed for Business Purposes (last 12 months): OnyorAI has not sold any personal information. We have disclosed personal information to sub-processors (listed in Section 5) for business purposes (service delivery) only.

7. International Data Transfers

OnyorAI is based in the United States. If you are located in the EU, EEA, or UK, your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

We safeguard these transfers using:

• EU Standard Contractual Clauses (SCCs): The 2021 European Commission SCCs (Module 2: Controller to Processor) for EU/EEA to US transfers
• UK International Data Transfer Addendum (IDTA): ICO version B.1.0 for UK to US transfers
• Transfer Impact Assessments (TIAs): We assess the legal environment and supplement SCCs with appropriate technical measures

To receive a copy of the applicable SCCs or IDTA, email contact@onyorai.com with subject “SCCs Request.”

8. Data Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction:

• Encryption at rest: AES-256 for all stored documents and account data
• Encryption in transit: TLS 1.3 for all data transmitted between your browser, our servers, and our sub-processors
• Access controls: Role-based access control (RBAC); only authorized personnel can access client data; multi-factor authentication (MFA) required for all staff
• Automatic deletion: Source documents deleted within 72 hours of delivery; no backup copies retained beyond the deletion schedule
• Auditing: All access to client data is logged and reviewed regularly
• Staff training: All employees complete mandatory data protection training and sign confidentiality agreements
• Vendor security: All sub-processors are vetted for security compliance before engagement

Despite these measures, no internet transmission or electronic storage is completely secure. In the event of a data breach that affects your personal data, we will notify you without undue delay and within 72 hours as required by applicable law.

9. CCPA — California Privacy Notice

This section supplements the rest of this Privacy Policy for California residents and is provided in compliance with the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) as amended by the CPRA.

Categories of personal information collected in the past 12 months:

CCPA Category	Examples Collected	Source	Business Purpose
Identifiers	Name, email, IP address, account ID	You directly; automatically	Account management, security
Commercial information	Order history, plan type, payment records	You directly	Billing, service delivery
Internet activity	Pages visited, browser type (anonymized)	Automatically	Analytics, security
Professional information	Company name, job title (if provided)	You directly	Account management
Sensitive personal information	Payment card last 4 digits (held by Stripe)	You directly via Stripe	Payment processing only

OnyorAI does not use sensitive personal information for any purpose other than providing the requested services. For CCPA rights requests, see Section 6.2.

10. Children’s Privacy

Our services are directed exclusively to businesses and adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at contact@onyorai.com and we will promptly delete that data.

Our services are not designed for or marketed to children. We do not knowingly engage in any transaction with a person under 18 years of age.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on this page with a revised “Last updated” date
• Notify registered users by email at least 14 days before the changes take effect
• Where required by law, obtain your renewed consent before processing your data under the updated policy

Your continued use of our services after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree to the updated policy, you must stop using our services and may request deletion of your data.

This Privacy Policy was last updated on March 1, 2026. Previous versions are available upon request.

12. Contact Us & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Complaints to a Supervisory Authority

If you are located in the EU or EEA and are not satisfied with our response to your privacy request, you have the right to lodge a complaint with your local Data Protection Authority. A full list of EU DPAs is available at edpb.europa.eu. UK residents may contact the Information Commissioner’s Office (ICO) at ico.org.uk. We encourage you to contact us first — we are committed to resolving all privacy concerns promptly and fairly.