Privacy Policy

Last updated: August 2026

1. Data Controller

OCENOX LTD
82 The Circle, Manly
Whangaparāoa, 0930, New Zealand
Email: webmaster@ocenox.com

ONOXIA is a SaaS product of OCENOX LTD. This privacy policy explains how we process personal data on the platform onoxia.nz and through the ONOXIA chat widget.

2. Applicable Data Protection Law

For visitors and customers from the EU/EEA, the provisions of the General Data Protection Regulation (GDPR) apply. For all others, the provisions of the New Zealand Privacy Act 2020 apply.

3. Cookies

ONOXIA uses no tracking, advertising, or analytics cookies. There is no Google Analytics and no cookie consent banner, as no consent-required cookies are set.

The chat widget (embedded on customer websites) sets no cookies. It exclusively uses sessionStorage in the visitor's browser to temporarily store the current chat session (session ID and message history). sessionStorage is scoped to the individual browser tab: the data is not transmitted to our or any other servers, is not accessible to other tabs or websites, and is automatically deleted when the tab is closed. Unlike cookies, sessionStorage data is not sent with HTTP requests.

The dashboard (onoxia.nz/app) sets the following technically necessary cookies for logged-in customers:

Cookie	Purpose	Duration	Type
onoxia_session	Session management for login	Session (2 hrs)	Strictly necessary
XSRF-TOKEN	CSRF protection against form attacks	Session (2 hrs)	Strictly necessary

These cookies are permitted without consent under Art. 6(1)(f) GDPR, as they are strictly necessary for the operation of the service.

The language preference on the landing page is stored using localStorage. This data does not leave the browser and is not transmitted to our servers.

4. Data Collected When Using the Website

4.1 Server Log Files

When visiting our website, the web server automatically stores information in server log files:

• Anonymised IP address (hashed, non-reversible)
• Date and time of the request
• Requested URL
• Referrer URL
• Browser and operating system used

IP anonymisation: IP addresses are anonymised using cryptographic hashing before storage. Reversal to the original IP address is not possible.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security and operation of the website).

4.2 Contact via Email

If you contact us by email, your details will be stored for the purpose of processing the enquiry and in case of follow-up questions. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).

5. Data Collected During Registration (SaaS Platform)

When registering as a customer on onoxia.nz, we collect:

• Company name and contact person
• Email address
• Billing address
• Payment information (processed by Stripe and/or Xero, not stored on our servers)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

5.1 Payment Processing

Depending on your region and currency, we use different payment service providers:

• Stripe (Stripe, Inc., USA) — Credit card, Apple Pay, Google Pay for EUR and NZD customers. Credit card data is processed exclusively by Stripe and is never stored on our servers.
• GoCardless (GoCardless Ltd, London, UK) — SEPA Direct Debit for EUR customers.
• Xero (Xero Limited, New Zealand) — Invoicing for EUR and NZD customers.
• Paddle (Paddle.com Market Ltd, London, UK) — Payment processing for all other currencies (USD etc.). Paddle acts as Merchant of Record and is the contractual partner for payment processing. Paddle collects and processes payment data in its own right. The Paddle Privacy Policy and Paddle Terms of Use apply additionally. For questions about Paddle payments, please contact Paddle Buyer Support.

6. Data in the Chat Widget

The ONOXIA chat widget is embedded by our customers on their websites. When end users interact with the widget, the following data is processed:

6.1 Data Collected

• Chat messages: Text messages sent by the end user to the bot
• Session ID: A randomly generated ID to associate the chat session (no cross-session tracking)
• IP address: Immediately anonymised via cryptographic hashing; the original IP is not stored
• Browser information: User agent string for technical compatibility
• Contact details: Name, email address, phone number or company — only if the end user provides them in the chat, for example to request a callback or an appointment
• Voice recordings: Only when the voice input feature is used. The recording is transmitted for conversion into text and is not stored afterwards.
• Email content: Only if the website operator has enabled the email channel. The bot then processes incoming emails including attachments in order to answer them.

6.2 Data Not Collected

• No cookies
• No fingerprinting
• No cross-session tracking
• No location data

6.3 AI Processing

Chat messages are transmitted to AI interfaces for generating responses. Depending on configuration and language pair, the following providers may be used:

• Mistral AI (Mistral AI SAS, Paris, France) — processing within the EU.
• OVHcloud (OVH SAS, Roubaix, France) — processing within the EU.
• OpenRouter (OpenRouter, Inc., USA) — AI model router for models such as Qwen and Gemini. Used exclusively with endpoints that do not retain data (zero data retention); if a model is not available there, processing falls back to an EU provider.

With all of the above providers, the transmitted data is used solely to generate the response. It is not retained by them and is not used to train AI models.

The AI provider is selected automatically based on the configured language and model. The website operator can view the model selection in the dashboard.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of our customers in automated customer service).

6.4 Data Processing Agreement

OCENOX LTD acts as a data processor on behalf of the customers (website operators) who deploy the ONOXIA widget. The website operators are the data controllers for the processing of end-user data.

6.5 Disclosure to the Website Operator

The website operator can view the chat histories of their own website. In addition, the following data may be disclosed:

• Contact requests: Contact details provided in the chat are made available to the website operator and may be transmitted to third-party systems configured by them, such as a CRM.
• Live chat: The conversation may be handed over to a human agent of the website operator, who can view the conversation so far.
• Appointment booking: If the end user uses the booking feature, they are forwarded to Calendly (Calendly LLC, USA), where Calendly's privacy policy applies.

The respective website operator is responsible for this processing.

7. Server Location and Data Transfers

Our servers are located in Finland (EU). AI processing is carried out by Mistral AI and OVHcloud in France (EU).

Data transfers outside the EU/EEA:

• Stripe (USA) — Billing data for credit card payments. Safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses).
• OpenRouter (USA) — Chat messages for AI processing, where a non-European model is configured. Only via endpoints that do not retain data (zero data retention). Safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses).
• Calendly (USA) — Only when the appointment booking feature in the widget is used. Safeguards pursuant to Art. 46 GDPR (EU Standard Contractual Clauses).
• Paddle (UK) — Payment data for non-EUR/NZD customers. The United Kingdom benefits from an EU adequacy decision.
• GoCardless (UK) — SEPA Direct Debit data. EU adequacy decision.
• Xero (New Zealand) — Billing data. New Zealand benefits from an EU adequacy decision.
• Kie.ai (USA) — Avatar image generation. Only text prompts are transmitted; no personal data is involved.

8. Data Retention

Data Type	Retention Period
Chat messages	Configurable per plan (default: 90 days)
Session data	Configurable per plan (default: 90 days)
Server log files	14 days
Customer account data	Duration of business relationship + statutory retention periods
Billing data	7 years (statutory retention requirement)

Automatic deletion of expired data is performed daily by our system.

9. Your Rights (GDPR)

As a data subject, you have the following rights:

• Access (Art. 15 GDPR) — Information about what data we hold about you
• Rectification (Art. 16 GDPR) — Correction of inaccurate data
• Erasure (Art. 17 GDPR) — Deletion of your data
• Restriction (Art. 18 GDPR) — Restriction of processing
• Data portability (Art. 20 GDPR) — Receive your data in a machine-readable format
• Objection (Art. 21 GDPR) — Object to processing

To exercise your rights, please contact us at webmaster@ocenox.com.

You also have the right to lodge a complaint with a supervisory authority.

10. Third-Party Services

Service	Provider	Purpose	Location
Mistral AI	Mistral AI SAS, Paris	AI chatbot responses	France (EU)
OVHcloud	OVH SAS, Roubaix	AI chatbot responses, content vectorisation	France (EU)
OpenRouter	OpenRouter, Inc.	AI model routing (Qwen, Gemini etc.), no data retention	USA (EU-SCC)
Calendly	Calendly LLC	Appointment booking in the chat widget	USA (EU-SCC)
Kie.ai	Kie AI, Inc.	Avatar image generation	USA
Stripe	Stripe, Inc.	Credit card payments (EUR, NZD)	USA (EU-SCC)
GoCardless	GoCardless Ltd	SEPA Direct Debit (EUR)	UK (adequacy decision)
Paddle	Paddle.com Market Ltd	Payment processing (Merchant of Record, USD etc.)	UK (adequacy decision)
Xero	Xero Limited	Invoicing (EUR, NZD)	New Zealand (adequacy decision)
Bunny Fonts	BunnyWay d.o.o.	Font (Montserrat)	Slovenia (EU)

11. Changes

We reserve the right to update this privacy policy to reflect changes in the law or modifications to our service. The current version is always available on this page.