Privacy Policy

Please read this Privacy Policy carefully to understand how we handle your personal data and the rights available to you!

ONIXCREATOR is operated by AndAnd Operations OÜ, registry code 16445425, VAT number EE102489723, with its registered address at Narva mnt 7-634, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia («ONIXCREATOR», «We», «Us» or «Our»).

By accessing or using the ONIXCREATOR website (the «Website») and the web-based services, tools, features and functionality made available through the Website (collectively, the «Service» or «ONIXCREATOR»), You («You», «User» or «Your») acknowledge that You have read and understood this Privacy Policy.

This Privacy Policy describes how We collect, use, store, disclose and otherwise process Personal Data when You visit the Website, purchase a subscription to or use the Service, contact Us, or otherwise interact with Us in connection with the Website or the Service. It also explains the choices and rights available to You regarding Our processing of Your Personal Data and how You may exercise those rights.

We respect Your privacy and take the protection of Your Personal Data seriously. This Privacy Policy should be read together with Our Terms of Service.

We assume that all Users have carefully read this Privacy Policy. If You do not agree with the processing practices described in this Privacy Policy, You should refrain from using the Website and the Service.

1. General Information

1.1. This Policy applies to the following people:

1.1.1. people who use the Website and/or the Service in any available way;

1.1.2. contact Us or otherwise communicate with Us in connection with the Website or the Service.

1.2. We do not sell Your Personal Data to third parties. A «sale» of Personal Data is defined broadly to include selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating Personal Data of a Consumer to another business or third party for monetary or other valuable consideration. We may disclose or transfer Your Personal Data in connection with a merger, acquisition, reorganization, bankruptcy, sale of some or all of Our assets, or another similar business transaction. Any party that acquires Our business or assets may continue to process Your Personal Data in accordance with this Privacy Policy and applicable law. If the acquiring party intends to use or disclose Your Personal Data in a manner materially inconsistent with this Privacy Policy, We will provide prior notice as required by applicable law.

2. Terms and Definitions

2.1. The following terms shall have the following meanings:

2.1.1. «Service» — the ONIXCREATOR website and all web-based services, tools, features and functionality offered by ONIXCREATOR through the website, as well as any other related services that ONIXCREATOR may introduce in the future.

2.1.2. «Personal Data» — data relating to a living individual who can be identified from such data or from such data together with other information in Our possession or likely to come into Our possession.

2.1.3. «Usage Data» — data collected automatically, either generated through the use of the Service or obtained from the Service infrastructure itself, for example, the duration of a page visit.

2.1.4. «Cookies» — small files, usually consisting of letters and numbers, that are downloaded to and stored on Your device when You visit a website. Cookies allow a website to recognise a User’s device.

2.1.5. «Data Controller» — a natural or legal person who, either alone or jointly with other persons, determines the purposes for which and the manner in which Personal Data is processed.

2.1.6. «Data Processors» or «Service Providers» — natural or legal persons who process Personal Data on behalf of the Data Controller. We may use the services of various Service Providers to process Your Personal Data more effectively.

2.1.7. «User» — an individual using Our Service. The User corresponds to the Data Subject whose Personal Data is processed.

3. Data Controller

AndAnd Operations OÜ, a company registered in Estonia under registry code 16445425, VAT number EE102489723, with its registered address at Narva mnt 7-634, Kesklinna linnaosa, Tallinn, Harju maakond, 10117, Estonia, is the Data Controller responsible for the Personal Data collected and processed within the scope of this Privacy Policy.

AndAnd Operations OÜ determines the purposes and means of processing Your Personal Data in connection with the Website and the Service.

If You have any questions regarding the processing of Your Personal Data, You may contact Us via email at support@onixcreator.com.

4. Principles of Data Processing

4.1. We adhere to the following principles when processing Your Personal Data:

4.1.1. the principle of lawfulness, fairness and transparency: We process Personal Data lawfully, fairly and transparently in relation to the Data Subject;

4.1.2. the principle of purpose limitation: We collect Personal Data for specified, explicit and legitimate purposes and do not further process it in a manner that is incompatible with those purposes;

4.1.3. the principle of data minimisation: We collect Personal Data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;

4.1.4. the principle of accuracy: We take reasonable steps to ensure that Personal Data is accurate and, where necessary, kept up to date. Inaccurate Personal Data is corrected or deleted without undue delay;

4.1.5. the principle of storage limitation: We retain Personal Data in a form that permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data is processed;

4.1.6. the principle of integrity and confidentiality: We process Personal Data in a manner that ensures its appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through the use of appropriate technical and organisational measures; and

4.1.7. the principle of accountability: We are responsible for complying with the principles described above and for maintaining appropriate measures and documentation to demonstrate such compliance.

5. Personal Data That We Collect and Process

5.1. To provide the Website and the Service, manage access to the Service, administer usage limits, process subscriptions and respond to Your requests, We may collect and process the following Personal Data:

5.1.1. Your email address;

5.1.2. information relating to Your access to the Service, including Your access status, login request information and single-use login links;

5.1.3. where You purchase a paid subscription, Your name, email address, billing address, subscription status, Stripe customer identifier and Stripe subscription identifier; and

5.1.4. information relating to Your export activity, including Your email address, the format of the exported file, the number of products included in the export and the date and time of the export;

5.1.5. information contained in emails, support requests or other communications sent by You to Us.

5.2. We may collect Personal Data from You in various ways and circumstances, including when You request access to or use the Service, purchase or manage a subscription, contact Us for support, or otherwise communicate with Us in connection with the Website or the Service.

5.3. ONIXCREATOR is an invite-only Service. We process Your email address to verify that You are authorised to access the Service and to send You a single-use login link. ONIXCREATOR does not use passwords. Single-use login links are sent through Resend from noreply@onixcreator.com and expire after 15 minutes.

5.4. If You purchase a paid subscription, payment and subscription processing is carried out through Stripe. Payment card details are entered directly on Stripe’s hosted payment page. We do not receive, process or store Your full payment card number or card verification code.

5.5. We may collect Personal Data directly from You when You request access to or use the Service, purchase or manage a subscription, contact Us for support, or otherwise communicate with Us in connection with the Website or the Service. We may also receive limited subscription and payment-related information from Stripe, as described in this Privacy Policy.

5.6. We do not use Your email address for direct marketing purposes.

6. Personal Data Collected in an Automatic Way

6.1. We may automatically collect limited technical and Usage Data about the devices used to access and interact with the Website and the Service.

6.2. Personal Data automatically collected by or transmitted to Us in the course of accessing or using the Website or the Service may include Your IP address, browser and device information, operating system information, session information, server logs, error and diagnostic information, pseudonymous identifiers, and information about certain interactions with the Website or the Service.

6.3. We process such information to provide and maintain the Website and the Service, ensure their proper and secure operation, maintain user sessions, identify and resolve technical issues, prevent unauthorised access or misuse, and improve the functionality and performance of the Service.

6.4. We and Our Service Providers may also use Cookies and similar technologies to collect information when You interact with the Website or the Service. Strictly necessary technologies are used to operate and secure the Service and remember Your preferences. Where You have provided the relevant consent, We may also collect limited analytics information through Amplitude.

6.5. The information collected automatically through analytics technologies does not include book metadata, the contents of uploaded files or Your email address. Book metadata and uploaded files are processed locally within Your browser session and are not transmitted to or stored on Our servers.

6.6. Further information about the Cookies and similar technologies We use, the information collected through them and how You may manage Your preferences is provided in Section 7 of this Privacy Policy.

8. Lawful Basis of Data Processing

8.1. Under Article 6 of the GDPR, We Process Personal Data only where We have a lawful basis for doing so. The lawful bases on which We rely include:

8.1.1. performance of a contract (Article 6(1)(b) GDPR) — We Process Personal Data where necessary to provide access to the Service, manage subscriptions, process related requests and perform Our obligations under the Terms of Service;

8.1.2. Consent (Article 6(1)(a) GDPR) — We Process Personal Data based on Your Consent where required, including through optional analytics. You may withdraw Your Consent at any time;

8.1.3. legitimate interests (Article 6(1)(f) GDPR) — We Process Personal Data where necessary for Our legitimate interests in operating, maintaining and securing the Website and the Service, preventing unauthorised access, resolving technical issues, responding to Your inquiries and protecting Our legal rights, provided that such interests are not overridden by Your rights and freedoms; and

8.1.4. legal obligation (Article 6(1)(c) GDPR) — We Process Personal Data where necessary to comply with applicable accounting, tax and other legal obligations or to respond to a lawful request from a court, supervisory authority, law-enforcement agency or other competent public body.

8.2. We ensure that all Processing of Personal Data is based on an applicable lawful ground and is carried out lawfully, fairly and transparently.

9. The Purpose of Data Processing (Use of Collected Personal Data)

9.1. We may use the Personal Data collected from or about You for the following purposes:

9.1.1. to provide, operate and maintain the Website and the Service;

9.1.2. to verify that You are authorised to use the Service and manage Your access;

9.1.3. to record Your export activity, administer the usage limits applicable to the Service and manage Your subscription entitlements;

9.1.4. to send single-use login links and other communications necessary for the operation of the Service;

9.1.5. to process and manage paid subscriptions, confirm subscription status and handle subscription-related requests;

9.1.6. to provide customer support and respond to Your questions, requests and communications;

9.1.7. to identify, investigate and resolve technical issues, errors and service interruptions;

9.1.8. to maintain the security and integrity of the Website and the Service, prevent unauthorised access, fraud and misuse, and protect Our systems and Users;

9.1.9. to understand how the Website and the Service are used and improve their functionality and performance, where You have consented to analytics technologies;

9.1.10. to maintain records necessary for accounting, tax, audit and other legal or regulatory purposes;

9.1.11. to comply with applicable laws, lawful requests, court orders and other binding legal processes;

9.1.12. to establish, exercise or defend Our legal rights and claims and enforce Our Terms of Service; and

9.1.13. to fulfil any other purpose disclosed to You at the time Your Personal Data is collected or otherwise permitted by applicable law.

9.2. We do not use Your email address for direct marketing purposes.

10. Consent to Personal Data Processing

10.1. Acknowledgement of the Privacy Policy. By accessing or using the Website or the Service, You acknowledge that You have read and understood this Privacy Policy and that Your Personal Data may be Processed as described herein on the applicable lawful bases.

Your acknowledgement of this Privacy Policy does not mean that all Processing of Your Personal Data is based on Consent. Depending on the relevant purpose, We may Process Personal Data based on performance of a contract, compliance with a legal obligation, Our legitimate interests or Your Consent, as described in the Lawful Basis of Data Processing Section.

10.2. EU Persons’ Consent to Personal Data Processing. If You are located in the European Economic Area and Your Consent is required under the GDPR, We will Process the relevant Personal Data only after receiving a freely given, specific, informed and unambiguous indication of Your wishes.

10.3. Way to Give Consent. You may provide Your Consent by selecting the relevant option through the «Cookie Settings» link available in the Website footer.

We use Consent for optional analytics technologies, including Amplitude. Such technologies are not activated unless You provide the relevant Consent.

10.4. Scope of Consent. Your Consent applies only to the specific purpose or category of Processing selected by You. It does not apply to strictly necessary technologies or to any Processing carried out on another lawful basis.

10.5. Non-EU Persons’ Consent to Personal Data Processing. If You are located outside the European Economic Area, We will obtain Your Consent where required by the privacy or data-protection laws applicable in Your jurisdiction.

Where Consent is not required, We may Process Personal Data on another lawful basis permitted under applicable law and for the purposes described in this Privacy Policy.

10.6. Withdrawal of Consent. You have the right to withdraw Your Consent at any time through the Cookie settings available on the Website or by contacting Us at support@onixcreator.com.

Withdrawal of Consent does not affect the lawfulness of any Processing carried out before Your Consent was withdrawn.

Withdrawal of Consent also does not prevent Us from continuing to Process Personal Data where another lawful basis applies, including where Processing is necessary to perform a contract, comply with a legal obligation, protect the Website or the Service, or establish, exercise or defend legal claims.

11. The Rights of Users

11.1. Subject to possible restrictions under national law, as a Data Subject under the GDPR and other applicable data protection laws, You may have certain rights regarding the Personal Data We collect on You.

11.2. Under Chapter 3 of the GDPR, the rights of the Data Subjects include the following:

11.2.1. The Right to access. You may contact Us to get confirmation as to whether or not We are processing Your Personal Data. When We process Your Personal Data, We will inform You of what categories of Personal Data We process regarding You, the processing purposes, the categories of recipients to whom Personal Data have been or will be disclosed, and the envisaged storage period or criteria to determine that period;

11.2.2. The Right to Rectification. You may request that We correct inaccurate Personal Data concerning You or complete Personal Data that is incomplete.

11.2.3. The Right to Erasure. You may request the deletion of Your Personal Data where the conditions established by applicable law are met. This right is not absolute, and We may retain Personal Data where continued Processing is required or permitted by law, including for compliance with legal obligations or the establishment, exercise or defence of legal claims.

11.2.4. The Right to Withdraw Consent. Where Our Processing is based on Your Consent, You may withdraw that Consent at any time through the relevant functionality of the Website or by contacting Us. Withdrawal of Consent does not affect the lawfulness of any Processing carried out before the withdrawal and does not prevent Us from continuing the Processing where another lawful basis applies.

11.2.5. The Right to Object. Where Our Processing is based on legitimate interests, You may object to such Processing on grounds relating to Your particular situation. We will cease the relevant Processing unless We demonstrate compelling legitimate grounds that override Your interests, rights and freedoms or the Processing is necessary for the establishment, exercise or defence of legal claims.

11.2.6. The Right to Restriction of Processing. You may request that We restrict the Processing of Your Personal Data in certain circumstances, including where You contest its accuracy, believe that the Processing is unlawful, or have objected to the Processing while We assess the applicable grounds.

11.2.7. The Right to Data Portability. Where Processing is based on Your Consent or the performance of a contract and is carried out by automated means, You may request to receive the Personal Data provided by You in a structured, commonly used and machine-readable format and transmit it to another Data Controller.

11.2.8. The Right to Lodge a Complaint. You may lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of Your habitual residence, place of work or the place of the alleged infringement. As AndAnd Operations OÜ is established in Estonia, You may also contact the Estonian Data Protection Inspectorate.

11.3. How to use these rights. To exercise any of the rights described above, You may contact Us at support@onixcreator.com and specify the right You wish to exercise.

We may request additional information where reasonably necessary to locate the relevant Personal Data, verify Your identity and protect Personal Data against unauthorised disclosure, alteration or deletion. We will not request a copy of an identity document unless We have reasonable doubts concerning Your identity and such verification is necessary and proportionate.

We will respond to Your request without undue delay and, where the GDPR applies, generally within one month after receiving it. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. We will inform You of any extension and the reasons for it within the initial one-month period.

11.4. You may have other rights under the law applicable in Your jurisdiction.

12. Data Storing and Deletion

12.1. General. We store Your Personal Data for as long as needed to provide You with Our Website and/or Service, or as long as You use Our Website and/or Service, or continue communicating with Our support team.

Unless a longer retention period is required or permitted by applicable law, We retain Your Personal Data for no longer than 3 (three) years after Your access to the Service ends or, where applicable, after Your last interaction with Us.

When Personal Data is no longer necessary for the purposes for which it was collected, or when the applicable retention period expires, We will delete or irreversibly anonymise it using reasonable measures designed to protect it from unauthorised access or use.

12.2. Longer Terms. We may store Personal Data for a longer period where necessary to comply with applicable legal, accounting or tax obligations, resolve disputes, prevent fraud, or establish, exercise or defend legal claims.

12.3. Other Terms. Retention periods may differ depending on the territory in which the Personal Data is collected or Processed and the applicable laws and regulations. However, We seek to retain Personal Data only for as long as necessary to provide, maintain and secure the Website and the Service.

12.4. Third-Party Service Providers. Personal Data may be stored or Processed by the Service Providers used to operate the Website and the Service, including Vercel, Supabase, Resend, Stripe, Amplitude. Such providers retain Personal Data in accordance with their contractual obligations, applicable laws and their own retention requirements where they act as independent Data Controllers.

12.5. EU Territory Notice. Where the GDPR applies, We retain Personal Data only for as long as necessary for the purposes for which it was collected and Processed.

Technical and traffic information is deleted or anonymised when it is no longer required for the operation or security of the Website and the Service. Other Personal Data is stored for as long as necessary to provide the Service, manage Your access and subscription, respond to Your requests and comply with applicable legal obligations.

If You exercise Your right to erasure and the applicable legal requirements are met, We will delete the relevant Personal Data and, where appropriate, instruct the Service Providers Processing such Personal Data on Our behalf to delete it.

12.6. Anonymised and Aggregated Data. Information that has been irreversibly anonymised or aggregated so that it no longer identifies an individual may be stored and used without a fixed retention period.

13. International Transfer of Personal Data

13.1. Personal Data may be Processed or stored in countries other than the country in which You are located, including where Our Service Providers or their infrastructure are located outside the European Economic Area.

13.2. Where Personal Data is transferred outside the European Economic Area, We take appropriate measures to ensure that such transfer complies with applicable data protection laws. Depending on the relevant country and Service Provider, such measures may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses or another lawful transfer mechanism.

13.3. By using Service Providers located in different jurisdictions, Your Personal Data may be subject to the laws of those jurisdictions. However, We require Service Providers Processing Personal Data on Our behalf to apply appropriate confidentiality, security and data protection safeguards.

14. Data Security

14.1. We care to ensure the security of Personal Data. We follow generally accepted industry standards to protect the information submitted to Us, both during transmission and once We receive it. We maintain technical, physical, and administrative security measures to provide reasonable protection for Your Personal Data. When We or Our contractors process Your information, We also make sure that Your information is reasonably protected from unauthorized access, misuse, loss, manipulation, falsification, destruction, or unauthorized disclosure. This is done through appropriate administrative, technical, and physical measures.

14.2. Due to the nature of Internet communications and evolving technologies, there is no 100% secure method of transmission over the Internet or method of electronic storage. Although We do Our best to protect Your information, We cannot guarantee its absolute security. We cannot provide, and we hereby disclaim, assurance that the data You provide Us will remain absolutely secure.

14.3. We never process any kind of sensitive data or criminal offense data. Also, We never undertake to profile Personal Data.

15. Third-Party Service Providers

15.1. We work with third-party service providers who provide website hosting, maintenance, and other services for Us. They may be located outside of the EEA. These contractors may have access to or process Personal Data on Our behalf as part of providing those services for Us. We limit the information provided to these service providers to that which is reasonably necessary for them to perform their functions.

15.2. Hosting. Vercel provides hosting and technical infrastructure for the Website and the Service. In providing these services, Vercel may process standard server and technical information, including IP addresses, browser information and timestamps. Further information is available in the Vercel Privacy Notice.

15.3. Backend Infrastructure. Supabase provides the database and authentication infrastructure used to manage authorised email addresses, access information and authentication tokens. Our Supabase project is hosted in a European Union region. Further information is available in the Supabase Privacy Policy.

15.4. Transactional Emails. Resend provides transactional email services used to send single-use login links and other service-related communications. For this purpose, Resend may Process Your email address and information relating to the delivery of the relevant email. Further information is available in the Resend Privacy Policy.

15.5. Analytics. Amplitude provides analytics services and is activated only where You have provided the relevant Consent. Amplitude may Process a pseudonymous device identifier and limited information about Your interactions with the Service. Amplitude does not receive book metadata, the contents of uploaded files or Your account email address. Our Amplitude project is configured to use servers located in the European Union. Further information is available in the Amplitude Privacy Notice.

15.6. Payment Services. Stripe provides payment processing and subscription management services in connection with the Service. Personal Data Processed by Stripe is subject to the Stripe Privacy Policy.

15.7. Listed service providers may collect, store, and process certain Personal Data in compliance with applicable laws and their internal privacy policies. We take reasonable steps to ensure that any Third-Party provider handling Personal Data implements appropriate technical and organizational security measures to protect such Data against unauthorized access, loss, misuse, or disclosure. However, We do not control and are not responsible for the privacy practices of these Third-Party providers, and We encourage You to review their respective privacy policies for further information on how they Process Personal Data.

15.8. Personnel and Advisors. We may share Your Personal Data with Our personnel, contractors, technical specialists, insurers and professional advisors, including lawyers, accountants, auditors and tax advisors, where necessary in connection with the services they provide to Us. Access is limited to persons whose duties require it and only to the extent reasonably necessary. Such persons are required to keep Personal Data confidential and secure.

15.9. Legal Disclosures. We may disclose Your Personal Data where required or permitted by applicable law, including in response to a lawful request, court order or other legal process issued by a court, regulatory authority, law-enforcement agency or other competent public body. We may also disclose Personal Data where reasonably necessary to protect Our rights, property or security, prevent unlawful activity, or establish, exercise or defend legal claims.

16. Payments and Subscriptions

16.1. All payments for subscriptions to the Service are processed by Stripe through its payment interface.

16.2. When You purchase a subscription, You may be required to provide Stripe with Your name, email address, billing address and payment card information. Your payment card information is submitted directly to and Processed by Stripe.

16.3. We do not collect, receive or store Your full payment card number, card verification code or other complete payment card details.

16.4. We receive and retain only limited information necessary to manage Your subscription, including Your subscription status and the relevant Stripe customer and subscription identifiers.

17. Children’s Privacy

17.1. Protecting children’s privacy is important to us. However, ONIXCREATOR is a professional, invite-only Service and is not intended for children.

17.2. You may use the Service only if you are at least 18 years old or have reached any other minimum age required under the laws of your country of residence to enter into a legally binding agreement.

17.3. We do not knowingly collect or maintain personal data from anyone who does not meet this age requirement. If we become aware that we have collected personal data from such a person, we will take reasonable steps to delete the relevant information.

17.4. If you believe that a person who does not meet the applicable age requirement has provided personal data to us, please contact us at support@onixcreator.com.

18. Changes to the Privacy Policy

18.1. We may update this Privacy Policy from time to time to reflect changes to the Service, our processing practices, our service providers or applicable legal requirements.

18.2. The updated version will be published on the ONIXCREATOR website. Where changes materially affect how we process your personal data, we will provide reasonable notice by email, through the Service or by another appropriate means.

19. Contact

If you have any questions about this policy or want to exercise your data-protection rights, email support@onixcreator.com.