1. Roles
For player data, you are the data controller and Onari is your data processor. We process player data only to provide Onari to you, following your documented instructions. Your instructions are these terms, your campaign settings and what you do in the dashboard and API.
If we believe an instruction breaks data protection law, we will tell you.
2. Details of the processing
- Subject matter: running gamification campaigns for your customers.
- Duration: for as long as you have an Onari workspace, plus up to 30 days for deletion.
- Nature and purpose: receiving events, calculating progress and rewards, showing the Rewards Hub, sending webhooks to you, producing reports, and keeping the service secure.
- People concerned: your app's users who take part in your programme (players).
- Types of data: the player ID you choose, events and their properties, optional attributes you send, progress and reward history, and technical data from the Rewards Hub (device, app version, IP address).
- Sensitive data: none. You agree not to send it.
3. Our commitments
- Only people who need access to player data have it, and they are bound by confidentiality.
- We keep the security measures in section 7 in place, and we only change them in ways that keep the same or a higher level of protection.
- We help you respond to requests from players exercising their rights. You can export or delete a player's data from the dashboard or API.
- We help you with data protection impact assessments and with questions from regulators, where they relate to our service.
4. Sub-processors
You allow us to use the sub-processors listed below. Each is under a written contract that protects data at least as well as this agreement does, and we remain responsible for their work.
| Provider | What it does for us | Data it handles |
|---|---|---|
| Vercel | Hosting for our website, dashboard, Rewards Hub and API | All service data in transit; request logs |
| Supabase | Main database, sign-in and file storage | Account data, player IDs, events, progress |
| Upstash | Cache, rate limits and leaderboards | Player IDs, scores, short-lived counters |
| Inngest | Background jobs and webhook delivery | Player IDs, event and reward payloads |
| Vercel AI Gateway and its model providers | The AI campaign builder | What you type into the builder and summary statistics, never player-level data |
| Bachs | Subscription billing and payments | Billing contact, plan and payment details |
| Resend | Transactional email | Team members' names and email addresses |
| Sign in with Google | Name, email and profile photo of team members who choose it |
We will give workspace owners at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds, tell us at hello@onari.xyz and we will work with you on a solution. If we can't find one, you may end the affected part of the service and receive a refund of any prepaid fees for it.
5. Personal data breaches
If we become aware of a breach affecting your player data, we will tell you without undue delay and within 48 hours. We will tell you what happened, what data and how many players are affected, what we are doing about it, and who to contact. This gives you time to meet your own duty to notify the regulator, which under the Nigeria Data Protection Act is within 72 hours.
6. International transfers
Player data may be processed outside your country by Onari and its sub-processors. We only transfer it with safeguards recognised by the applicable law, such as contractual commitments that ensure an adequate level of protection.
7. Security measures
- Encryption: TLS 1.2 or higher in transit; AES-256 at rest.
- Separation: each workspace's data is isolated at the database level with row-level security.
- Keys and webhooks: secret API keys are stored hashed and can be rolled at any time; every webhook is signed so you can check it came from us.
- Access: staff access to production uses single sign-on with an approved list of people, follows least privilege, and is logged.
- Monitoring: audit logs for every workspace, alerting on unusual activity, and rate limits on all public endpoints.
- Resilience: automated daily backups and point-in-time recovery for the main database.
- Data minimisation: we ask for opaque player IDs only and reject sensitive data patterns where we can detect them.
8. Deletion and audits
When your workspace closes, you can export your data for 30 days. After that, we delete player data from live systems, and it leaves our backups within a further 35 days.
We will give you the information you reasonably need to show that we follow this agreement. Enterprise customers can request a security questionnaire or audit once a year with reasonable notice at hello@onari.xyz.