Privacy Policy

Onari handles personal data for two groups of people, and our role is different for each:

• Our customers' teams and visitors to onari.xyz. For people who sign up, use our dashboard, contact us or browse our website, Onari decides how the data is used. We are the data controller.
• Players. These are the customers of the companies that use Onari (for example, a shopper on an e-commerce app). The company decides what to send us and why, so the company is the data controller and Onari is its data processor. If you are a player, the company's own privacy policy applies, and you should contact it first. We will help it respond.

We follow the Nigeria Data Protection Act 2023 and, where they apply, Ghana's Data Protection Act 2012, Kenya's Data Protection Act 2019 and South Africa's Protection of Personal Information Act (POPIA).

• Account details: your name, work email, company, role, country and, if you use Google sign-in, your Google profile name and photo.
• Billing details: billing contact, company address and tax number where needed. Payments are handled by Bachs; we do not see or store full card numbers.
• How you use the dashboard: pages viewed, actions taken (kept in your workspace's audit log), device and browser type, IP address and approximate location.
• What you tell us: messages from our contact form, support emails and calls.
• AI builder prompts: the campaign descriptions you type and the drafts produced, so you can see them later and so we can fix problems.

Companies send us:

• A player ID that the company chooses, such as user_8a21. It should not be a phone number, email or account number.
• Events and properties, such as "order completed, amount ₦12,500, channel app".
• Optional attributes the company chooses to send for targeting, such as a city or customer tier.

From these, Onari creates progress data: streaks, badges, quest progress, leaderboard positions, trivia answers and scores, referrals and rewards earned. When a player opens the Rewards Hub, we also record basic technical data (device type, app version, IP address) to keep it secure.

Our terms forbid companies from sending us sensitive data such as BVN, NIN, ID numbers, card details, health or biometric data.

• To provide the service you signed up for, including running campaigns, sending webhooks and showing reports. Legal basis: our contract with you.
• To keep the service secure and prevent fraud and abuse, such as fake referrals or bots in trivia. Legal basis: our legitimate interest, and our contract.
• To bill you and keep financial records. Legal basis: contract and legal obligation.
• To send service emails (receipts, usage alerts, security notices). Legal basis: contract.
• To send product news. Legal basis: consent or legitimate interest; you can unsubscribe at any time.
• To improve Onari using aggregated statistics that cannot identify anyone. Legal basis: legitimate interest.

We do not sell personal data. We do not use player data for advertising, and we do not use customer or player data to train AI models.

We use the following service providers (sub-processors) to run Onari. Each is bound by a contract that requires it to protect the data and use it only to provide its service to us.

We may also share data if the law requires it, to protect people's safety, or as part of a merger or acquisition (in which case this policy continues to apply).

Some of our providers store or process data outside the country where you or your players live, including in Europe and the United States. When that happens, we rely on the safeguards the applicable law recognises, such as contractual commitments and the provider's security certifications. Enterprise customers can ask about hosting options closer to home.

• Account and workspace data: for as long as the workspace is open, then deleted within 30 days of closing.
• Raw player events: 13 months, so year-on-year reports work. After that, only aggregated totals remain.
• Player progress and reward history: for as long as the company keeps its workspace, or until it asks us to delete a player.
• Billing records: as long as tax and accounting law requires (usually 6 years in Nigeria).
• Contact form messages: up to 2 years.

Data is encrypted in transit and at rest. Each company's data is kept separate at the database level. Secret API keys are stored hashed, webhooks are signed, staff access is limited to people who need it and is logged, and we back up data regularly. More detail is in our Data Processing Agreement.

Depending on where you live, you can ask us to:

• Give you a copy of your personal data.
• Correct data that is wrong.
• Delete your data.
• Stop or limit how we use it, or object to it being used.
• Send your data to you or another service in a common format.
• Withdraw consent where we rely on it.

Email hello@onari.xyz. We reply within 30 days. If you are a player, please contact the company whose app you use first; we will help it respond.

You can also complain to your data protection authority: the Nigeria Data Protection Commission, Ghana's Data Protection Commission, Kenya's Office of the Data Protection Commissioner, or South Africa's Information Regulator.

Onari's dashboard is for adults acting for a business. Companies are responsible for making sure their campaigns are suitable for, and lawful to offer to, their own users, including any rules about children.

If we make an important change to this policy, we will tell workspace owners by email and update the date at the top.

Privacy questions: hello@onari.xyz.