Privacy policy

1. Who is responsible for your information?

OnyxJar is operated by OnyxJar ("we", "us" or "our"). We are responsible for handling personal information in accordance with applicable New Zealand privacy law, including the Privacy Act 2020. Our privacy officer handles privacy questions and requests.

For privacy matters, use our contact form.

2. The information we collect

Depending on how you use OnyxJar, we may collect the following information:

• Account and security information. Your email address, account identifiers, email-verification and password-reset status, and information needed to authenticate your account and protect the service.
• Model and file content. The information you create, enter or import, including model names, descriptions, objects, attributes, relationships, rules, evidence, history, and information contained in files you upload. This content may contain personal information about you or other people.
• Plan and payment records. Your selected plan, subscription status, billing dates, transaction and invoice records, and payment-provider identifiers or payment outcomes. Payments are processed by Stripe. We do not intend to collect or store your full payment-card number or card security code on OnyxJar's own systems.
• Communications. The information you include when contacting us, together with our replies and any information needed to resolve your enquiry.
• Technical, operational and security information. Information such as IP address, request timestamps, browser or device details, error reports and security logs, to the extent these are recorded by the application and its infrastructure.
• Product-usage analytics. On the production service, we use PostHog to understand how OnyxJar is used and to improve reliability and usability. Depending on the features enabled, this may include page views, interactions with interface elements, browser/device information and session-replay data. We configure analytics to exclude or mask passwords, payment fields and model content before collection. We do not intentionally send the content of your models to PostHog.

Some information is needed to create and secure an account, provide the service or take payment. If you do not provide it, we may be unable to create your account, provide particular features or complete a payment. Other information, such as content you choose to add to a model or the details in a contact message, is optional, but is needed for the relevant feature or enquiry.

3. Why we use the information

We use information for purposes connected with operating OnyxJar, including to:

• create, verify, secure and administer accounts;
• store, process, display, import, export and publish model content at your direction;
• provide plan entitlements, process subscriptions and payments, and maintain transaction records;
• send essential service messages, including verification, security, billing and service notices;
• answer enquiries and provide support;
• detect abuse, investigate errors, maintain security, protect the service and comply with legal obligations; and
• understand product usage and improve the service through aggregated or user-level product analytics.

We do not sell personal information or use it to build advertising profiles for sale to advertisers.

4. Model content and information about other people

You choose what to enter or import into OnyxJar. Model content can contain confidential business information or information that identifies people. Only upload personal information about another person where you have the authority to do so and have provided any notice or obtained any permission required by law. Keep the information relevant to the model's purpose and avoid including sensitive or unnecessary personal information.

Where we store or process personal information in model content only to provide OnyxJar to you, we may be acting as your service provider and holding that information on your behalf. The respective legal responsibilities of you and us depend on the circumstances and applicable law. Where we collect personal information indirectly from another source for our own purposes, we will take reasonable steps to provide any notice required by law, subject to applicable exceptions.

5. Publishing and sharing

Some plans and features let you publish or share a model through an OnyxJar viewer or create a published file. When you choose to publish, the content included in that published output may be visible to people who can access the published page or file. A file you download and share is under your control. Other people may copy or redistribute material they can access, and we may not be able to retrieve copies that have been downloaded or shared outside OnyxJar. Review a model for confidential or personal information before publishing it.

6. Cookies and similar technologies

We use essential browser storage, including session and security cookies, to keep the service working, maintain sign-in state and protect forms. Our production analytics tools may also use cookies or similar technologies, depending on their configuration. We do not use advertising cookies for targeted advertising. You can manage cookies through your browser, although blocking essential cookies may prevent some features from working correctly.

The website currently loads the DM Sans typeface from Google Fonts. When your browser requests that font, Google may receive your IP address and the usual technical details associated with the request.

7. Who we share information with

We share information only where needed to operate the service, at your direction, or as otherwise permitted or required by law. Our service providers include:

• Vultr: hosting for the production application and its data;
• Cloudflare: domain traffic, network and security services, and production backup object storage;
• Resend: delivery of account, security and other service emails;
• Stripe: payment processing and subscription administration;
• PostHog: production product analytics using its US Cloud service; and
• Google Fonts: delivery of the website typeface.

These providers may process information in New Zealand or other countries, depending on the provider and service. Our production application is hosted in Sydney, Australia. We take steps appropriate to the circumstances to protect information handled by service providers. Where a transfer is a disclosure of personal information outside New Zealand to which information privacy principle 12 applies, we will take the steps required by that principle.

We may also disclose information where reasonably necessary to respond to a lawful request, comply with a legal obligation, protect the rights or safety of a person, investigate suspected misuse, or establish or defend a legal claim. If OnyxJar or its business is reorganised or transferred, information may be transferred as part of that transaction subject to applicable privacy requirements.

8. Storage, security and retention

We use safeguards intended to protect personal information against loss, unauthorised access, misuse or disclosure. No internet service or storage system can be guaranteed completely secure, so keep independent copies of important source material and any exports available to your plan.

We keep account and model information while it is needed to provide the service or while your account remains active. If you close your account or request deletion, we will delete or de-identify information from active systems within a reasonable period, except where we need to retain it for legal, accounting, security, dispute-resolution or other lawful purposes. Published material and copies held by other people may not be fully retractable.

Production backups use rotating retention periods. A deleted item may remain in an earlier backup until that backup expires; backups are retained for recovery rather than ordinary use of the service. Billing records may be retained for the period required by applicable tax, accounting and other laws. Technical, security and analytics records are kept only for as long as reasonably needed for their stated purposes and the retention settings of the relevant systems.

9. Access, correction and privacy complaints

You may ask for access to personal information we hold about you and request correction if it is inaccurate. Contact our privacy officer using the details in section 1. We may need to verify your identity and consider other people's rights before responding. We will handle requests within the timeframes required by the Privacy Act 2020.

If you are not satisfied with our response, you may raise the matter with the Office of the Privacy Commissioner at privacy.org.nz. If a privacy breach is a notifiable privacy breach, we will notify the Commissioner and affected people as required by law.

10. Changes to this policy

We may update this policy to reflect changes to OnyxJar, our providers or the law. We will update the date at the top of this page and provide additional notice of material changes where appropriate. If a change requires consent or another step under law, we will take that step.

11. Contact

For privacy questions or requests, contact OnyxJar at the contact form.