Privacy Policy

Last updated: 25 October 2026

This Privacy Policy explains how Oniq ("Oniq", "we", "us", or "our"), operated by ONIQ AI LTD, a company registered in England and Wales (company number 17084772) with its registered office at Flat 204 The Circle, Queen Elizabeth Street, London, England, SE1 2JN, collects, uses, stores, and protects information in connection with the Oniq service (the "Service"), available at oniqai.com and its subdomains (including connect.oniqai.com and dashboard.oniqai.com), at oniq.page, and on the pages we publish for our customers on subdomains of their own domains.

If you have any questions, contact us at privacy@oniqai.com.

1. Who this policy is for

Oniq is a business-to-business service. Our customers are businesses who ask us to improve their website: to read the marketing and analytics accounts they own or are authorised to access, propose improvements, build page versions (new versions of their pages) and, when agreed, publish them and measure them with their visitors.

When a customer connects an account (for example Google, Meta or PostHog), they authorise Oniq to read data from that account on their behalf. For that data, and for data about the visitors to the pages we publish for a customer, the customer is the controller and Oniq acts as a processor. Oniq is the controller for the limited account information we use to operate the Service (for example the email address used to sign in to the dashboard), and for the visitors to our own site, oniqai.com (Section 3.9).

2. What the Service does

Oniq connects, with your explicit authorisation, to the marketing and analytics platforms you already use, reads data from them, and fetches the public pages of your own website. From these we propose improvements to your website. They are presented to you in a dashboard, where each is shown as your page as it is today next to a page version: a new version of it. We build page versions ourselves, by hand or with AI (see Section 5). In the dashboard you can also comment on your pages and on page versions, which we store and act on (see Section 3.6).

When agreed with you, we publish a page version on a subdomain of your own domain that you point to us, and can show it to some of your visitors to measure it against your current page (a page test). Section 3.10 describes what that collects about your visitors.

We do not run ads or change your connected accounts: we only read from them. We do not change your own website or its server.

3. Information we access and collect

3.1 Google account data (read only)

When you connect a Google account, you grant the following scopes. We request only what the Service needs, only for the platforms you choose to connect, and we only read with them:

Google offers no read-only scope for Google Ads, so the Google Ads scope would also allow changes; we make none. The Google Analytics data we read is aggregate and reported at the metric level. We do not request scopes that read individual end-user identities.

3.2 Meta account data (read only)

When you connect a Meta (Facebook and Instagram) account, you grant the read-only scope ads_read. We read aggregate ad performance: campaigns, spend, delivery, lead counts, and reported conversions, plus the list of ad accounts you can access so we can locate the right one. We do not request the `leads_retrieval` scope and do not retrieve the personal contact details of individual leads submitted through your lead forms; we read only aggregate lead counts and costs.

3.3 Website and public data

To propose improvements we fetch and store the public pages of your website (including pages linked from your ad campaigns), capture screenshots of those pages, and request performance measurements from the Google PageSpeed Insights API. This covers only publicly accessible pages of your site.

3.4 Authentication and account data

To use the dashboard you sign in with a one-time "magic link" sent to your email address. The link works once and expires after 10 minutes; a sign-in lasts 30 days from your last visit. Only people we have given access to a site can sign in to see it. We store your email address, the sites you have access to, and when each sign-in started and was last renewed by a visit (at most once a day), to operate and secure the dashboard. An invitation we send you when we give you access works the same way: once, within 7 days.

Cloudflare logs each request to the dashboard, which can include your IP address, so we can secure and debug the Service.

3.5 OAuth tokens

To read the data above, we store the access and refresh tokens issued by Google and Meta. These tokens let the Service read your connected accounts until you revoke access. If you connect PostHog, we store a personal API key you create with read access to your project; it can read every event and person in that project, including any email addresses it holds. These sign-ins stay on our operator's computer, except for page tests: for those we keep your Google sign-in, and your PostHog key if you give us one, on our servers, encrypted. The service that reads your page tests' figures asks Google only for read-only Google Analytics access, though the sign-in carries every scope you granted. See Section 8 for how they are secured.

3.6 What you add in the dashboard

The dashboard lets you comment on a page of your site, or on a version we propose for it, and add a note on your site's goals and context. We store what you type, the page or version it is about, anything you pointed at on the page (a label and where it is on the page), when you sent it, and the email address of the person who wrote it.

Everyone with access to your site in the dashboard sees each comment with who wrote it: your people by their email address, ours by first name. Notes on your goals and context are shown without the sender's email address. When someone on your side comments, our team gets an email with the comment, who wrote it, what they pointed at and a link to it. When we comment, everyone on your side with access to your site gets an email with the comment, who wrote it, what it points at and a link to it. When someone replies to a comment, everyone on your side who wrote in that thread gets one with the reply, who wrote it, the start of the comment it answers and a link to it. Nobody gets an email about their own comment, and these emails stop when someone's access to your site does. We, and the AI tools we work with (see Section 5), see comments and notes with the address. For each person, we also keep how far they have read the comments on each page and version (the time of the newest one they have seen), so the dashboard can mark the comments that are new to them; it is removed when their access to the site is.

Don't put anything confidential in a comment or a note: what you ask us to put on a page version can appear on a public copy (see Section 3.7).

When someone resolves a comment's thread, we store who resolved it and when. When you remove a page version from the list, we store who removed it and when, so it can be brought back.

3.7 Copies of your pages and the versions we build

To show an improvement, we keep copies of public pages of your website and the page versions of them:

• Saved pages. Copies of your public pages, and pictures of them, stored on Cloudflare R2 and served from dashboard.oniqai.com/sites/ under a random address.
• Site copies. We host a working copy of your saved pages on Cloudflare Workers, at an address of our own named after your site (for example <name>.oniq.page), so the dashboard can show page versions in place. We remove scripts that track visitors, and the copy's forms send nothing. These copies are separate from your live website: nothing we do on them changes it.
• Page versions. The page versions we build are stored with these copies and on Cloudflare R2.
• Previews. A page version can be opened on its own at oniq.page, under an address that carries a random token.

Saved pages, site copies, previews, and the page versions shown on them do not require signing in: anyone who has the address can open them. Saved pages sit under a random address; a site copy's address is named after your site, so it is easy to find. They ask search engines not to index them, but they should not be treated as confidential, and what you ask us to put on a page version can appear there.

3.8 Cookies in the dashboard and the site copies

The dashboard sets a few cookies of its own, and our site copies set none. None is used for advertising or to follow you across other websites. The dashboard loads no advertising scripts, and what it counts of how it is used (Section 3.11) keeps nothing in your browser. When we have no icon saved for a site, your browser fetches it from Google's public icon service, which tells Google that site's address and, like any request, your IP address.

Pages on a site copy can include players and forms from other services that your own pages embed, such as YouTube videos or HubSpot forms. When one loads, that service may set cookies of its own, as it does on your website.

3.9 Cookies on oniqai.com

oniqai.com counts its visitors with Cloudflare Web Analytics and Ahrefs Web Analytics, which set no cookies, and with Google Analytics, which is linked to our Google Ads account so we can see which of our ads bring visitors.

Google Analytics sets no cookies until you agree if Google places you in the UK, the European Economic Area or Switzerland, or if your device is set to a time zone there. If your device is set to such a time zone, we ask once, at the foot of the page. Until you agree, and if you say no, Google Analytics still receives each visit, without cookies, from which Google estimates our visits and the results of our ads.

Your answer is kept in your browser (oniq-consent, in local storage) and is not sent to us. To change it, use Cookies at the foot of any page; saying no then deletes the cookies below.

Because Google Analytics is linked to Google Ads, Google may also set cookies of its own to measure our ads, under the same answer.

3.10 Visitors to the pages we publish for our customers

When we publish a page for a customer on a subdomain of their own domain (for example go.their-company.com), the customer decides with us what runs there, and is the controller of what it collects about their visitors.

• Page tests. Our server decides which version of the page a visitor sees before the page loads, and keeps that choice in a cookie on the subdomain, for every visitor, without waiting for a cookie banner. The address a visitor lands on says which version they were shown (oniq_test, oniq_version), so the customer's own analytics can tell the two apart.
• Our server's records. For each visit to a page under a page test, our server logs one line that names no visitor: the page, the version shown, how the visitor arrived (from an ad, directly, or otherwise), their country, and the Cloudflare data centre that answered, without their IP address, browser, or the address's query string. Cloudflare's own logs of each request to a published page also hold its headers, such as the browser and the page the visitor came from (Section 9 says how long each is kept).
• Our analytics. Each published page carries PostHog (PostHog Inc., on servers in the EU), in one project of Oniq's that holds the events of every customer's published pages, each marked with its page; we use a customer's events only for that customer's results. PostHog receives each page's full address (including any ad click id in it), the address the visitor came from, their device and browser, their IP address, from which PostHog derives an approximate location, page views, clicks, scroll depth and heatmaps, and, on shop pages, the products viewed and added to the cart. It never records sessions and builds no profile of a visitor who is not identified. Where the customer's page asks for consent through its cookie banner, PostHog waits for that answer and runs without cookies if the visitor refuses; where the page asks nothing, it runs at once, with its cookie.
• The customer's own tags. A published page also carries the analytics and advertising tags the customer's current page carries (for example Google Analytics or a Meta pixel), which send to the customer's own accounts under their own terms.

If you visited a page we published for one of our customers, the customer's own privacy notice applies; contact them, and we will help them answer you.

3.11 How you use the dashboard

We count how the dashboard is used, to see what helps and improve it, with PostHog (PostHog Inc., on servers in the EU), in a PostHog project of its own, apart from the one for the pages we publish. PostHog receives, with your email address and whether you are one of our team or a customer:

• when a sign-in link is sent to you (one you asked for, or an invitation, even before you first sign in), and when you sign in;
• while you are signed in, each screen you open (its address, never anything after a #, and its title), when, how long it stayed open, the site and page version on it, the address you came from, and your browser, device and screen size;
• when you switch between a current page and a page version, or between phone and laptop width, and when you copy a page version's link to share it;
• when you comment, reply or resolve a thread, and when you send Oniq a prompt (a new improvement, a change to a page version, a note or a goal), without what you wrote;
• whether you arrived from a link in an email we sent.

It goes to PostHog through our own servers, so PostHog does not receive your IP address, and no location is looked up. Nothing is kept in your browser for it, and your sessions are not recorded. Only our team sees it, to improve the Service, never for advertising.

4. How we use information

We use the information solely to:

• provide the Service: read your connected accounts and website, propose improvements, build and show page versions, publish them when agreed and measure them in page tests, and act on your comments and notes in the dashboard;
• operate, secure, debug, and improve the Service; and
• comply with legal obligations.

We do not sell your data, use it for advertising, or share it for others' advertising or marketing.

5. Automated and AI processing

We propose improvements, build page versions, and act on your comments and notes in the dashboard with the help of large language models from Anthropic, PBC, which provides the Claude AI models through its API, acting as our sub-processor and processing the data under Anthropic's commercial terms. For that we send Anthropic, through its API, the code of the page, your site's context, the improvement the version carries out, aggregate figures from your connected accounts and your page tests' results, and your comments and notes, with who wrote them.

The data is processed by AI only to propose improvements, build page versions, and act on your comments and notes, for the customer that granted access. We do not use your data, and we do not permit our AI sub-processor to use your data, to train, develop, or improve any generalised or foundational AI or machine-learning models.

6. Google API Services Limited Use disclosure

Oniq's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

1. We only use access to Google user data to provide and improve the user-facing features of the Service that are prominent in the Oniq interface.
2. We only transfer Google user data to others as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your consent.
3. We do not use Google user data for serving advertisements.
4. We do not allow humans to read Google user data except: with your affirmative consent for the Service you have requested; where necessary for security purposes or to comply with applicable law; or where the data has been aggregated and anonymised for internal operations. Human access is limited to authorised personnel delivering or supporting the Service you engaged us for.

The same commitments apply to data we receive from Meta and other connected platforms.

7. How we share information (sub-processors)

We share information only with service providers that help us run the Service, under contract and for the purposes above:

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of Oniq, our customers, or the public. We do not otherwise sell or rent personal information.

An up-to-date list of sub-processors is available on request.

8. Where data is stored and how we secure it

Data is stored on the computer of the operator working on your site and on Cloudflare infrastructure (R2 object storage, a D1 database, and KV for sign-in sessions) associated with dashboard.oniqai.com. Site copies and previews run on Cloudflare Workers under oniq.page, and the pages we publish for you on the subdomain you point to us. The records behind each site's workspace (its improvements, figures, context, and page versions) are kept in our database on Cloudflare; your site's profile is kept with our code in our private repository on GitHub.

We apply safeguards appropriate to the data, including:

• End-to-end encryption of tokens on the relay. When onboarding is done remotely, the sign-in tokens are sealed to the operator using ECDH-P256 and AES-GCM, so the relay's temporary key store holds only ciphertext, which the operator alone can decrypt.
• Automatic expiry. A link we send you to connect Google or Meta stops working after the time we set when we send it, never more than 30 days. With it we store the name of the person we sent it to and the Google or Meta account to add as a tester. A sealed token bundle is removed from the relay's temporary key store automatically, within about thirty days of the sign-in. In the same-room flow, where the operator is waiting, it is deleted the moment it is retrieved and the whole window is thirty minutes.
• Restrictive storage. Locally cached tokens are written with owner-only file permissions.
• Sign-ins for page tests. The Google sign-in and PostHog key we keep on our servers for page tests are encrypted with AES-256-GCM before they leave the operator's computer, under a key held only there and by the service that reads page tests' figures; the dashboard cannot open them.
• Access control. The dashboard is gated behind email magic-link authentication. Each person sees only the sites we have given them access to, and that is checked on every request. Saved pages, site copies and previews are the exception: see Section 3.7.

No method of transmission or storage is completely secure, but we work to protect your information using measures appropriate to its sensitivity.

9. Data retention and deletion

We retain your data for as long as needed to provide the Service to you, and then as required for legal, security, or record-keeping purposes.

• Relay token bundles expire automatically after about thirty days.
• Dashboard sign-in links expire after 10 minutes, and sign-ins 30 days after your last visit.
• For pages we publish: Cloudflare keeps its request logs and our log lines for 7 days; we keep a copy of our log lines, which name no visitor, in our own storage until we delete it; PostHog keeps our analytics events for as long as our PostHog plan keeps events.
• How the dashboard is used (Section 3.11): PostHog keeps those events for as long as our PostHog plan keeps events, and we delete a person's on request.
• You can revoke Oniq's access to any connected account at any time (see Section 10), which stops all future data collection.
• On offboarding, or on your request, we stop serving the pages we published for you and delete, by hand today, the tokens and keys for your connected accounts, the database records for your site (including the comments and notes left in the dashboard and who has access), your saved pages, site copies, and the page versions we built, and your people's events of how they used the dashboard. Your site's profile is removed from our code repository; its history keeps earlier versions. We do not yet remove, for one customer at a time: the record of which page version each published address showed and when, the shares each page test ran at, our stored copy of page tests' log lines, or your published pages' events in our PostHog project.

To request deletion, contact privacy@oniqai.com.

10. Your rights and choices

Revoke access at any time. You can disconnect Oniq without contacting us:

• Google: Google Account permissions
• Meta: Business Settings → Business Integrations for the connected Business account.
• PostHog: delete the personal API key you made for us, in your PostHog settings.

Data-protection rights. Depending on where you are, you may have the right to access, correct, delete, port, or restrict processing of your personal information, and to object to processing. If you are in the EEA or UK, the legal bases we rely on are performance of a contract, our legitimate interest in operating, securing and improving the Service, and, for the cookies on oniqai.com described in Section 3.9, your consent, which you can withdraw at any time. If you are a California resident, we do not sell or "share" personal information as those terms are defined under the CCPA.

To exercise any right, contact privacy@oniqai.com. Where we act as a processor on a customer's behalf, we will refer a request to the relevant customer (controller) or act on their instructions.

11. International transfers

We operate internationally, and information may be processed in countries other than your own, including the United States. Where required, we use appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for such transfers.

12. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date above and, for material changes, take reasonable steps to notify you.

14. Contact

ONIQ AI LTD Flat 204 The Circle, Queen Elizabeth Street, London, England, SE1 2JN Company number 17084772 (registered in England and Wales) Email: privacy@oniqai.com