Privacy Policy

Who we are and what this covers

Onita AI is an agentic business platform that helps small and medium-sized businesses run their work with AI assistants (“agents”), automations, and connections to the tools you already use. Onita AI is built and operated by iDegin Technologies Ltd (“iDegin”, “Onita AI”, “we”, “us”, or “our”), a company registered in Nigeria.

This Privacy Policy explains what information we collect when you use our websites, apps, and services (together, the “Service”), why we collect it, who we share it with, and the choices and rights you have. It applies to everyone who uses Onita AI — account holders, people invited into a workspace, and visitors to public pages such as this website, shared documents, and booking links.

In short: we collect what we need to run the Service for you — your account details, the content you and your team create, the accounts you choose to connect, and basic technical data. We use trusted third-party providers to deliver AI, payments, email, and hosting. We do not sell your personal data, and we do not use your private business content to train our own AI models.

If you use Onita AI as part of a team or company workspace, that organisation controls the workspace and its content. In that case we handle much of your information on the organisation’s behalf, and their own policies may also apply to you.

Information we collect

We collect information in three ways: information you give us, information created as you use the Service, and information from accounts you choose to connect.

• Account details — your name, email address, and a password (stored only in a securely hashed form; we never see or store your actual password). You may also add a profile photo.
• Workspace and organisation details — the name of your workspace or organisation, your role and team members, and, for billing, an organisation contact’s name, email, and phone number.
• Content you create — the documents, notes, files, tables, forms, chat messages with your agents, comments, attachments, and approvals you and your team produce inside Onita AI. We call this your “Customer Content”.
• Invitations and contacts — email addresses you use to invite people into a workspace or share content with, and contact details your agents gather or you enter as part of your work.
• Form and booking submissions — if you or a visitor fills in an Onita AI form or booking link, we collect the answers submitted, which may include an email address and any details the form asks for.
• Support and communications — messages you send us and your notification preferences.
• Usage and activity — actions taken in your workspace, an audit trail of changes and approvals, when you were last active, and which notifications you have read.
• AI usage records — for billing and limits, we record which AI model was used, how many tokens were processed, and the cost, linked to your account, agent, and conversation.
• Device and technical data — your IP address, browser or device type (user-agent), and session information needed to keep you signed in securely.
• Push and notification data — if you enable push notifications, the technical subscription details your browser or device provides so we can deliver them.
• Connected-account data — when you connect a third-party account such as Google, Microsoft, Zoho, or Zoom, we receive the access permissions (tokens) you grant and the data needed to perform the tasks you ask your agents to do. You control which accounts you connect and can disconnect them at any time.
• Payment information — when you pay, our payment providers (Paystack and Flutterwave) process your card or transfer details directly. We do not store your full card number; we keep only a record of the transaction — amount, currency, status, and a reference — to manage your invoices and credits.

How we use your information

We use the information above to:

• Provide, maintain, and secure the Service — including signing you in, running your agents and automations, and keeping your data in sync across your devices.
• Carry out the tasks you ask for, such as drafting documents, sending email through a connected account, scheduling meetings, or researching on the web.
• Send you service messages you need — security codes, invitations, approval requests, and important account notices.
• Send product notifications you have chosen to receive; you can adjust or turn these off in your notification settings, and every non-essential email includes a one-click unsubscribe.
• Process payments, manage subscriptions and AI credits, and prevent fraud and abuse.
• Understand how the Service is used so we can fix problems and improve it.
• Meet legal, tax, and regulatory obligations, and enforce our Terms of Service.

Lawful bases for processing

Under Nigeria’s data protection law, we rely on one or more lawful bases to process your personal data: performing our contract with you, your consent (for example, connecting an account or enabling push notifications), our legitimate interests in running and improving the Service safely, and compliance with our legal obligations.

How AI processes your information

Onita AI is powered by artificial intelligence. To answer you and carry out tasks, your agents send the relevant content of a conversation — your messages, the documents or data you reference, and results from tools such as web search — to third-party AI providers that run the underlying models.

We route this through an AI gateway (OpenRouter) to leading model providers such as Anthropic (Claude), and use additional providers for specific jobs such as generating text embeddings for search. We choose providers that offer strong security and confidentiality terms.

We do not use your private Customer Content to train our own AI models, and we instruct our AI providers not to use it to train theirs. Your business content is processed to serve you, not to build a general model.

Because AI can make mistakes, the Service is built around human-in-the-loop approvals: sensitive or significant actions an agent proposes (like sending an external email) can be held for a person to review and approve. You are responsible for reviewing agent output before relying on it.

Connected accounts and connectors

Onita AI can connect to other services so your agents can work across your tools. You decide which accounts to connect and what they may do. When you connect an account, we securely store the access tokens needed to act on your behalf — always encrypted — and you can revoke access at any time from your settings or from the provider directly. Connectors currently include:

• Google Workspace — Gmail, Calendar, Drive, Docs, and Sheets.
• Microsoft 365 — Outlook mail and calendar, Teams, OneDrive, and Excel.
• Zoho — Mail and Calendar.
• Zoom — meetings and webinars.

Google and Microsoft data use

Onita AI’s use and transfer of information received from Google APIs, and from Microsoft Graph, adheres to the Google API Services User Data Policy and Microsoft’s equivalent requirements, including their Limited Use requirements. We only access the data needed to provide features you request, we do not sell it, we do not use it for advertising, and we do not let humans read it except with your permission, for security, to comply with the law, or where required to operate or improve user-facing features in line with those policies.

Cookies and analytics

We use a small number of cookies that are essential to run the Service — chiefly a secure sign-in (session) cookie that keeps you logged in. This cookie cannot be read by scripts and is not used for advertising.

On our production website we also use analytics tools to understand how the Service is used so we can improve it. These may set their own cookies or identifiers:

• PostHog — product analytics (pages viewed, features used, and feature flags), using event and identifier data, not the content of your documents, chats, or emails.
• Microsoft Clarity — anonymised heatmaps and session replay that show how people navigate our interface.
• Google Analytics — aggregate website traffic and usage statistics.

When we share information

We do not sell your personal data. We share information only in these situations:

• With your workspace — content you create is visible to the people you share it with and to administrators of your workspace or organisation.
• With service providers (sub-processors) who help us run Onita AI, under contracts that require them to protect your data and use it only to provide their service to us. The current list is below.
• At your direction — with third-party accounts you connect, or when you publish or share content via a public link.
• For legal reasons — where we must comply with the law, a lawful request, or to protect the rights, safety, and property of Onita AI, our users, or the public.
• In a business transfer — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that deal, subject to this Policy.

Our sub-processors

These are the key third parties that process personal data to help us deliver the Service. We may update this list as our providers change, and we only involve a provider for an optional connector if you choose to use it.

• OpenRouter, Anthropic, and other AI providers — AI model processing for agents and automations (conversation content and referenced data you send to an agent).
• Google Gemini and OpenAI — text embeddings and search features (content indexed for search within your workspace).
• Web search and research tools (such as Tavily) — web search and page reading when an agent researches (the search terms and URLs your agent uses).
• Zoho ZeptoMail — sending transactional and notification email (recipient email address and message content).
• Paystack and Flutterwave — payment and subscription processing (payment details, amount, and transaction reference).
• PostHog, Microsoft Clarity, and Google Analytics — product and website analytics (usage events and device data, not your content).
• Google, Microsoft, Zoho, and Zoom — connectors you choose to link (the data needed for tasks you authorise).
• Tigris object storage — storing your files and attachments (files, attachments, and documents you upload).
• Fly.io — cloud hosting and database (all Service data, hosted in the United States).

International data transfers

Onita AI is operated from Nigeria, and our providers may store and process data in other countries, including the United States and the European Union. This means your information may be transferred outside your home country.

When we transfer personal data internationally, we take steps required by Nigeria’s data protection law to keep it protected — for example, by using providers that offer adequate safeguards and appropriate contractual protections. By using the Service, you understand that your information will be processed in the locations described in this Policy.

How long we keep information

We keep your information for as long as your account or workspace is active and for as long as we need it for the purposes in this Policy.

Some records are kept longer where the law requires it — for example, billing and payment records for tax and accounting. When you delete your account or workspace, we delete or de-identify the associated personal data within a reasonable period, except where we must retain it for legal reasons or to resolve disputes.

Some data is also removed automatically:

• Read notifications are deleted after about 30 days, and notifications generally after about 90 days.
• Resolved approvals and completed change-history records are removed after about 90 days, while document version snapshots may be kept so you can undo and audit changes.
• Temporary file attachments are deleted after they expire.

How we protect your information

We use technical and organisational measures designed to protect your information. No online service can be perfectly secure, so please protect your password, use the human-approval features for sensitive actions, and tell us promptly if you suspect any unauthorised access to your account. Our measures include:

• Encryption of data in transit (HTTPS) across the Service.
• Encryption of sensitive credentials, such as connected-account tokens and API keys, while stored.
• Passwords stored only as strong, one-way hashes; we never store them in readable form.
• Secure sign-in cookies, rate limiting on sensitive actions, and redaction of secrets from our logs.
• Access controls so that only authorised people and systems can reach your data.

Your privacy rights

Subject to Nigeria’s data protection law (and any other law that applies to you), you can exercise the rights below by emailing us at legal@onitaapp.com. We will respond within the time the law requires. If your data is held inside a workspace controlled by your employer or organisation, we may direct your request to them as the controller of that workspace. Your rights include the right to:

• Access the personal data we hold about you.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete your personal data in certain circumstances.
• Object to or ask us to restrict certain processing, and withdraw consent you have given (such as for connectors or notifications).
• Request a copy of certain data in a portable format.
• Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.

Children’s privacy

Onita AI is a business product and is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, let you know inside the Service or by email. Continuing to use Onita AI after a change means you accept the updated Policy.

Contact us

If you have questions about this Policy or how we handle your data, contact iDegin Technologies Ltd (operator of Onita AI) at legal@onitaapp.com.