Privacy Policy
Version 1.0 · Effective 2026-08-19 · Onyx One Limited
This is the same document you accept when you sign up at onyx1.app. Questions: support@onyx1.app.
1. Who we are and what this covers
Onyx One Limited operates Onyx One, a job-management service for New Zealand trade businesses. This policy explains how we collect, use, store and disclose personal information under the Privacy Act 2020 and its Information Privacy Principles. It covers the people who use Onyx One (business owners and their teams) and personal information those businesses store in it about their own customers.
2. What we collect
Account information: your name, email address, phone number, role, and password (stored only as a secure hash). Business information: company name, NZBN, contact details, branding. Service content: the jobs, customers, quotes, invoices, photos, reports and messages your business enters. Technical information: sign-in times, IP addresses, device and browser type, and service logs kept for security and support. We collect payment card details only via our payment processor — card numbers never touch our systems.
3. Your business's customers — who is responsible
When your business stores its customers' details in Onyx One, your business is collecting that information and is responsible for having the right to hold it; we process it on your business's behalf and only to provide the service. Requests from your customers about their information should go to your business; we will help you meet them.
4. Why we use information
To provide and secure the service; to support you; to bill you; to send service messages (like trial reminders and security notices); and to understand aggregate usage so we can improve the product. We send marketing only with consent and every such message has a working unsubscribe, as the Unsolicited Electronic Messages Act 2007 requires. We do not sell personal information, and we do not use your content to train AI models.
5. AI features
If your plan includes AI/MCP connectivity, requests you make through your own AI assistant are processed against your business's data under your existing user permissions, and an audit log records what was asked and answered. Your AI assistant is a service you hold with its provider under that provider's terms.
6. Where information is stored and who processes it
Your information is hosted with reputable cloud providers which may store it outside New Zealand: Vercel (hosting), Neon (database), Resend (email delivery), and Stripe (payments). Each processes information only to provide their service to us, under contractual safeguards we consider comparable to the Privacy Act 2020, as Information Privacy Principle 12 requires for overseas disclosure.
7. Security
Information is encrypted in transit and at rest. Every business's data is isolated at the database layer (row-level security), access within your business is controlled by roles you assign, passwords are hashed with a modern algorithm, and two-factor authentication is available for every account. No system is perfectly secure, but security is engineered into the product, not added on.
8. How long we keep information
While your account is active, operational data (photos, report files, activity history) is retained according to your plan's retention window, with notice before anything is removed. Financial and statutory records are kept for the life of the account in line with New Zealand record-keeping law. When an account closes, you have 30 days to export your data, after which we delete personal information unless we are legally required to keep it. Backups age out on a rolling schedule.
9. When we disclose information
To the processors in section 6, to the extent needed to run the service; when the law requires or permits it (for example a court order or a Privacy Act request); and in a business sale or restructure, to a successor bound by this policy. Never to advertisers, and never for profit from the data itself.
10. Your rights
You may ask for a copy of the personal information we hold about you and ask us to correct it (Information Privacy Principles 6 and 7). Write to support@onyx1.app; we respond within 20 working days as the Act requires. If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
11. If something goes wrong
If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, as the Privacy Act 2020 requires, and tell you what happened, what information was involved, and what we are doing about it.
12. Cookies
Onyx One uses only the cookies needed to keep you signed in and keep the service secure. We do not use third-party advertising or cross-site tracking cookies.
13. Changes and contact
If we change this policy materially we will notify your account owner by email and in the app before the change takes effect. The version you accepted and when is recorded and available to you. Contact: support@onyx1.app, Onyx One Limited, New Zealand.