Skip to main content

Privacy Policy

Last updated: November 2026

We take the protection of your personal data very seriously. This Privacy Policy explains what personal data we collect through our website onaihq.com (sections 1–10) and when you use the onAI service at app.onaihq.com (section 11), how we use it, and what rights you have under the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

1. Data Controller

The website onaihq.com is operated by:

Telesoft AG

Weisserlenweg 7
8966 Oberwil-Lieli
Switzerland

Email: hello@onaihq.com

2. Data We Collect

When you use our website, we may collect the following personal data:

  • Contact Form: name, email address, company, and your message
  • Calendly (demo scheduling): when booking a demo, personal details (e.g., name, email, availability) are collected by Calendly
  • Technical data: such as IP address, browser type, requested page, and date/time of access (processed by our hosting provider bunny.net to deliver the website; IP addresses in the access logs are anonymized)
  • Spam protection (Cloudflare Turnstile): when the contact form is displayed, Cloudflare Turnstile checks whether it is being used by a human; this processes technical data such as your IP address and browser characteristics
  • Website analytics (Plausible): we count page views with Plausible Analytics, which uses no cookies and stores no personal data; your IP address is only used to compute a daily changing, anonymous identifier and is then discarded
  • Fonts (Google Fonts): our pages load the Gantari font from Google's servers (fonts.googleapis.com, fonts.gstatic.com), which transmits your IP address to Google

We do not collect payment data via our website. Payments for the onAI service are handled by Creem, see section 11.

3. Purpose of Processing

We process your personal data for the following purposes:

  • Responding to your inquiries submitted via the contact form
  • Scheduling and organizing demo appointments via Calendly
  • Ensuring the secure and reliable operation of our website (via bunny.net)
  • Protecting the contact form against spam and abuse (via Cloudflare Turnstile)
  • Delivering contact form messages to our inbox (via Resend)
  • Understanding how our website is used, in aggregated form only (via Plausible)

We do not use your data for automated decision-making or profiling.

4. Legal Basis for Processing

We process your data on the following legal bases under the GDPR:

  • Article 6(1)(b) GDPR: to respond to your requests and provide our services
  • Article 6(1)(f) GDPR: our legitimate interest in ensuring the security and proper functioning of our website, protecting it against spam and abuse, measuring its reach anonymously, and displaying it consistently

5. Data Retention

  • Contact form inquiries: stored for up to 2 years
  • Technical logs (bunny.net): access logs with anonymized IP addresses, deleted automatically after 3 days
  • Contact form delivery (Resend): delivery records are kept by Resend for a limited period according to its retention policy
  • Calendly bookings: retained according to Calendly's privacy policy

Data will be deleted once it is no longer required for the purposes stated above.

6. Data Sharing and Third Parties

We share data only with trusted service providers necessary for operating our website:

  • Calendly, LLC (USA): for demo bookings. Data may be transferred outside the EU, with protection through Standard Contractual Clauses (SCCs).
  • BunnyWay d.o.o. (bunny.net), Slovenia (EU): hosting, content delivery, and processing of contact form and pricing estimator requests. Content is delivered from the bunny.net location closest to you; for visitors in Europe this is normally a European location.
  • Cloudflare, Inc. (USA): spam protection for the contact form (Turnstile). Data may be transferred to the USA.
  • Resend, Inc. (USA): delivery of contact form messages by email to us (name, email address, company, message). Data may be transferred to the USA.
  • Plausible Insights OÜ, Estonia (EU): cookie-free, anonymous website analytics.
  • Google Ireland Limited (Ireland/EU) and Google LLC (USA): delivery of web fonts (Google Fonts). Data may be transferred to the USA.

We do not sell or otherwise disclose your personal data to third parties for marketing purposes.

7. Data Security

Your data is transmitted using SSL encryption. We also rely on the security measures of our hosting provider (bunny.net) to protect your personal information from unauthorized access, disclosure, alteration, or destruction.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Access – to receive a copy of your data
  • Rectification – to correct inaccurate data
  • Erasure – to request deletion of your data
  • Restriction – to limit processing under certain conditions
  • Portability – to receive your data in a structured, machine-readable format
  • Objection – to object to processing based on legitimate interests

To exercise your rights, please contact us at hello@onaihq.com.

You also have the right to lodge a complaint with a supervisory authority if you believe your data is not being processed in compliance with GDPR.

9. International Data Transfers

Where data is transferred outside the EU/EEA and Switzerland (e.g., via Calendly, Cloudflare, Resend, or Google), we ensure adequate protection through EU Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU-U.S. Data Privacy Framework.

10. Cookies

Our website uses the following strictly necessary cookie:

  • Language preference cookie: stores your chosen language (English or German) to display the correct version of our site. This cookie is technically necessary for the multilingual functionality and expires after 3 months.

We do not use analytics, advertising, or tracking cookies.

11. The onAI Service (app.onaihq.com)

This section covers the hosted onAI service: the chat, Image Studio, the translator, connected sources such as Microsoft 365, and billing.

11.1 Our role

  • For company workspaces, the company is the controller of the content its users put into onAI. We process that content on its behalf as a processor under a data processing agreement, which companies can request at hello@onaihq.com. Please direct requests about company content to your company first.
  • For personal accounts, and for account, billing, security and support data in all cases, Telesoft AG is the controller.

11.2 Data we process

  • Account data: name, email address, sign-in method (email link, Google or Microsoft account identifiers), language and settings.
  • Workspace data: organisation name and domain, memberships, roles, licences and usage limits.
  • Content: your prompts, uploaded files, chat history, AI responses, generated and edited images, translations and documents, and audio when you use speech features.
  • Connected sources: when you connect Microsoft 365, account and directory identifiers, approved permissions, encrypted access tokens, and the items Microsoft returns for your requests. onAI searches Microsoft 365 live with your own permissions and does not build a separate index of your files.
  • Usage and billing data: which features and models were used, token and image counts, costs, licences, subscription status, and invoices and payment status that Creem reports to us. We do not receive your card details.
  • Technical and security data: IP address, browser, timestamps, error logs and, where enabled by your workspace, access audit records.

11.3 Purposes and legal bases

  • Providing the service and the features you use, managing your account and workspace, billing, and support (Art. 6(1)(b) GDPR, contract).
  • Security, preventing abuse, screening image prompts for content our Acceptable Use Policy prohibits, and fixing errors (Art. 6(1)(f) GDPR, legitimate interest).
  • Keeping accounting and tax records (Art. 6(1)(c) GDPR, legal obligation).
  • Company content: processing on the company's instructions (Art. 28 GDPR).

We do not sell your data, do not use your content to train AI models, and do not use the service for advertising, tracking or profiling. The service uses no analytics or advertising cookies.

11.4 Service providers

We pass data to these providers only as far as needed for the feature you use:

  • Hosting: the application and its database run on servers in Europe. Files and generated media are stored encrypted in OVHcloud Object Storage in Paris, France (OVH SAS, France).
  • AI models: your prompts and the content needed to answer them are sent to the AI model you or your workspace selected. Most models are reached through OpenRouter, Inc. (USA), which forwards each request to the model's provider, for example Mistral AI (France), OpenAI (USA), Anthropic (USA), Google (USA/Ireland) or Black Forest Labs (Germany). Some image models are called directly at OpenAI (USA). Workspace administrators decide which models are available.
  • Translation: DeepL SE (Germany) for the translator and its glossaries.
  • Web search: Kagi Inc. (USA) receives search queries when you or your workspace turn on web search.
  • Sign-in and Microsoft 365: Google and Microsoft when you sign in with them, and Microsoft when you connect Microsoft 365.
  • Payments and prompt screening: Creem, our reseller and Merchant of Record, processes payments, invoices and taxes and receives your billing details. Creem also checks every prompt for image generation against its content policy before an image is created; for this it receives the prompt text and a pseudonymous user ID.
  • Email: sign-in links and service notifications are sent from mail.onaihq.com through AhaSend, an email delivery provider that processes and stores message data in the EU.

11.5 Transfers outside Switzerland and the EU/EEA

Some providers above are based in the USA. Where data leaves Switzerland or the EU/EEA, we rely on adequacy decisions, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks where the provider is certified, or Standard Contractual Clauses. Company workspaces can restrict which models and features may receive their content.

11.6 Retention

  • Content stays in your account until you, or your workspace administrators, delete it, or until the account or workspace is closed. Deleted files can remain recoverable in storage for up to 30 days before they are removed permanently.
  • Disconnecting Microsoft 365 removes the stored connection and its tokens. Content already used in a chat stays in that chat until it is deleted.
  • Usage, billing and invoice records are kept for 10 years, as Swiss accounting law requires.
  • Technical and security logs are kept only as long as needed for operation and security.

11.7 Your rights

The rights in section 8 apply to the service as well. You can delete chats and files yourself in the app. For everything else, write to hello@onaihq.com. In Switzerland, you can complain to the Federal Data Protection and Information Commissioner (FDPIC).

12. Policy Updates

We may update this Privacy Policy from time to time, for example due to changes in our services or legal requirements. The updated version will always be published on this page.