Privacy Policy

Effective date: August 6, 2026 · Last updated: August 6, 2026

The short version

We collect what we need to run Onnie — no more. Your workspace content is yours; we don't read it to serve ads or sell it to anyone. We do not operate foundation models and we do not train models on your Customer Content. Payments are handled by Dodo Payments, our merchant of record — we never store your card details. Named infrastructure and AI partners are listed on our Sub-processors page. If you want to know what we hold about you, or want it deleted, write us at legal@onnie.ai.

1. Who we are

Heizen Tecnologia Ltda. ("Heizen", "we", "us", or "our") is a Brazilian company (CNPJ 47.624.793/0001-83) operating Onnie — an AI-powered workspace platform at onnie.ai. When this policy says "we" or "Onnie," it means Heizen acting through the Onnie platform.

2. What this policy covers

This policy applies to:

visitors to our website (onnie.ai and related pages)
people who create or use an Onnie account or workspace
workspace members who are invited by an account holder

It does not cover third-party websites or services you may reach through links inside Onnie, or third-party services you connect as connectors (those services have their own policies).

3. Two roles we play

Our platform is designed for individuals and organizations managing their own workspace. Depending on your relationship with Onnie:

For account and billing data (your name, email, subscription status, support communications) — Heizen acts as the data controller: we decide how and why this data is processed.
For Customer Content (the records, tasks, pages, files, chats, agent configurations, connector settings, and other data you put into your workspace) — Heizen acts as a data processor / service provider on behalf of you or your organization. We process Customer Content only to deliver the service you asked for.

4. What we collect

4.1 Information you give us

Account data: name, email address, authentication identifiers, workspace role, and related profile fields you provide.
Account authentication: Onnie account access uses email-based credentials (for example email and password or email-based authentication flows we support). We do not currently offer Sign in with Google or other social login for account authentication.
Workspace content (Customer Content): everything you create, upload, or store inside a workspace — including chats, Work items, knowledge and artifacts (such as pages and tables), files, agent and routine configurations, connector configuration, and related content.
Support and communications: messages you send us, feedback, and support requests.
Billing contact info: the email and name used for invoicing. Payment details (card numbers, etc.) are handled exclusively by Dodo Payments, our merchant of record — we never receive or store full card numbers.

4.2 Information collected automatically

Usage data: which features you use, how often, and how you interact with them (including capacity and billing-relevant usage metrics).
Technical data: IP address, browser type, device identifiers, operating system, language preference, and timestamps.
Logs and diagnostics: error reports and performance metrics used to keep the service running reliably.

4.3 Cookies and similar technologies

We use cookies, local storage, and similar technologies for authentication, session management, preferences, analytics, and (on our marketing site) marketing measurement. See Section 14.

4.4 Information from third parties

If you are invited to a workspace, the person who invited you provided your email address.
If you enable a connector (for example Google Workspace tools or Notion), we receive data and tokens from that provider as needed to run the connection you requested. Connector OAuth is not account login — you connect after you already have an Onnie account.

5. How we use your information

We use the information we collect to:

Run Onnie — create accounts, authenticate users, enable collaboration, run agents and routines, power connectors and tools you enable, and deliver workspace features.
Keep the service secure — detect and prevent abuse, fraud, unauthorized access, and misuse.
Improve the product — understand how features are used, identify bugs, and test improvements (using aggregated or operational signals where practical).
Handle billing — enforce plan limits, track usage for extended usage billing, and coordinate payments with Dodo Payments.
Communicate with you — send service notifications, security alerts, billing receipts, and support responses. We may send optional product updates; you can opt out of non-essential marketing messages.
Comply with law — respond to lawful requests, enforce our policies, and meet our legal obligations.

AI and training: Heizen does not operate foundation models of our own, and we do not train models on your Customer Content. When you use AI features, content is sent to underlying model providers so they can generate the output you requested and so we can operate the service (including routing, safety, and reliability). See Section 8 and our Sub-processors list.

6. Legal bases for processing

Where applicable (including under Brazil's LGPD and the EU's GDPR):

Contract: to provide the service you subscribed to or requested.
Legitimate interests: to secure and improve Onnie, and to operate our business — balanced against your rights.
Consent: for non-essential cookies and optional marketing communications where required.
Legal obligation: to comply with applicable law and lawful requests.

7. Who we share your information with

We do not sell personal data. We share it only in the following categories. The living, named inventory of sub-processors is published on our Sub-processors page.

Dodo Payments — our merchant of record processes subscription payments and extended usage billing on our behalf.
AI model providers — when you use Onnie's AI features, inputs needed to generate outputs are sent to model providers under their terms and our operational controls.
Infrastructure and operations — hosting, database, edge compute, object storage, email delivery, monitoring, and related tooling.
Connectors and tools you enable — when you connect a third-party service or use a tool integration, relevant content and credentials/tokens may flow to that provider according to your configuration.
Legal and safety — if we believe in good faith that disclosure is necessary to comply with law or legal process, protect our users or the public, or enforce our policies.
Business transfers — if Heizen is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, with appropriate notice and safeguards.

8. AI features and your content

When you use Onnie's AI features — including the Onnie agent, custom agents (Onniebots), Routines, and related AI surfaces — content you provide (and context selected by workspace configuration and permissions) is processed to generate the output you requested and to maintain security and reliability of the service.

Workspace owners and admins control what data can flow into AI features through configuration, roles, and permissions.
AI-generated outputs may be saved into your workspace if you or your automations store them.
Outputs may be inaccurate, incomplete, or unsuitable — you remain responsible for reviewing them before relying on them, especially in high-stakes contexts.
Underlying model providers process data subject to their own terms and privacy policies. We select and configure providers as part of delivering the service; we do not promise that every provider's training practices match ours. See Sub-processors.

9. Data retention

We keep personal data for as long as necessary to:

provide the service and manage your account
meet legal, accounting, or regulatory obligations
resolve disputes and enforce our agreements

Workspace content is retained while your workspace is active. You may delete content within your workspace at any time (subject to your role and workspace policies). On account or workspace closure, we delete or anonymize personal data within a reasonable period, subject to legal hold or retention requirements.

10. Security

We apply administrative, technical, and organizational measures designed to protect your data against unauthorized access, alteration, loss, or disclosure. No security measure is perfect; we cannot guarantee absolute security. Protect your credentials and account access.

11. International transfers

Heizen is based in Brazil. We may process and store data on servers located in other countries. When we transfer personal data internationally, we use contractual protections and, where applicable, mechanisms recognized under Brazilian law and equivalent frameworks (such as standard contractual clauses for EU/UK data).

12. Your rights

Depending on your location, you have rights regarding your personal data. Under Brazil's LGPD — and under equivalent frameworks in the EEA, UK, and other jurisdictions — these typically include:

Access — confirm whether we hold data about you and receive a copy.
Correction — fix inaccurate or incomplete data.
Deletion — ask us to delete your data (subject to legal retention requirements).
Portability — receive your data in a structured, machine-readable format where applicable.
Objection or restriction — object to or restrict certain types of processing.
Consent withdrawal — withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email legal@onnie.ai. We may verify your identity before acting. If your data is managed by a workspace owner (for example your employer), you may need to contact them first for workspace-level Customer Content.

13. Children's privacy

Onnie is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with data, contact legal@onnie.ai and we will delete it.

14. Cookies

We use cookies and similar technologies in these categories:

Essential — authentication, session security, load balancing, and core functionality. These cannot be disabled without breaking the service.
Preferences — remembering settings such as theme or locale-related preferences.
Analytics — aggregate measurement of how Onnie (including the marketing site) is used, to improve the product and site.
Marketing — on our marketing site, measurement and advertising tags may be used to understand campaigns and conversions. Third-party tags may set their own cookies under their policies.

You can control non-essential cookies through your browser settings. Disabling essential cookies will affect your ability to use the service. We may add a consent banner or preference center later; until then, browser controls are the primary control surface for non-essential cookies.

15. Changes to this policy

We may update this policy as our practices evolve. If changes are material, we will post the updated policy with a new "Last updated" date and, where required by law, notify you through the product or by email. Continuing to use Onnie after the effective date means you accept the updated policy where permitted by law.

16. Contact us

Email: legal@onnie.ai
Company: Heizen Tecnologia Ltda. · CNPJ 47.624.793/0001-83
Address: Av. Brig. Faria Lima 1811, Office 1119 · São Paulo, SP · 01452001 · Brazil