Onyx Insights Privacy Policy

Effective October 20, 2026

This Privacy Policy explains how OnyxNexus Cloud & AI, a division of OnyxNexus Technologies Ltd ("OnyxNexus", "we", "us"), established in Ghana, handles personal data in connection with Onyx Insights, our observability and log analytics service at onyxinsights.global and <workspace>.onyxinsights.global (the "Service"), our documentation site docs.onyxinsights.global, and our emails.

1. Our two roles

• OnyxNexus as controller. We decide how to use the personal data we collect to run our business: account and sign-in details of the people who use the Service, billing contacts, support conversations, website visits, and security and usage logs about the Service. This policy mainly covers that data.
• OnyxNexus as processor. Our customers send us telemetry data (logs, metrics, traces and real user monitoring, or "RUM", data), upload log files, and connect other tools. That data may contain personal data, for example user IDs, email addresses or IP addresses in log lines, or data about visitors to a customer's website collected by RUM. For this data our customer is the controller and OnyxNexus is its processor. We process it only on the customer's instructions, under our Terms of Service, which set out our commitments as a processor. If your data is in a customer's telemetry and you want to exercise your privacy rights, please contact that customer. We will help them respond.

2. Personal data we collect as controller

Account and profile data. When you sign up or are invited, we collect your name (display name), work email address, password (stored only as a salted hash), your organization name, industry and workspace name, and your role in the workspace (viewer or admin).

Google sign-in. If you choose to sign in with Google, we receive your Google account identifier, email address, whether Google has verified that email, and your name, as permitted by your Google settings. We do not receive your Google password. Sign-in with Microsoft is not currently offered.

Single sign-on through your organization. If your organization signs you in with its own identity provider (OIDC or SAML), we receive the identifier, email address and name that provider sends us. An email address asserted by your organization's identity provider counts as verified.

Verification and security data. Email verification and invitation status (accepting a workspace invitation confirms your email address), password reset requests, multi-factor authentication settings (an encrypted authenticator secret, hashed recovery codes and one-time email codes), sign-in attempts, session records, and the IP address and browser details of requests to the Service.

Audit records. The Service keeps an audit log of significant actions in a workspace, such as sign-ins, invitations, role changes, token creation and revocation, configuration changes and approvals of AI-proposed actions, with the acting user, time and details of the action.

API and ingest tokens. Token names, scopes, creation and expiry dates, and last use. We store only a hash of each token's secret.

Billing data. If you buy a paid plan, our payment processors Stripe and Paystack collect your payment card and billing details on a page hosted by Stripe or Paystack. To start checkout we pass your account email address to Stripe or Paystack. We keep your Stripe or Paystack customer and subscription identifiers, plan and subscription status. We do not receive or store full card numbers.

Communications. Messages you send to our support or sales teams, and records of the service emails we send to you.

Service usage data. Information about how the Service is used, such as data volumes, request counts, feature use, errors and performance, which we use to run, secure and bill for the Service. Our own self-monitoring of the Service is filtered so that request bodies, headers, customer payloads, credentials and similar content are dropped before it is stored.

Website visits. When you visit onyxinsights.global or our documentation site, our servers receive standard request data (IP address, browser user agent, pages requested, and time).

3. Telemetry data we process as processor

On our customers' behalf we receive, store, index, analyze and display:

• logs, metrics and traces sent with OpenTelemetry (OTLP over HTTP or gRPC) or other supported ingestion methods;
• where offered, RUM data from customers' websites and apps, which may include page views, performance timings, errors, and browser and device information about the customer's end users, depending on how the customer configures it;
• log files uploaded by workspace administrators;
• data retrieved from third-party accounts the customer connects (for example cloud provider monitoring data or data from other observability tools); and
• dashboards, queries, alert rules, incidents, investigations, notes and questions put to our AI features.

Built-in data minimization. Before telemetry is stored, the Service automatically masks attribute values whose names suggest credentials (such as authorization, cookie, password, token, API key, JWT, session or secret) and values shaped like payment card numbers, and masks Bearer/Basic credentials and card-number-shaped strings inside message text. Workspace administrators can add processing rules to mask text with their own patterns, drop matching log lines before they are stored, or add tags and attributes. These protections reduce risk but cannot catch everything, so customers should avoid sending sensitive personal data.

4. How we use personal data and our legal bases

If you are in the European Economic Area (EEA) or the United Kingdom, we must have a legal basis for using your personal data. As controller, we rely on the following:

Where we rely on legitimate interests, we have balanced those interests against your rights. You can object (see Section 10). We do not use automated decision-making that produces legal or similarly significant effects on you.

5. AI features

The Service includes several analysis features:

• Onyx Oracle ("Ask Onyx Oracle"). When a workspace is created, we give OnyxNexus's AI platform a read-only access token for that workspace, so that it can read the workspace's telemetry and a limited set of workspace records (incidents, findings, SLOs, services and service relationships) when it investigates. When a signed-in workspace member asks a question, the Service sends the AI platform the question, workspace identifiers, the asking user's internal ID, the plan and conversation identifiers; the AI platform then reads the data it needs using that token. When a critical incident opens an investigation, the Service may start an AI investigation automatically and send the AI platform the incident's title and service. The workspace records provided to the AI platform exclude connector credentials and alert-channel destinations. The AI platform is hosted on AWS in the US West (Oregon) region and uses third-party AI model providers acting as our sub-processors to generate answers. The conversation shown in your browser is temporary. The AI platform stores records of each investigation (evidence and answers).
• AIOps analysis, root cause analysis, the AI Payment Analyst, and in-product explanations. These features compute findings from the workspace's own telemetry using defined statistical rules inside the Service. They do not send data to an external AI model.

No model training. We do not use customer telemetry, questions or AI outputs to train AI models, and the AI Analyst does not learn from your data on its own.

AI outputs can be wrong. They never make decisions about individuals. Any action the AI Analyst proposes takes effect only if a person in the workspace approves it.

6. Cookies and similar technologies

We use only cookies and browser storage that are needed for the Service to work or to remember your preferences. The Service does not set advertising or analytics cookies.

Cookies (all set by onyxinsights.global or your workspace address, HttpOnly, and sent only over HTTPS in production):

Browser storage (kept on your device only, not sent to us automatically): your chosen display time zone (onyx-time-zone), time range (onyx-time-range), navigation layout (onyx-nav-groups), whether sample-data previews are on (onyx.samplePreview.*), the AI panel's Enter-to-send setting (onyx.ai.enterToSend), onboarding checklist progress, and a per-tab marker that prevents repeated redirects to your workspace address (session storage).

You can block or delete cookies in your browser settings, but the Service will not work without the strictly necessary cookies.

7. Who we share personal data with

We do not sell personal data, and we do not share it for cross-context behavioral advertising.

We share personal data only with the following:

Sub-processors and service providers that help us run the Service, under contracts that require them to protect the data and use it only to provide their services to us:

We will tell customers before we add or replace a sub-processor that processes customer data.

At your direction. When your organization connects a third-party tool or sends alerts to Slack, webhooks or email addresses it configures, we send data to those destinations on its instruction. Those recipients handle the data under their own terms.

Within your organization. Workspace administrators can see the members of their workspace, their roles and the audit log.

Legal and safety reasons. We may disclose information if required by law, regulation, legal process or a valid government request; to protect the rights, property or safety of OnyxNexus, our customers or others; or to enforce our agreements. Where allowed, we will tell the affected customer first.

Business transfers. If OnyxNexus is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

8. International data transfers

Onyx Insights is hosted in the United States: our application runs in AWS US West (Oregon), and telemetry is stored in ClickHouse Cloud on AWS US East (Ohio). Web content may be delivered through AWS CloudFront edge locations worldwide. OnyxNexus is established in Ghana, and our personnel may access data from Ghana to provide support and operate the Service. Our other service providers listed in Section 7 may process data in other countries. If you are in the EEA, the UK or Switzerland, your personal data will therefore be transferred to the United States and Ghana, which may not have data protection laws equivalent to yours.

Where we transfer personal data out of the EEA, UK or Switzerland, OnyxNexus commits to using the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum or Swiss equivalents where needed), or another lawful transfer mechanism, together with supplementary measures such as encryption in transit and access controls. For customer telemetry, the same commitment is part of our Terms of Service. You can ask us about these safeguards using the contact details below.

Ghana. As an organization established in Ghana, OnyxNexus processes personal data in accordance with Ghana's Data Protection Act, 2012 (Act 843), which is overseen by the Data Protection Commission of Ghana.

9. How long we keep personal data

We keep personal data only as long as we need it for the purposes in this policy. In particular:

10. Your rights

EEA and UK residents. Under the GDPR and UK GDPR you have the right to: access your personal data; correct inaccurate data; have your data deleted; restrict or object to our processing (including processing based on legitimate interests and any direct marketing); receive your data in a portable format; and withdraw consent at any time where we rely on consent, without affecting earlier processing. You also have the right to complain to your local data protection authority, for example the authority in your EU member state or the UK Information Commissioner's Office. To exercise these rights, contact privacy@onyxinsights.global.

Ghana. Under the Data Protection Act, 2012 (Act 843), you can ask for access to your personal data, ask us to correct or delete it, and object to certain processing. You can also complain to the Data Protection Commission of Ghana.

California residents. Under the California Consumer Privacy Act, as amended (CCPA), you have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information other than for the purposes the CCPA permits. In the last 12 months we have collected the categories described in Section 2: identifiers (such as name, email and IP address), commercial information (plan and billing records), internet or network activity (Service usage and security logs), and professional information (organization and role). We collect them from you, from your organization, from Google if you use Google sign-in, and from our payment processor, for the business purposes in Section 4, and we disclose them to the service providers listed in Section 7. We will not discriminate against you for exercising your rights. You may use an authorized agent, and we will verify requests by confirming control of the account email address.

How to make a request. Email privacy@onyxinsights.global. We will respond within the time the law requires (generally one month under the GDPR and 45 days under the CCPA). If your request concerns telemetry that a customer sent to us, we will refer you to that customer or help them respond.

11. Security

We protect personal data with technical and organizational measures, including: HTTPS/TLS encryption in transit for the web application, APIs and ingestion; salted password hashing; optional multi-factor authentication; sign-in attempt limits; hashed API tokens; AES-256-GCM encryption of stored integration credentials, authenticator secrets and AI connection keys; production secrets kept in a managed secrets service; workspace-level data separation with tenant-scoped access and workspace-bound tokens; role-based access; audit logging; and the telemetry masking described in Section 3. No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires. OnyxNexus does not claim any third-party security certification.

12. Children

The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18, and users of the Service must be at least 18. If you believe a child has given us personal data, contact us and we will delete it. Customers must not use the Service to send us children's personal data unless they have a lawful basis for doing so and we have agreed in writing.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify workspace administrators by email or in the Service before the changes take effect. The "Effective" date at the top shows the latest version.

14. Contact us

OnyxNexus Cloud & AI, a division of OnyxNexus Technologies Ltd (Ghana)

• Privacy questions and data requests: privacy@onyxinsights.global
• Legal notices: legal@onyxinsights.global
• General support and security reports: support@onyxinsights.global
• Website: https://onyxinsights.global