Privacy Policy

This Privacy Policy explains how 1001525932 Ontario Inc., operating as Onyt ("Onyt," "we," "us," or "our"), collects, uses, shares, and protects personal information when you use our website at onyt.app, our web dashboard, and the Onyt mobile app for iOS and Android (together, the "Services").

Onyt is a business-management platform for mobile detailing businesses. It offers scheduling and calendar management, online booking pages, automated SMS messages to clients, job-time location sharing for team members, payment collection through Stripe Connect, before/after job photos, custom branding, client management (CRM), and revenue reporting.

This policy covers business owners and their team members who use Onyt ("Operators" and "Authorized Users"). It also covers the end customers of those businesses who book, pay, or message through Onyt ("End Customers"); see Section 4. If you do not agree with this policy, please do not use the Services. Questions: admin@onyt.app.

• We collect the information needed to run your account and your business’s workspace, including contact details, bookings, client records, job photos, and payment records.
• We do not sell personal information. We do not use it for targeted advertising in our mobile app, and the app does not track you across other companies’ apps or websites.
• The Onyt mobile app does not collect your location. Team members’ location is shared only from the Onyt web dashboard, during an active job, after they consent.
• We do not process sensitive personal information such as health, biometric, or government-ID data.
• You can delete your account at any time from inside the app or the web dashboard.

Information you give us

• Account details: name, email address, phone number, password (stored only as a secure hash by our authentication provider), and your role (owner or team member).
• Business details: business name, logo and branding, service area, services, add-ons, pricing, working hours, and booking-page settings.
• Client and job records you enter: your clients’ names, phone numbers, email addresses, service addresses, vehicle details, booking history, notes, quotes, and invoices.
• Photos: before/after job photos you choose to take or upload.
• Support and feedback: anything you send us when you contact us.

Sign in with Apple and Google

If you sign in with Apple or Google, we receive your name and email address from that provider. With Apple, this may be a private relay address if you choose "Hide My Email." We never receive your Apple or Google password.

Payment information

Onyt subscriptions are billed either by Apple through the App Store (on iOS) or by Stripe (on the web). Payments your clients make to your business are processed by Stripe through your connected Stripe account. We never see or store full card numbers or security codes; Apple and Stripe handle them directly. We receive only limited records such as subscription status, transaction IDs, amounts, and dates. See Stripe's privacy policy.

Location data

If a business turns on job tracking and you, as a team member, agree to it on the consent screen, Onyt collects your precise location from the Onyt web dashboard open in your browser. Location is collected only while a job is in progress, starting at most about one hour before the scheduled start. It stops when the job is completed, or after 12 hours at most. It is shown to the business so it can see job progress and estimated arrival times.

Location is never collected in the background, outside of active jobs, or from the Onyt mobile app. The mobile app only displays locations that were already shared from the dashboard. You can withdraw consent at any time in Settings → Location Tracking, or turn off location access for your browser in your device settings.

Device permissions (mobile app)

• Camera: to take before/after job photos, only when you open the camera.
• Notifications: to send you booking and account alerts. We store a push token for your device so notifications can be delivered.

The mobile app does not access your contacts, microphone, calendar, call log, SMS messages, Bluetooth, or location. You can change permissions at any time in your device settings.

Information collected automatically

• Diagnostics (mobile app): crash reports and error details, such as device model, OS version, app version, and a stack trace, collected through Sentry. These reports are not linked to your name or email address.
• Website analytics: on our website only, we use Google Analytics to understand how visitors use onyt.app, for example pages viewed and referral source. See our Cookie Policy.
• Server logs: IP address, browser type, and timestamps, which our hosting and database providers log for security and reliability.

When someone books through a business's Onyt booking page, receives a quote or invoice, pays a deposit, or exchanges text messages with a business, we process the information they submit, such as name, phone number, email, service address, vehicle details, and messages, on behalf of that business. For this information the business is responsible for how it is used (it acts as the "controller"), and Onyt acts as its service provider ("processor"). If you are an End Customer, contact the business you booked with about your information. We will help them respond to your request.

• To create and manage accounts and authenticate users.
• To provide the Services: scheduling, booking pages, reminders, quotes and invoices, payments, photos, team management, and reporting.
• To send transactional messages, such as booking confirmations, reminders, receipts, and account and security notices, by email, SMS, and push notification.
• To process and verify subscriptions and payments.
• To provide support and respond to your requests.
• To keep the Services secure, including fraud prevention and abuse detection.
• To fix bugs and improve the Services, using diagnostics and aggregated, de-identified usage information.
• To send you product updates or offers about Onyt, only where you have agreed or where the law allows. You can opt out at any time.
• To comply with legal obligations and enforce our Terms of Service.

Canada: we process personal information with your express or implied consent, as permitted by the Personal Information Protection and Electronic Documents Act (PIPEDA). We may also process it without consent where the law allows, for example to investigate fraud, to comply with a subpoena or court order, or where the information is publicly available as defined by regulation. You can withdraw consent at any time (see Section 11), subject to legal or contractual limits.

EU/UK: we rely on performance of a contract (to provide the Services), legitimate interests (security, fraud prevention, and improving the Services, where those interests are not overridden by your rights), consent (for example, job-time location sharing and non-essential website cookies), and legal obligations.

We share personal information only with the service providers ("subprocessors") that help us run Onyt. Each receives only what it needs and is contractually required to protect it:

• Supabase: database, authentication (including account emails), and file storage.
• Vercel: website and web application hosting.
• Stripe: subscription billing (web) and payment processing for businesses’ clients.
• Apple: Sign in with Apple and App Store in-app purchases (iOS).
• Google: Google Sign-In, and Google Analytics on our website only.
• Twilio: delivery of SMS text messages.
• Expo: delivery of push notifications to your device.
• Sentry: mobile app crash and error reporting.
• Map tile providers (OpenStreetMap on the web; Apple Maps on iOS; Google Maps on Android): these receive your IP address and the map area being viewed when a map is displayed.

We may also share information:

• Within your business: information in a business’s workspace is visible to that business’s owner and, depending on role, its team members.
• With End Customers: your business name, branding, services, and available times appear on your public booking page.
• For legal reasons: when required by law, or to protect the rights, safety, or property of Onyt, our users, or others.
• In a business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. No mobile information, including SMS opt-in data and consent, will be shared with third parties or affiliates for their marketing or promotional purposes.

Onyt does not currently send your personal information, or your clients' personal information, to third-party artificial intelligence services. If we add a feature that does, we will update this policy first. We will clearly tell you what data is shared and with whom, and we will ask for your explicit permission before any data is shared.

Our website uses strictly necessary cookies (for example, to keep you signed in to the dashboard). With your consent, it also uses Google Analytics cookies. You can accept or reject analytics cookies in the cookie banner, and change your choice at any time using "Cookie preferences" in the site footer. See our Cookie Policy for details.

The Onyt mobile app contains no advertising. It does not use advertising identifiers (IDFA/AAID), and it does not track you across apps or websites owned by other companies.

Our website does not currently respond to browser "Do Not Track" signals, because there is no agreed standard for them.

We keep personal information for as long as your account is active and as needed to provide the Services. When you delete your account, we delete your personal information from our active systems right away. Residual copies in backups are removed within six (6) months. We may keep limited records longer where the law requires it, for example tax and accounting records, or where needed to prevent fraud or resolve disputes.

Delete your account

You can permanently delete your account at any time. In the mobile app, go to Settings → Account & Profile → Delete Account. On the web, go to Settings → Account Settings → Delete Account. Deleting an owner account deletes the entire business workspace, including client, booking, and photo records. Deleting a team member account removes only that person's login and profile. Deletion cannot be undone. Deleting your account does not cancel a subscription bought through the App Store; cancel it in your device's Settings → [your name] → Subscriptions to stop future charges.

Access, correction, and other rights

Depending on where you live (including Canada, the EEA, the UK, Switzerland, and several US states), you may have the right to:

• Access your personal information and get a copy of it.
• Correct inaccurate information.
• Delete your information.
• Receive your information in a portable format.
• Restrict or object to certain processing.
• Withdraw consent at any time. This doesn’t affect processing that happened before you withdrew.
• Not be discriminated against for exercising these rights.

You can update most account information directly in the app. For anything else, submit a data subject access request or email admin@onyt.app. We may need to verify your identity before acting on a request. You may use an authorized agent where the law allows. We will respond within the time the law requires, and in any case within 30 days.

Marketing messages

You can unsubscribe from marketing emails using the link in the email. You can stop SMS messages by replying STOP. We will still send messages that are necessary to run your account.

Complaints

If you're not satisfied with our response, you can complain to your local data protection authority. That includes the Office of the Privacy Commissioner of Canada (priv.gc.ca), your EU member-state authority, the UK Information Commissioner's Office (ico.org.uk), or the Swiss Federal Data Protection and Information Commissioner.

If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia, or Texas, you have the rights described in Section 11. The table below shows the categories of personal information we have collected in the past 12 months. We keep each category for as long as the account exists, subject to Section 10.

In the past 12 months we have disclosed categories A, B, D, F, G, H, and I to the service providers listed in Section 7, for business purposes only. We have not sold or "shared" personal information (as those terms are defined under California law), and we do not knowingly sell the personal information of anyone under 16. If we decline your request, you may appeal by emailing admin@onyt.app. If the appeal is denied, you may contact your state attorney general.

California's "Shine the Light" law (Civ. Code § 1798.83) lets California residents ask, once a year, which personal information we disclosed to third parties for their direct marketing. We do not disclose personal information for that purpose.

We use administrative, technical, and physical safeguards to protect personal information. These include encryption in transit, encryption at rest through our infrastructure providers, and database-level access controls that isolate each business's data from other businesses. No system is completely secure, so we cannot guarantee absolute security. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.

Onyt is based in Canada. Our service providers may store and process information in Canada, the United States, and other countries where they operate. Wherever your information is processed, we protect it as described in this policy. Where the law requires it, we use appropriate safeguards such as standard contractual clauses.

Onyt is a business tool for people aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. Contact admin@onyt.app if you believe a minor has given us personal information.

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. For material changes, we will also notify you by email or in the app before they take effect.

Questions or requests about this policy, including for our privacy officer, can go to admin@onyt.app. You can also write to us or call:

1001525932 Ontario Inc. (Onyt)
7266 Black Walnut Trail
Mississauga, Ontario L5N 7M6
Canada
Phone: +1 (647) 969-7233