Privacy Policy

1. Who we are

Onym ("Onym", "we", "us") provides privacy-first identity infrastructure – we help businesses verify and communicate with people while holding as little personal data as possible. For the personal data we process about you, Onym is the data controller. You can reach us at privacy@onym.online.

2. The data we collect

• Account & identity data – your name, email address, and the credentials you use to sign in.
• Profile attributes – information you choose to add to your Onym profile, and any attributes verified for you (for example, that you are over 18).
• Activity & security data – sign-in events, the devices you use, and approximate location, which we use to keep your account secure and to show you who has accessed your data.
• Sharing & consent records – which businesses you’ve connected to and what you’ve allowed them to see.
• Communications – messages you send us (for example, support requests).

3. How we use your data – and our lawful bases

• To provide the service (performance of a contract) – creating and securing your account, verifying attributes, and sharing data only as you direct.
• To keep you and the platform safe (legitimate interests) – detecting and preventing fraud, abuse, and unauthorised access.
• To communicate with you (consent or legitimate interests) – service notifications, and marketing only where you’ve opted in.
• To meet legal obligations (legal obligation) – where the law requires us to retain or disclose certain information.

4. Our privacy-first approach

We design to hold less. Where we can, your data is encrypted so that it’s unreadable at rest, and certain documents can be protected with a key only you hold – meaning even Onym cannot read them. We don’t sell your personal data, and we never share it with a business unless you’ve consented to that specific sharing.

5. When we share data

• With businesses you connect to – only the specific attributes you have consented to share, for the purposes you allowed. You can review and revoke this at any time.
• With trusted service providers – who process data on our behalf (for example, cloud hosting and email delivery) under contracts that require them to protect it.
• Where the law requires it – to comply with a valid legal request, or to protect our rights, users, or the public.

6. International transfers

Your personal data is stored within the United Kingdom. Where any processing involves a transfer outside the UK, we put appropriate safeguards in place (such as approved transfer mechanisms) so that your data remains protected to UK standards.

7. How long we keep your data

We keep personal data only for as long as we need it to provide the service, meet legal obligations, and resolve disputes. When data is no longer needed, we delete or anonymise it. You can ask us to delete your account and associated data at any time (see your rights below).

8. Your rights

You have the right to:

• Access the personal data we hold about you – and download it through your dashboard.
• Correct data that is inaccurate or incomplete.
• Delete your data ("the right to be forgotten").
• Restrict or object to certain processing.
• Port your data – receive it in a structured, machine-readable format.
• Withdraw consent at any time, where we rely on it.

To exercise any of these, email privacy@onym.online. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

9. How we protect your data

We use encryption, strict access controls, multi-factor authentication, and continuous monitoring to protect your data. No system is ever perfectly secure, but security is core to what we build – not an afterthought.

10. Cookies

We use a single, strictly-necessary cookie – the one needed to keep you signed in. We set no advertising, analytics, or cross-site tracking cookies, no load-balancing or platform cookies, and we never share cookie data with anyone. In the spirit of the platform, here is exactly what we set:

• oneidentity_sso – keeps you securely signed in for your session, and remembers that you recently confirmed it’s you (step-up) so you aren’t challenged over and over. Set by Onym; it is HttpOnly (not readable by scripts), Secure (only sent over HTTPS) and SameSite=Lax (never sent on cross-site requests), and it expires after about 8 hours of inactivity.

Because this is essential to deliver a service you asked for, it doesn’t require consent under the ePrivacy rules – but we tell you anyway. If this ever changes, we’ll update this section and ask for your consent before setting anything non-essential.

11. Children

Onym is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we’ll remove it.

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we’ll update the date above and, where appropriate, let you know directly.

13. Contact us

Questions about this policy or your data? Email privacy@onym.online or info@onym.online.