Privacy Policy

1. Who we are

Onyx.AI (onyx-ai.eu) is a set of online tools for AI content creators, published by Jean Gayrard, entrepreneur individuel (EI), trading as Onyx-ai, SIRET 100 456 508 00025 (see section 1 of our Terms of Service), the controller of the data described here. This policy explains what data the Services process, why, and your rights. Contact: contact@onyx-ai.eu.

2. Data we process

• License key and sessions: your key, a session cookie, the IP address and browser of each session (to keep you signed in and to detect key sharing).
• Purchases: handled by Stripe. We receive your e-mail address, the product bought and the payment status — never your card details. Referral codes and credits are linked to your key.
• Your content: pictures, videos, audio, prompts and settings you upload, import or generate with the tools.
• Third-party keys: most of them (Kie.ai, WaveSpeed, AtlasCloud, Gemini, Grok, RunPod…) stay in your own browser and are sent directly from it to those providers. A few are kept on our server because the provider requires it or because you ask the server to work for you: your Higgsfield key, the keys you save for Automatic Pipeline server runs and the connection to your Higgsfield account. They are stored encrypted or with restricted access, never shown back in full, never logged, and deleted when you remove them.
• API tokens: if you create tokens for our public API, we keep a fingerprint of each token, its name and its use (calls, jobs, limits).
• Connected services (optional): Google Drive (section 3), the Telegram chats you connect to review Reels, and your Discord user id if you link Discord to get your member role.
• Instagram research: IG Niche Finder and Content Finder read public data of Instagram accounts and posts (user name, public profile figures, public Reels and their statistics) to show you niches and trending content.
• Community References: the videos imported from public Instagram posts and left shared, the link to the original post, the name of the account that published it, the member who imported it (never shown to other members) and its use. These videos can show identifiable people (section 4).
• Reports: when you report content, your name, e-mail address, IP address, the content concerned, your message, and the decision taken.

3. Google Drive

If you connect Google Drive, Onyx.AI asks for the drive.file permission only and your Google account e-mail address. With drive.file, Onyx.AI can only see and manage the files and folders it creates itself (the “Onyx.AI” folder and what is inside); it cannot read, list or change any other file in your Drive.

We use this access for one purpose: uploading the videos made by your Automatic Pipeline into your Drive, in folders named after your character and the date. The access token is stored encrypted on our server, is never shared, sold or used for advertising, and is not used to train AI models. You can disconnect at any time from the Automatic Pipeline (we then revoke the access at Google and delete it), or from your Google account permissions page.

Onyx.AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. People who appear in videos of Community References

Community References only contains videos that were publicly posted on Instagram and imported by members. If you appear in one of them, or you own the rights to it, you can ask us to remove it at any time, without having to give a reason for your own image: use the form at onyx-ai.eu/report or write to the contact address. The video is hidden at once while we check the request, then deleted and blocked so that it cannot be added again. Videos of the Bank are only visible to signed-in members, are not used to train AI models, and are deleted 30 days after their last use.

5. Why we use it (legal bases)

• To provide the Services you ask for, bill them and give you support: performance of the contract.
• To prevent fraud and key sharing, secure the Services, run Community References and our Instagram research tools: our legitimate interest, and that of members, in running a useful and secure service, balanced by the limits described in this policy and your right to object.
• To handle reports and keep a record of moderation decisions, to answer requests from authorities, and to meet accounting obligations: legal obligations.

6. Service providers and transfers

OVHcloud (servers in Canada), Cloudflare (file storage and license checks), Stripe (payments) and, only when you use them, Google, Telegram, Discord and the AI or data providers you choose (for example Higgsfield, Kie.ai, WaveSpeed, AtlasCloud, xAI, ElevenLabs, RunPod) and the data providers behind our Instagram research tools (HikerAPI, Apify, Bright Data). We do not sell personal data and do not use it for advertising.

Some of these providers process data outside the European Union. Canada benefits from an adequacy decision of the European Commission; transfers to the United States rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

7. How long we keep it

• Generated and downloaded files: 7 days.
• Videos of Community References: 30 days after their last use; hidden videos: deleted 7 days after being hidden unless restored. The fingerprint of a removed video is kept to stop it from being added again.
• Session data: up to 30 days.
• Telegram review items: 7 days. Keys and connections kept on our server: until you remove or disconnect them, or your license ends.
• Reports and moderation decisions: 3 years, to prove how they were handled.
• Purchase and billing records: as long as accounting law requires (10 years in France).

8. Your rights

Under the GDPR you can ask to access, correct or delete your data, object to or restrict its processing, and ask for a copy. Write to the contact address above; we answer within one month. You can also complain to the CNIL (cnil.fr).

9. Security

Traffic is encrypted (HTTPS), each member’s files are kept apart, keys and access tokens kept on our server are encrypted or stored with restricted access, and access to the administration is restricted.

10. Changes

We may update this policy. The date at the top shows the latest version; for material changes we inform members by e-mail or in the app.