Download

Customer document

Privacy notice

What OnoeX LLC collects, why it is needed, where providers process it, how long it is kept, and how to exercise your rights.

Effective
October 13, 2026
Version
2026.10.13
Seller
OnoeX LLC
Contact
support@kiweely.com

1. Who controls your data

OnoeX LLC is the controller of personal data used to operate kiweely accounts, product access, support, security, and this website. Contact support@kiweely.com for privacy requests. This Notice does not govern Workday, Google, OpenAI/ChatGPT, Anthropic/Claude, or another service under its own notice.

2. Data we process

  • Account and identity: Google Identity Platform subject, email/contact profile, linked provider, authentication/security events.
  • Installation access: opaque installation ID, public-key digest, platform/OS/app version, authorization/check-in/lease dates, and sign-out events. We do not use a hardware fingerprint as an account identity.
  • Website security: opaque session, browser label, coarse location where available, timestamps, CSRF/rate-limit and audit events.
  • Support: messages, the crash and problem reports you choose to send from the app (what failed, the app version and your computer's system version, an optional screenshot, and the redacted app log when you include it), diagnostic details you choose to send, and resolution history. Automatic crash reports, if you turn them on, carry no account link. Do not send passwords, OTPs, private keys, or unnecessary tenant data.
  • Operations: redacted logs, correlation IDs, health/error/release events, and backup/recovery evidence.

The desktop app may process your local Customer Content and connected Workday, ChatGPT, or Claude activity to provide requested functionality. Product-runtime authorization receives opaque account and entitlement references only—not email or your identity-provider profile.

3. Why we use it

  • perform the contract: authenticate, deliver downloads/updates, and authorize your personal computer installations;
  • protect legitimate interests: security, fraud prevention, debugging, support, reliability, and business records;
  • comply with law: sanctions, disputes, lawful requests, and consumer rights; and
  • obtain consent where required, including optional communications or non-essential technologies.

We do not sell personal data or use third-party behavioral advertising on the kiweely website.

4. Sharing and subprocessors

We disclose data only to providers that operate the Service, professional advisers, authorities where legally required, or a successor in a legitimate business transaction subject to appropriate safeguards. Current providers and purposes are listed at Subprocessors. We do not give a subprocessor more data than its role requires.

5. United States processing and global transfers

OnoeX LLC is in the United States. If you use kiweely elsewhere, personal data may be transferred to and processed in the United States and other provider locations, which may have different privacy laws.

Where required, we rely on contractual safeguards, provider transfer mechanisms, adequacy decisions, or other lawful bases. Provider-specific locations and notices are linked from the subprocessor list.

6. Retention

  • Active account/installation records: while the account exists and as needed to operate it.
  • Web sessions/auth attempts/rate-limit detail: short operational periods; security/audit summaries may remain longer.
  • Backups: expire on a rolling schedule; deletion propagates as backups age out unless legal/security preservation applies.
  • Support/security/audit records: for the issue lifecycle and a reasonable defense/compliance period.

We delete, aggregate, or de-identify data when its purpose and legal retention period end.

7. Your choices and rights

Depending on location, you may request access, correction, deletion, portability, restriction, objection, or appeal; withdraw consent; or complain to a regulator. See data rights for the authenticated process. We verify identity, respond within applicable time, and explain a lawful denial. You may use an authorized agent where law permits.

8. Security

Controls include external identity, PKCE, rotating credentials, opaque hashed sessions, CSRF/ Origin validation, one-use installation grants, signed bounded leases, encryption, least-privilege service identities, protected secrets, backups, audit logs, and signed releases (notarized on Mac, Authenticode-signed on Windows). No system is perfectly secure. Report concerns to support@kiweely.com.

9. Children, changes, and contact

kiweely is not directed to children and we do not knowingly collect data from anyone under 18. We update this Notice as the Service or law changes, identify the effective date, and provide material notice where required. Contact support@kiweely.com or 548 Market Street #630378, San Francisco, CA 94104, United States.