Private beta status

Onoex LLC / document 2026.09.04

Privacy Notice

What Onoex LLC collects, why it is needed, where providers process it, how long it is kept, and how to exercise your rights.

Effective
September 4, 2026
Seller
Onoex LLC
Contact
support@kiweely.com

1. Who controls your data

Onoex LLC is the controller of personal data used to operate Kiweely accounts, billing, product access, support, security, and this website. Contact support@kiweely.com for privacy requests. This Notice does not govern Workday, Google, Auth0 during migration, Stripe, Resend, OpenAI/ChatGPT, or another service under its own notice.

2. Data we process

  • Account and identity: Google Identity Platform or transitional Auth0 subject, email/contact profile, linked provider, authentication/security events.
  • Commercial: Stripe customer/subscription/invoice references, plan state, exact dates, tax/billing country, refund/dispute status. Stripe—not Kiweely—handles full payment credentials.
  • Installation access: opaque installation ID, public-key digest, platform/OS/app version, authorization/check-in/lease dates, and sign-out events. We do not use a hardware fingerprint as an account identity.
  • Website security: opaque session, browser label, coarse location where available, timestamps, CSRF/rate-limit and audit events. Raw IP is not used alone to deny a trial.
  • Support: messages, diagnostic details you choose to send, and resolution history. Do not send passwords, OTPs, private keys, card details, or unnecessary tenant data.
  • Operations: redacted logs, correlation IDs, health/error/release/email-delivery events, and backup/recovery evidence.

The desktop app may process your local Customer Content and connected Workday/ChatGPT activity to provide requested functionality. Product-runtime authorization receives opaque account and entitlement references only—not email, Stripe, invoice, address, or card data.

3. Why we use it

  • perform the contract: authenticate, bill, deliver downloads/updates, and authorize your personal Mac installations;
  • protect legitimate interests: security, fraud/trial-abuse prevention, debugging, support, reliability, and business records;
  • comply with law: tax, accounting, sanctions, disputes, lawful requests, and consumer rights; and
  • obtain consent where required, including optional communications or non-essential technologies.

We do not sell personal data or use third-party behavioral advertising on the Kiweely website.

4. Sharing and subprocessors

We disclose data only to providers that operate the Service, professional advisers, authorities where legally required, or a successor in a legitimate business transaction subject to appropriate safeguards. Current providers and purposes are listed at Subprocessors. We do not give a subprocessor more data than its role requires.

5. United States processing and global transfers

Onoex LLC is in the United States. If you use Kiweely elsewhere, personal data may be transferred to and processed in the United States and other provider locations, which may have different privacy laws.

Where required, we rely on contractual safeguards, provider transfer mechanisms, adequacy decisions, or other lawful bases. Provider-specific locations and notices are linked from the subprocessor list.

6. Retention

  • Active account/subscription/installation records: while the account exists and as needed to operate it.
  • Web sessions/auth attempts/rate-limit detail: short operational periods; security/audit summaries may remain longer.
  • Permanent trial-eligibility history: retained in pseudonymized/HMAC form to enforce the one-trial rule.
  • Invoices, payments, refunds, disputes, and tax/accounting evidence: generally seven years or the period required by law.
  • Backups: expire on a rolling schedule; deletion propagates as backups age out unless legal/security preservation applies.
  • Support/security/audit records: for the issue lifecycle and a reasonable defense/compliance period.

We delete, aggregate, or de-identify data when its purpose and legal retention period end.

7. Your choices and rights

Depending on location, you may request access, correction, deletion, portability, restriction, objection, or appeal; withdraw consent; or complain to a regulator. See Data Rights for the authenticated process. We verify identity, respond within applicable time, and explain a lawful denial. You may use an authorized agent where law permits.

8. Security

Controls include external identity, PKCE, rotating credentials, opaque hashed sessions, CSRF/ Origin validation, one-use installation grants, signed bounded leases, encryption, least-privilege service identities, protected secrets, backups, audit logs, and signed/notarized releases. No system is perfectly secure. Report concerns at Security.

9. Children, changes, and contact

Kiweely is not directed to children and we do not knowingly collect data from anyone under 18. We update this Notice as the Service or law changes, identify the effective date, and provide material notice where required. Contact support@kiweely.com or 548 Market St, San Francisco, California 94104-5401.