Privacy Policy
How Onbixo collects, uses, and protects personal data - your account data, and your end users' onboarding data.
17 August 2026 · InkWired Technologies Pvt. Ltd.
1. Who we are
Onbixo is operated by InkWired Technologies Pvt. Ltd., a company registered in India.
- Address: C-101, Mahesh Nagar, Jaipur, Rajasthan, Pin Code - 302015, India
- Email: [email protected]
- Product: Onbixo - a no-code product-onboarding toolkit (guided tours, tooltips, checklists, a resource center, announcements, and surveys)
When we say "we", "us", or "our", we mean InkWired Technologies Pvt. Ltd.. When we say "you" or "your", we mean you as a customer of Onbixo. "End users" means the people who use your app, to whom you show Onbixo flows.
2. Controller and processor
Onbixo handles two different kinds of personal data, and our role differs for each:
- Your account data - we are the controller. The data you give us to run your Onbixo account (your name, email, workspace, billing) is data we decide how to use, so we are the data controller. This policy governs it.
- Your end users' data - we are the processor. When our runtime shows your flows to your users and sends back onboarding analytics, we process that data on your behalf and under your instructions. You are the controller of it; we are your processor. That relationship is governed by our Data Processing Agreement.
3. Data we collect (about you, our customer)
Account information
When you create an account, we collect:
- Name - your display name
- Email address - used for login, notifications, and account recovery
- Password - securely hashed with a one-way algorithm (we never store your plain-text password)
- Workspace & team data - workspace names, team memberships, and roles
- Registration and login IP addresses - stored to detect and prevent fraudulent or automated access
Content you create
The flows you build (tours, tooltips, checklists, resource centers, announcements), their configuration, targeting rules, and theming. This is your content; we store and serve it so your flows run.
Usage data
- IP address - for rate limiting, security, and abuse prevention
- Dashboard activity - requests, timestamps, and response status for the app you use
- Install-key usage - which account token served the runtime, and when
Payment information
We do not collect or store your card details. Payment processing is handled by our providers (PayPal, Stripe, and/or Paddle), who may collect your card number, billing address, and payment details directly. See their privacy policies:
For invoicing (including GST invoices in India) we store the billing details you provide and retain invoice records as required by tax law.
Analytics and advertising
Our marketing site may use Google Analytics 4, Google Tag Manager, and Google Ads conversion tracking to measure and improve the site. These collect anonymized usage data and, for ads, conversion events. They are provided by Google Ireland Limited; data may be transferred to Google in the United States. See Google's Privacy Policy, and opt out with the Google Analytics Opt-out Add-on.
Data we do not collect
- We do not sell your data, or your end users' data, to anyone
- We do not use social tracking pixels on the dashboard
- We do not use your content or your end users' data to build advertising profiles
4. End-user data (the embedded runtime)
When you install Onbixo, a small script runs on your app and shows your flows to your users. To target and measure flows, it processes limited data on your behalf:
- An end-user reference - an identifier you pass to us (for example a user id), or a first-seen anonymous id, used to remember which flows a user has seen or completed
- Traits you choose to send - if you call our identify API, the user and company attributes you send us for targeting. You control this payload; we store it as sent, size-capped
- Flow events - views, steps, completions, and dismissals, so you can measure onboarding
- Survey answers - if you run a survey, the answers your users give: a score, a rating, a chosen option, or text they write. Text answers are a person's own words, so they are stored apart from flow events, are not included in the event purge, and are deleted with the survey or on an erasure request
- Server-derived signals - browser, OS, device type, and country, derived from the request headers (never trusted from the client) for device and geo targeting
You are the controller of this end-user data and we are your processor. What we collect is determined by how you configure your flows and what you send us. Our handling of it - sub-processors, security, retention, and deletion - is set out in the Data Processing Agreement.
The runtime does not set advertising cookies and does not track your users across other websites. It stores small values in the browser's local storage (for example, which flows a user has seen) so a flow does not repeat - see the Cookie Policy.
5. AI features (OnbiAI)
Onbixo includes optional AI features - the OnbiAI assistant and the in-editor AI shortcuts - that help you draft flows, targeting and audiences, rewrite copy, and read a flow's funnel. You choose when to use them; nothing is sent to an AI provider unless you invoke an AI action.
What is sent. To fulfil an AI request we send your own content and instructions to our
AI sub-processor: the text of your prompt, the flow content you are editing (titles and body copy), the natural-language
description you type for targeting or an audience, the trait and event key names configured on your account
(for example plan or signed_up, never their values), and, for insights, the
aggregate funnel numbers for a flow (counts and rates). We do not send your end users'
personal data - no names, emails, individual profiles, or trait values - to the AI provider.
Who processes it. AI requests are processed by Google (Gemini API) as our sub-processor. We use a paid API tier, under which Google does not use your prompts or the AI's responses to train or improve its models and does not route them to human review; Google logs them only briefly to detect abuse. The provider is listed, and may change, in our Data Processing Agreement, and is admin-configurable.
You stay in control. Every AI result is a draft you review before it is saved or shown to anyone - the AI proposes, you confirm. AI output can be inaccurate, so you are responsible for reviewing it before you publish. If you would rather not use AI, simply don't invoke the AI actions; the rest of the product works without them.
6. How we use your data
| Purpose | Data used |
|---|---|
| Account creation and authentication | Name, email, password hash |
| Transactional email (verify, password reset, 2FA codes, team invites) | Email address |
| Subscription management and billing (incl. GST invoicing) | Email, billing details, payment data via provider |
| Serving your flows and enforcing plan limits | Content, install-key usage, MAU counts |
| Security and abuse prevention | IP address, request patterns |
| Product improvement and support | Aggregated, anonymized usage data; support correspondence |
We use your account data to provide and improve the service and to communicate with you about it. We do not use it for third-party advertising or profiling.
7. Legal basis for processing
If you are in the EEA, UK, or another jurisdiction that requires a legal basis, we rely on:
- Contract performance - to provide Onbixo to you (account, billing, serving your flows).
- Legitimate interest - security, fraud prevention, and product improvement, where our interests do not override your rights.
- Consent - where required, such as for optional analytics cookies.
- Legal obligation - to comply with applicable law (tax and invoicing records).
8. Data sharing
We do not sell personal data. We share it only with service providers, and only as needed to run Onbixo:
| Provider | Purpose | Data shared |
|---|---|---|
| PayPal / Stripe / Paddle | Payment processing | Email, billing details (collected directly by provider) |
| Email delivery provider | Transactional email | Email address, message content |
| Hosting / infrastructure | Running the service and storing data | All data (encrypted at rest) |
| Google (Analytics / Ads / GTM) | Marketing-site analytics, when configured | Anonymized usage data, conversion events |
The full, current list of sub-processors that handle your end users' data is maintained in the Data Processing Agreement. We may also disclose data if required by law, court order, or to protect our rights and the safety of our users.
9. Cookies
Onbixo uses essential cookies for the dashboard to function (login state, CSRF protection), and the marketing site may use optional Google cookies for analytics and conversion tracking when configured. The embedded runtime uses browser local storage, not advertising cookies. For the full list, durations, and how to control them, see our Cookie Policy.
10. Data retention
- Account data - retained while your account is active; deleted when you delete your account.
- Content (your flows) - retained while your account is active.
- End-user profiles and events - retained for a rolling window for analytics and targeting, then purged; you can also delete a specific end user on request. See the DPA.
- Security / IP logs - short-lived, kept only as long as needed for rate limiting and abuse prevention.
- Payment and invoice records - retained as required by tax and financial regulations (typically up to 7 years).
When you delete your account, we permanently remove your personal data (name, email, password hash, workspaces, content, and end-user data) within 30 days. Some anonymized, aggregated data may be retained for product analytics.
11. Your rights
Depending on your location, you may have the right to:
- Access - a copy of the personal data we hold about you.
- Rectification - correct inaccurate data (update your name and email in your profile settings).
- Erasure - delete your account and associated data.
- Portability - receive your data in a machine-readable format.
- Restriction and objection - limit or object to certain processing.
- Withdraw consent - where processing is based on consent.
To exercise any right, contact us at [email protected]. We respond within 30 days. If your request concerns an end user of a customer's app, we will refer it to that customer, who is the controller of that data.
12. Data security
We take reasonable technical and organizational measures to protect your data, including:
- Passwords securely hashed; API and install tokens hashed before storage
- All connections encrypted in transit
- Workspace isolation enforced on our servers (one workspace cannot read another's)
- Protected session handling and cross-site request forgery protection
- Optional two-factor authentication with recovery codes
- Protection against brute-force sign-in attempts
- Multiple layers of defense against common web attacks on the dashboard
No method of transmission or storage is 100% secure. If you discover a vulnerability, please contact us immediately.
13. International transfers
Onbixo is operated from India. If you access the service from elsewhere, your data may be transferred to and processed in India or other countries where our service providers operate (including the United States). Where we transfer personal data of EEA, UK, or Swiss residents to countries without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses. Request a copy at [email protected].
14. GDPR - European Union & United Kingdom
If you are in the EEA, UK, or Switzerland, the GDPR (or UK GDPR) applies. For your account data, InkWired Technologies Pvt. Ltd. is the controller; for your end users' data, we act as a processor under the DPA. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your data protection authority. In the event of a breach that poses a risk to your rights, we will notify the relevant authority within 72 hours and affected users where the risk is high. See our full GDPR statement.
15. India DPDP Act 2023
Onbixo is operated by InkWired Technologies Pvt. Ltd., registered in India, and complies with the Digital Personal Data Protection Act, 2023. As a Data Principal you have the right to access, correction and erasure, grievance redressal, and nomination. Where we rely on consent, you may withdraw it at any time.
Grievance Officer
- Name: InkWired Technologies Pvt. Ltd. (Grievance Officer)
- Email: [email protected]
- Address: C-101, Mahesh Nagar, Jaipur, Rajasthan, Pin Code - 302015, India
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
16. Children's privacy
Onbixo is a business tool not intended for individuals under 18, and we do not knowingly collect personal data from anyone under 18. If we learn we have, we will delete it promptly. This threshold aligns with the DPDP Act 2023, which classifies anyone under 18 as a child.
17. Changes to this policy
We may update this policy from time to time. For material changes we will notify you by email or a notice on Onbixo before they take effect. Continued use after changes are posted constitutes acceptance.
18. Contact us
- Company: InkWired Technologies Pvt. Ltd.
- Address: C-101, Mahesh Nagar, Jaipur, Rajasthan, Pin Code - 302015, India
- Email: [email protected]