Privacy Policy

1. Who we are and how to reach us

ONTHEBIAS, Inc. ("ONTHEBIAS", "we", "us") is a Delaware corporation that operates the ONTHEBIAS design platform at onthebias.co and app.onthebias.co. We are the data controller for personal data collected through the service, except where the DPA (below) makes us your processor. For privacy questions, data-subject requests, or DPA requests, email info@onthebias.co.

Postal address: ONTHEBIAS, Inc., c/o Registered Agent, State of Delaware (full registered address on request from info@onthebias.co).

2. What we collect

We collect four buckets of data:

• Account info - email, name, avatar, workspace name, phone (optional), preferred language, and billing address when you subscribe. Provided when you sign up or in-app later.
• Design content - collections, canvas state, OBIE chat messages, generated mockups, flat sketches, tech packs, brand assets you upload, library favorites, RFQs and messages you send to suppliers.
• Usage telemetry - page views, feature use, error traces, device / browser type, IP address (truncated on write), and marketing-attribution cookies (see Cookie Policy). Used to run and improve the product.
• Commercial data - subscription tier, credit balance and history, orders placed, quotes accepted, invoices, and payments. Payment card numbers themselves are handled by Stripe and never touch our servers.

We do not sell personal data and we do not share personal data with third parties for their own advertising or marketing.

3. How we use it

• To run the platform and deliver the features you signed up for.
• To process payments via Stripe and route marketplace payouts to suppliers.
• To send transactional email (signup confirmation, password reset, order updates, referral notifications). We don't run marketing campaigns to your address without explicit opt-in.
• To improve the product through aggregated, de-identified usage analysis.
• To detect and prevent fraud, abuse, scraping, security incidents, and violations of the Terms.
• To comply with our legal obligations (tax records, sanctions screening, responses to lawful requests).

4. Legal bases (GDPR / UK GDPR)

For users in the EU, EEA, UK, and Switzerland, the legal bases we rely on under Article 6 GDPR are:

• Performance of a contract - to provide the service you signed up for, process payments, and fulfill orders you place.
• Legitimate interests - to secure the service, prevent fraud and abuse, understand aggregate product usage, and communicate operational updates. We balance these against your rights and you can object at any time by emailing info@onthebias.co.
• Consent - for marketing email, non-essential cookies (analytics and advertising), the Meta pixel in EU/EEA/UK/Switzerland/Brazil, and any future opt-in AI-training program. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation - to comply with tax, accounting, sanctions, and other applicable law.

5. AI training

Your design content is not used to train any model we own, and we do not permit our third-party AI providers to train their models on your content. We send your prompts and uploaded images to AI providers (Anthropic, Google) only to fulfill the generation you requested in the moment, under their no-training commercial APIs. We may in the future offer separate, per-workspace opt-in programs that let you consent to your content being used to train an ONTHEBIAS-owned model in exchange for defined benefits. Any such program is opt-in only, revocable at any time, and clearly labeled at the point of consent.

6. Sub-processors

We rely on these providers to operate the service. Each receives only the data required to perform their task, and each is under a written agreement that includes GDPR-appropriate data-protection terms.

• Supabase - database, auth, file storage (US regions)
• Vercel - hosting, edge network (global)
• Stripe - payments and marketplace payouts (US)
• Anthropic, Google - AI generation (prompt / output only, no-training commercial APIs)
• Liveblocks - real-time canvas and comments (US)
• Resend - transactional email (US)
• SerpAPI - image search for tech-pack BOM (US)
• AWS S3 - legacy library asset storage (us-east-2)
• Trigger.dev - durable job orchestration for long-running generation (US)
• Sentry - error tracking and performance monitoring (US)
• Google Cloud Run - fallback compute for AI generation (US)
• Meta - advertising measurement, only with your Marketing consent; conversion events sent with your email hashed

7. Sub-processor changes

The list above is current as of the last-updated date at the top of this page. When we add a new sub-processor that processes personal data, we update this list and notify workspace admins in-app at least 30 days before the change takes effect. If you object to a new sub-processor and we can't reasonably accommodate the objection, you may terminate your subscription and receive a pro-rated refund of any unused prepaid period.

8. International data transfers

ONTHEBIAS is based in the United States, and most of our sub-processors are US-based. When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to the United States or other jurisdictions, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the equivalent Swiss instrument, together with supplementary technical and organizational measures where required. Copies of the SCCs applicable to your relationship with us are available by emailing info@onthebias.co.

9. Retention

We keep personal data only as long as we need it for the purposes described above:

• Account and design content - for as long as your account is active. After account deletion we remove design content within 30 days, except backups (purged on the standard backup rotation, up to 90 days).
• Commercial records - invoices, payments, order history, and tax records are kept for up to 10 years to meet accounting and tax obligations.
• Usage telemetry and logs - up to 24 months, then aggregated or deleted.
• Marketing consent records - kept while you are subscribed and for 3 years after your last interaction, so we can prove we had your consent.
• Security and fraud-prevention records - kept for as long as needed to protect the service, typically not more than 3 years.

10. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access - request a copy of the personal data we hold about you.
• Rectification - correct inaccurate or incomplete personal data.
• Erasure - request deletion (subject to legal retention obligations).
• Restriction - ask us to stop processing your data for specified purposes.
• Portability - receive a copy of the data you provided in a machine-readable format, or ask us to transmit it to another controller where technically feasible.
• Objection - object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent - where processing is based on consent, withdraw it at any time.
• Complaint - lodge a complaint with your local data-protection authority. In the EU that is your national supervisory authority; in the UK it is the Information Commissioner's Office (ico.org.uk).

To exercise any right, email info@onthebias.co with enough detail for us to identify you and your request. We will respond within 30 days, extendable by 60 days for complex requests as GDPR permits. There is no fee unless the request is manifestly unfounded or excessive. Workspace admins can also delete individual collection + canvas data directly from the app.

11. Cookies

We use a session cookie for authentication and a small preference cookie to remember your active workspace. We also load the Meta (Facebook/Instagram) pixel to measure our advertising, and send conversion events (sign-up, subscription) to Meta with your email hashed first. This is on by default and you can opt out any time from the Manage cookies link; in the EU, EEA, UK, Switzerland and Brazil we load it only after you opt in. See our Cookie Policy for the full list.

12. Children

The service is not directed to children under 16, and we do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the applicable digital-consent age). If you believe a child has provided us with personal data, email info@onthebias.co and we will delete it.

13. US state-privacy rights (California and others)

If you are a California resident, you have rights under the California Consumer Privacy Act (as amended by the CPRA) - including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA. Similar rights are available under the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other US states with comprehensive privacy laws. Exercise these rights by emailing info@onthebias.co.

14. EU representative

ONTHEBIAS does not currently maintain a designated representative in the European Union under Article 27 GDPR. EU users may direct all data-protection requests and complaints to info@onthebias.co, and to their national supervisory authority. We are in the process of engaging an Article 27 representative and will list the representative here as soon as that is complete.

15. Security

We use industry-standard technical and organizational measures to protect personal data, including encryption in transit (TLS 1.2 or higher), encryption at rest for database and file storage, role-based access control, row-level security on user data, audit logging, and regular vulnerability scanning. No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the applicable supervisory authorities as required by law.

16. Changes

We may update this policy. Material changes will be announced in-app and emailed to active accounts at least 30 days before they take effect, except where a shorter period is required by law. Continued use after a change takes effect means you accept the updated policy. Prior versions are available on request from info@onthebias.co.