Privacy Policy

Who we are

OnyxFlex (“we”, “us”) operates the OnyxFlex website, web app and related services (the “Service”) and is responsible for the personal data processed through them. This policy applies to everyone who visits our website or uses the Service. Terms that are not defined here have the meaning given in our Terms of Service.

Information we collect

Account information: your email address, phone number, password (stored only as a salted hash), preferred language, referral code and who referred you. When you sign up, we also record the IP address and the type of device you signed up from, to review new accounts and prevent abuse.

Your linked Amazon Flex account: the sign-in details you provide and the access data Amazon issues when you link the account; your Amazon customer ID, name, email address and profile photo; your region and stations; and the location data used to request offers and blocks in your area.

Service activity: your preferences for offers and blocks; the offers and blocks found and accepted for you, with station, date and time, pay, duration, stops and location; your balance, plan, payments and fees; referral points; and the notifications we send you.

Payment information: payments are handled by Stripe. We receive the payment status, amount and plan, and references to your Stripe customer and subscription, but never your full card number.

Support: the messages you send us and the photos you attach. We remove location and other metadata from photos when you upload them.

Device and technical data: your IP address, browser and device information, server logs, error reports and diagnostic events, and the push notification token of each browser where you turn notifications on.

How we use it

We use your data to: create and secure your account and review new sign-ups; sign in to your linked Amazon Flex account and find, accept and track offers and blocks according to your settings; show your history, statistics and balance; take fees and process payments, renewals and referrals; send you service emails and push notifications, such as offer alerts, sign-in codes and billing notices; answer your support requests; and detect, prevent and investigate fraud, abuse and security incidents, including repeated free trials.

We also use aggregated or de-identified data, such as station load by hour, to provide station statistics and to monitor and improve the Service. We do not use your data for advertising, and we do not sell or rent your personal data.

Legal bases

Where laws such as the GDPR apply, we process your data: to perform our contract with you, that is, to provide the Service you signed up for; for our legitimate interests in securing the Service, preventing fraud and abuse and improving the Service, balanced against your rights; to comply with legal obligations, such as tax and accounting rules; and with your consent where we ask for it, for example for push notifications. You can withdraw your consent at any time.

Who we share it with

Amazon: to operate your linked Flex account, the Service sends Amazon the data needed to sign in and to request and accept offers and blocks, as any Flex app does. Amazon handles that data under its own privacy notice.

Service providers that process data on our behalf and only on our instructions: Stripe for payments, Google Firebase Cloud Messaging for push notifications, our hosting and encrypted backup storage providers, and network and security providers that route connections to Amazon and help complete Amazon’s sign-in checks.

We may also disclose data when the law requires it, to protect the rights, property or safety of our users, ourselves or others, or as part of a merger, acquisition or sale of assets, in which case the recipient remains bound by this policy for the data we transfer. We do not share your data with advertisers or data brokers.

How long we keep it

We keep your account information, linked Amazon Flex account records and offer and block history for as long as your OnyxFlex account exists. When you unlink an Amazon Flex account, the Service stops using it, but we keep a record of it so the free trial cannot be claimed twice and so we can resolve disputes.

Some data is kept for shorter, fixed periods: diagnostic events for 21 days, in-app notifications for 30 days, support photos for 90 days and server logs for up to 30 days. Encrypted database backups are kept for 14 days.

When your account is deleted, we delete or anonymize your personal data within 30 days, and it leaves our backups as they expire. We keep payment and transaction records for as long as tax and accounting laws require, usually up to seven years, and may keep limited data needed to establish or defend legal claims.

Security

We protect your data with measures that fit the risk: connections to the Service are encrypted with TLS; passwords are stored only as salted hashes; your Amazon password is encrypted at rest; backups are encrypted; and access to production systems is limited to the people and services that need it.

No system is perfectly secure. Use a strong, unique password for OnyxFlex, and tell us right away at support@onyxflex.vip if you notice anything suspicious. If a data breach affects your personal data, we will notify you and the authorities as the law requires.

Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, get a copy of it in a portable format, have it corrected or deleted, restrict or object to some processing, and withdraw any consent you have given. California residents have the right to know, delete and correct their personal information and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

You can change most of your settings in the app, unlink your Amazon Flex account there, and turn push notifications off in your browser. To exercise any other right, including deleting your account, write to us at support@onyxflex.vip from the email address on your account. We may need to verify your identity, and we will respond within 30 days. You also have the right to complain to your local data protection authority.

Cookies and local storage

We do not use advertising or third-party tracking cookies, and we do not run analytics scripts. The web app keeps a few items in your browser’s local storage so that it works as expected: your sign-in session, your language, your push notification token, the recent places and block settings you chose, and a cached copy of our public price list. You can clear them at any time in your browser settings, after which you will need to sign in again.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

International transfers

We and our service providers may process your data in countries other than the one you live in, including the United States and countries of the European Union, whose data protection laws may differ from yours. Where the law requires it, we protect these transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

Changes to this policy

We may update this policy as the Service or the law changes. We will update the date at the top of this page and, for material changes, let you know by email or in the app before they take effect.

Contact

For any question about this policy or your personal data, write to us at support@onyxflex.vip.