Privacy policy

Ontu (“we”, “us”) operates ontu.in. For personal data about our account holders and website visitors, we are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). For personal data that visitors submit through enquiry forms on a customer's page, that customer is the data fiduciary and we process the data on their behalf. [Registered entity details to be inserted before launch.]

• Account data: name, email address, password (stored only as a secure hash), profile picture and preferences such as marketing and analytics consent.
• Page content: the text, links and images you add to your pages, and your username.
• Enquiries: names, email addresses, optional phone numbers and messages that visitors submit to your page, plus their consent.
• Billing data: your plan, subscription status and payment records. Card and bank details are handled by our payment partners, not stored by us.
• Usage and device data: page views and clicks on published pages, referrer, device type, approximate country, browser user agent and a truncated IP hint for security. Known bots are excluded.
• AI inputs: what you type into AI tools and the outputs generated.
• Communications: messages you send us through the contact form or by email.

• To provide the Service: create your account, host and publish your pages, deliver enquiries and show analytics.
• To process payments and manage subscriptions.
• To keep Ontu secure: prevent fraud, spam and abuse, enforce limits and investigate reports.
• To provide support and send essential service messages (for example, verification or security emails).
• To send product news, only if you opted in. You can opt out at any time.
• To improve the Service using aggregated or de-identified information.

We process personal data with your consent, or for legitimate uses permitted by the DPDP Act — for example, where you voluntarily provide data to use the Service, to comply with law, or to respond to emergencies. Where we rely on consent, you can withdraw it at any time; this won't affect processing that already happened.

We don't sell personal data. We share it only with service providers (data processors) who help us run Ontu, under contracts that require them to protect it:

• Payment processors: Razorpay and Stripe, to take and manage payments.
• AI providers: third-party AI model providers that process AI tool inputs to generate text and images.
• Infrastructure: hosting, database, storage, email delivery and DNS providers.

We may also disclose data where required by law, or to protect the rights, safety and security of users and the public. A current list of sub-processors is available on request.

Some of our providers may process data outside India. We transfer data only to countries not restricted by the Government of India under the DPDP Act, and with appropriate safeguards.

• Account and page data: while your account is active. When you delete your account, we delete your pages, leads, analytics and media.
• Analytics: kept for the history your plan allows, then deleted or aggregated.
• Payment records: kept in anonymised form for as long as required by tax and accounting law.
• Security logs: kept for a limited period to investigate abuse.

Under the DPDP Act and other applicable law, you can:

• Access a summary of your personal data and how it is processed — you can export your data from account settings.
• Correct, complete or update your data.
• Erase your data — you can delete your account from settings.
• Withdraw consent, for example to marketing emails or analytics.
• Nominate another person to exercise your rights in case of death or incapacity.
• Raise a grievance with us, and, if unresolved, with the Data Protection Board of India.

If you submitted an enquiry to a page built on Ontu, please contact that page's owner first; we will help them respond.

We use reasonable security safeguards, including encryption in transit, hashed passwords and session tokens, access controls and audit logs. No system is perfectly secure; if a personal data breach occurs we will notify affected users and the Data Protection Board as required. Read more on our security page.

Ontu is not intended for children under 18 and we do not knowingly process their personal data. If you believe a child has given us data, contact us and we will delete it.

We use a small number of cookies, mainly to keep you signed in. See our Cookie Policy.

For privacy questions or to exercise your rights, email support@ontu.in with the subject “Privacy”. Our Grievance Officer can be reached at the same address. [Name and postal address to be inserted before launch.] We will respond within the time required by law.

We will post updates here and, for significant changes, notify you by email or in the product.