onything

Privacy Policy

This Privacy Policy informs you about the processing of personal data when using onything (ondocuments.org) in accordance with the EU General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (BDSG).

1. Controller

onything bureaubakker Voorstraat 39 2611JK Delft, Netherlands Email: siebe@onything.org

Data protection officer (if appointed): Zimmermann, gregor@onything.org

2. Overview

We process personal data only insofar as this is necessary to provide a functional platform and our content and services. Legal bases are in particular:

  • Art. 6 (1) (a) GDPR – consent
  • Art. 6 (1) (b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6 (1) (c) GDPR – legal obligation (e.g. tax retention)
  • Art. 6 (1) (f) GDPR – legitimate interests (e.g. security, error analysis, abuse prevention)

3. Visiting the website

When you visit our website, your browser automatically transmits technical data (IP address, date and time, page requested, browser type, operating system, referrer). This data is processed by our hosting provider to deliver the website and ensure its security (Art. 6 (1) (f) GDPR) and deleted after a short period, usually within 30 days, unless needed to investigate security incidents.

4. Registration and user account

For registration we process your email address, password (stored only as a hash), optional name, company membership and role. We send a confirmation email to verify your address. Legal basis: Art. 6 (1) (b) GDPR. Data is stored for the duration of your account and deleted after its deletion, unless retention obligations apply.

5. Use of the platform

When you use onything we process:

  • uploaded documents and the content extracted from them (text, images, tags, summaries, citations),
  • chats and AI research questions and answers, notes, highlights and folders,
  • usage data such as login times, session duration, uploads and number of questions, to provide the Service, enforce plan limits, bill usage and show statistics to administrators,
  • support tickets and messages.

Legal basis: Art. 6 (1) (b) GDPR; for usage statistics and security also Art. 6 (1) (f) GDPR. Company administrators can see members, usage and tickets of their company.

6. Artificial intelligence (Mistral AI)

For text recognition (OCR), image descriptions, embeddings, tagging, chat and research we transmit document content and your questions to Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. Mistral processes the data on our behalf (Art. 28 GDPR) within the EU and does not use it to train its models under our agreement. Legal basis: Art. 6 (1) (b) GDPR.

7. Hosting and database

  • Supabase Inc. (database, authentication, file storage), 970 Toa Payoh North #07-04, Singapore 318992; data stored in the region [EU region, e.g. Frankfurt].
  • Hosting/CDN: [hosting provider, e.g. Lovable / Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA].

These providers act as processors under Art. 28 GDPR. Where data is transferred to third countries (e.g. USA), this is based on the EU–U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 46 GDPR).

8. Payments (Stripe)

Payments for plans, seats, extra usage and reader subscriptions are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe receives name, email, billing address and payment details. Legal basis: Art. 6 (1) (b) and (c) GDPR. Stripe's privacy policy: https://stripe.com/privacy. Invoices are retained for 10 years according to § 147 AO and § 257 HGB.

9. Emails

Transactional emails (confirmation, invitations, password resets, notifications) are sent via our email provider [SMTP provider name, address]. Legal basis: Art. 6 (1) (b) GDPR.

10. Cookies and local storage

We only use technically necessary cookies and browser storage (e.g. for keeping you signed in, your language and display settings). No tracking or advertising cookies are used. Legal basis: § 25 (2) TDDDG and Art. 6 (1) (f) GDPR. Consent is not required for these technically necessary purposes.

11. Contact and support

If you contact us by email or via the ticket system, we process your details to handle your request (Art. 6 (1) (b) or (f) GDPR) and delete them when no longer needed, subject to retention obligations.

12. Recipients

Data is passed only to the processors named above, to the administrators of your company within the scope of the platform, and to authorities where legally required. We do not sell personal data.

13. Storage period

We delete personal data as soon as the purpose ceases to apply, in particular after deletion of your account or company, unless statutory retention periods (6 or 10 years under commercial and tax law) require longer storage.

14. Your rights

You have the right to:

  • access (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing based on legitimate interests (Art. 21 GDPR),
  • withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, contact [privacy email].

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for our registered office: [competent supervisory authority].

15. Security

We use TLS encryption, access control at database level (row-level security), private file storage with short-lived links and regular updates to protect your data.

16. Changes

We may update this Privacy Policy when the Service or legal requirements change. The current version is always available on this page. Where required, we will ask you to accept a new version.

Status: 17.10.2026