Privacy Policy & Cookies

Last updated: August 22, 2026

This Privacy Policy explains how ONUNDI processes personal data, and is intended to provide the information required under the EU General Data Protection Regulation ("GDPR") and applicable Irish data-protection legislation. By using the Platform, you acknowledge this Privacy Policy; if you disagree, please discontinue use.

Jump to: Retention & Deletion Your GDPR Rights Cookie Policy Contact

1. Data Controller

ONUNDI
Email: support@onundi.com

ONUNDI is currently operated as a trading name pending formal company registration in Ireland. For personal data ONUNDI processes in operating the Platform, ONUNDI acts as the data controller. Our service providers may act as processors where they process data on our instructions. Full legal controller identification is available here.

2. Who This Policy Applies To

This Policy applies to people who visit ONUNDI, register accounts, maintain profiles, publish projects, communicate through ONUNDI, contact support, report content or otherwise interact with ONUNDI. ONUNDI is intended for persons aged 16 or over (18 or over for paid subscriptions — see Section 19).

3. Personal Data We May Collect

Account information: name or username, email address, authentication information, account identifiers, account creation date.

Profile information: profile photograph, biography, skills, interests, approximate location, social links, portfolio information, collaboration interests.

User content: collaboration listings, comments, messages, content you upload, reports submitted to ONUNDI.

Technical information: IP address, device type, browser, operating system, timestamps, login records, security logs, and cookie/local-storage identifiers where applicable (see our Cookie Policy below).

Moderation and safety information: reports, enforcement decisions, content associated with a report, account restriction history, fraud or abuse indicators, correspondence concerning appeals.

Communications: emails and support messages you send to ONUNDI.

Payment information: payments are processed by Stripe, a third-party payment provider. ONUNDI does not retain your full payment-card details.

4. Why We Process Personal Data

To create and operate accounts; display profiles; provide collaboration functions; facilitate communications; provide customer support; secure accounts; prevent abuse and fraud; moderate content; enforce our Terms; investigate safety reports; comply with legal obligations; establish or defend legal claims; improve Platform reliability; and, where you have consented, provide analytics.

5. Legal Bases

Performance of a contract (Article 6(1)(b) GDPR): processing necessary to create and maintain your account, provide requested features, display your profile and deliver services you request.

Legitimate interests (Article 6(1)(f) GDPR): Platform security, fraud prevention, preventing abuse, enforcing our Community Guidelines, investigating reports, protecting users and improving reliability. Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and freedoms.

Legal obligation (Article 6(1)(c) GDPR): where processing is required to comply with law, regulatory obligations, lawful orders or other mandatory legal requirements.

Consent (Article 6(1)(a) GDPR): where we specifically request consent, such as for optional analytics cookies. You may withdraw consent at any time, without affecting processing lawfully performed before withdrawal.

6. Special Category Data

ONUNDI does not require users to provide special-category personal data such as health information, religious beliefs, political opinions, sexual orientation or biometric identification data. Users should avoid voluntarily publishing sensitive personal information unless necessary. Where ONUNDI intentionally processes special-category data, we will identify an appropriate condition under Article 9 GDPR.

7. Public Profiles

Information deliberately placed in a public ONUNDI profile may be visible to other users and, depending on Platform configuration, potentially internet visitors. Users should not publish information they do not wish to make available to the relevant audience. Public profiles are not currently indexed by external search engines, as profile content is rendered client-side within the app rather than as static, crawlable pages.

8. Messages

Where ONUNDI provides messaging functionality, messages are stored to provide the service. ONUNDI does not routinely read private messages out of curiosity. However, authorised access may occur where reasonably necessary to investigate reported abuse, protect users, detect fraud, investigate serious safety concerns, comply with law or diagnose technical problems. Access is limited where practicable to personnel or systems requiring it for those purposes.

9. Recipients

We share personal data with: other users (to the extent visible on your public profile or in your direct messages), the service providers listed in Section 10, legal or regulatory authorities where legally required, and professional advisers. We do not sell your personal data. We require processors to handle personal data under appropriate contractual and data-protection obligations.

10. Current Service Providers

Google Firebase / Google Cloud — authentication, database, hosting, file storage and serverless functions that power the Platform.

Stripe — payment processing for paid subscriptions.

Mailgun — service and reminder emails necessary to operate the Platform, sent on the basis of performance of our contract with you and our legitimate interests (Article 6(1)(b) and 6(1)(f) GDPR), not marketing consent. These include: new-message notifications, new-application notifications, a weekly reminder of unread messages, project-expiration notices, and occasional platform-wide or individual account-related emails from ONUNDI. Every such email includes a one-click unsubscribe link you may use at any time; where personal data is instead processed for direct marketing, you always have the right to object under Section 15.

Google Sign-In, YouTube and Twitch — if you choose to sign in with Google or verify a YouTube or Twitch channel, those providers process the information necessary for authentication or verification, governed by their own privacy policies.

Google Analytics — website usage analytics, loaded only if you accept optional cookies (see our Cookie Policy below).

We are not responsible for these providers' own data-handling practices, which are governed by their respective privacy policies.

11. International Transfers

Some service providers listed above may process information outside the EEA. Where personal data is transferred to a country that has not received an EU adequacy decision, ONUNDI relies on an appropriate transfer mechanism where required, such as European Commission Standard Contractual Clauses, another lawful transfer safeguard, or a permitted GDPR derogation in appropriate cases.

12. Retention

ONUNDI retains personal data only for as long as reasonably necessary for the purpose it was collected, including legal, security, fraud-prevention and dispute-resolution purposes:

Active account data: retained while your account remains active.
Deleted account data: when you delete your account, your Firebase Authentication record, profile, projects, reviews you have written, your notifications and your uploaded files (profile picture and portfolio) are deleted immediately as part of an automated cleanup process — see Section 13.
Messages: messages you have sent as part of a conversation may remain visible to the other participant after you delete your account, since removing them would remove context from an ongoing conversation the other person is party to.
Notifications: read notifications are automatically deleted after 30 days as part of routine housekeeping, independent of account deletion.
Security, fraud and moderation logs: retained for as long as reasonably necessary to protect the security of the Platform and its users; we do not currently operate a fixed automatic deletion schedule for these logs.
Financial records: retained for the periods required by applicable Irish and EU tax and accounting law.
Backups: ONUNDI does not currently operate a dedicated recurring backup/export schedule beyond the standard infrastructure durability provided by Google Cloud.

13. Account Deletion

You may request deletion of your account at any time from within the app ("Delete my account" in account settings) or by emailing support@onundi.com. Deleting your account triggers an automated process that deletes your Firebase Authentication record, your profile, your projects, your reviews, your notifications, and your uploaded files. As noted in Section 12, messages you have sent may remain visible to the other participant in a conversation, and we may retain limited information where necessary for legal obligations, fraud prevention, Platform safety, enforcement, legal claims, security or protection of other users. Such retained data is not used for unrelated purposes.

14. Your GDPR Rights

Subject to applicable law, you may have the right to: access your personal data; obtain a copy; correct inaccurate data; request erasure; restrict processing; object to certain processing; receive certain information in portable form; withdraw consent; and complain to a supervisory authority. Requests may be sent to support@onundi.com. We may need reasonable information to verify your identity before actioning a request.

15. Right to Object

Where ONUNDI processes personal data on the basis of legitimate interests, you may object to that processing in the circumstances provided by Article 21 GDPR. Where personal data is processed for direct marketing, you have the right to object at any time.

16. Complaints

You may lodge a complaint with the Irish Data Protection Commission. We encourage you to contact us first at support@onundi.com so we can investigate, but doing so does not restrict your right to contact a supervisory authority directly.

17. Security

ONUNDI implements technical and organisational measures reasonably appropriate to the risks associated with processing, including access controls, authentication protections, encryption in transit, restricted administrative access, logging, backups, software updates and abuse prevention. No internet service can guarantee absolute security.

18. Data Breaches

Where a personal-data breach occurs, ONUNDI will assess the incident and comply with applicable GDPR breach-notification requirements, including, where legally required, notification to the relevant supervisory authority and affected data subjects.

19. Children

ONUNDI does not knowingly permit persons under 16 to maintain accounts, and does not knowingly permit anyone under 18 to hold a paid subscription (see Terms Section 2). If we discover that an account belongs to a person under 16, we may disable the account and take reasonable steps regarding associated personal data. Separately, and regardless of ONUNDI's own age requirements, we treat anyone under 18 as a child for child-safety purposes; if we become aware of child sexual exploitation or abuse material we will preserve relevant records and report to competent authorities where legally required. If you believe a minor has created an ONUNDI account, contact support@onundi.com.

20. Changes to This Policy

We may update this Privacy Policy periodically. The current version displays the date of the latest revision at the top of this page. Where a change materially affects the way we process personal information, we will provide additional notice where appropriate or required.

21. Contact

Data protection questions, GDPR rights requests, and general support: support@onundi.com

Cookie Policy

1. What Are Cookies?

Cookies are small data files stored on your device. ONUNDI also uses browser localStorage, a similar storage technology, to remember your cookie choice itself.

2. Types We Use

Necessary (required): Firebase Authentication session persistence, and storing your cookie-consent choice. These cannot be disabled and do not require consent, as they are strictly necessary to operate the Platform.

Analytics (optional): Google Analytics, loaded only after you click "Accept All" in our cookie banner. If you choose "Essential Only," Google Analytics is not loaded at all.

Advertising: ONUNDI does not use advertising or ad-targeting cookies.

3. Your Choice

When you first visit ONUNDI, a banner lets you choose "Accept All" or "Essential Only." Your choice is stored in your browser's local storage and respected until you clear your browser data or change your choice.

4. Managing Cookies

You can also control cookies through your browser settings, though disabling necessary cookies may prevent you from logging in or using core features. Continued use of the Platform after making a cookie choice constitutes acceptance of that choice.

Questions? Contact support@onundi.com

You have the right to lodge a complaint with your local data protection authority.