§1 Who we are
This Privacy Policy describes how OYNYX [legal entity name, state of formation to be added] ("OYNYX," "we," "us," "our") collects, uses, stores, and protects personal information. It applies to:
Visitors to oynyx.com ("the Website"). Clients who engage OYNYX under a Master Service Agreement ("Clients"). Customers of our Clients whose information is processed through the ClientConnect™ system ("End Customers"). Professionals on the PartnerConnect™ network ("Professionals"). Individuals who apply for employment through the OYNYX careers page ("Applicants").
This Privacy Policy applies alongside our Terms of Service and the Client's Master Service Agreement (MSA). Data processing is governed by the OYNYX Data Processing Addendum (DPA), current version available at [URL], which forms part of the Terms of Service.
For data processed on behalf of Clients (End Customer data), OYNYX acts as a data processor (GDPR) and service provider (CCPA/CPRA) — the Client is the data controller and determines how their customers' information is used. OYNYX processes End Customer data only as instructed by the Client through the Client Playbook and MSA. The MSA contains the contract terms required under CCPA §1798.140(ag) for service-provider status.
§2 What we collect and why
From Website visitors
| Data | Why | How |
|---|---|---|
| Name, email, phone, message | To respond to inquiries submitted through the contact form | Contact form submission — see §5, Form submissions |
| Article slug, helpful/not-helpful response, optional comment | To find out which resources articles are working and which need rewriting | Feedback control on Resources Center articles — see §5, Form submissions |
| IP address, cookies | To maintain site functionality and security | Automatic collection |
| Page views, device type, browser, approximate location | To understand how visitors use the site and improve it | Analytics cookies — not currently active; will be implemented with consent mechanisms in place |
From Clients
| Data | Why | How |
|---|---|---|
| Business name, contact person, email, phone, address | To establish and manage the service relationship | Onboarding, MSA |
| Billing information | To process monthly invoices | Provided by Client during setup |
| Playbook content, SOP details, escalation paths | To build and operate the Client Playbook | Onboarding discovery |
| Account activity (access logs, settings changes) | To maintain audit trail and security | System logging |
From End Customers (on behalf of Clients)
| Data | Why | How |
|---|---|---|
| Name, phone, email, address | To handle the contact on the Client's behalf (Tier A) | Customer contacts the Client's line |
| Conversation content, internal notes, resolution records | To track the interaction and follow through (Tier B) | Captured during service delivery |
| Work items, appointment details, case intake metadata (matter type, conflict-check identifiers, scheduling) | To manage the Client's workflow (Tier C) | Created during service delivery |
| Call recordings | Quality assurance, specialist training, dispute resolution | Recorded during calls with disclosure |
OYNYX processes End Customer data as a data processor / service provider acting on the Client's instructions. The Client determines what is collected and how it is used. OYNYX does not use End Customer data for any purpose other than delivering the service to the Client.
From Professionals (PartnerConnect™)
| Data | Why | How |
|---|---|---|
| Name, business name, contact information | To create and manage the Professional's network profile | Professional onboarding |
| Service types, service area, rates, availability | To match the Professional with Client jobs | Profile setup |
| Insurance documentation, licensing, identity verification | To verify the Professional meets network standards | Verification process |
| Job history, ratings, performance metrics | To maintain the Professional's reputation and matching priority | Accumulated through completed jobs |
| Invoice and payment details | To process payment for completed jobs | Provided by Professional |
From Applicants (careers page)
| Data | Why | How |
|---|---|---|
| Name, email, phone, location | To evaluate the application and communicate | Application form — see §5, Form submissions |
| Resume/CV | To assess qualifications | Uploaded through the careers form — see §5, Form submissions |
| Role interest, languages, availability, referral source | To match the applicant with open roles | Application form |
Applicant data is kept separate from Client and prospect records. It is not added to OYNYX's customer relationship management system and is not used for sales or marketing purposes.
§3 How we use personal information
To deliver the services. Processing End Customer contacts, managing work items, tracking follow-ups, generating Insights reports, operating the Client Playbook — all on the Client's behalf and within the scope wall.
To operate PartnerConnect™. Matching Professionals with Client jobs, tracking job lifecycle, processing payment, maintaining verification and compliance records.
To communicate. Responding to inquiries, sending service-related notifications, delivering monthly Insights reports, providing onboarding support, sending appointment confirmations and reminders on the Client's behalf.
To improve the service. Analyzing anonymized, aggregated data to improve AI accuracy, system performance, and industry benchmarks — only where the Client has explicitly opted in. Legal and healthcare Clients are excluded from anonymized data use by default. No individually identifiable data is used for service improvement without explicit written consent.
To improve the Resources Center. Reviewing article feedback responses to identify content that is unclear, incomplete, or out of date. Feedback is analyzed in aggregate and is not linked to an identified individual unless the submitter includes identifying information in the optional comment field.
To evaluate job applications. Reviewing resumes, assessing qualifications, communicating with applicants about open roles.
To maintain security and compliance. Logging access, monitoring for unauthorized activity, enforcing MFA on OYNYX internal accounts, maintaining audit trails, meeting legal obligations.
§4 Legal bases for processing
Contractual necessity. Processing required to deliver the services under the MSA (End Customer data processing, Playbook operation, Insights generation, PartnerConnect™ management).
Legitimate interest. Processing for service improvement, security monitoring, fraud prevention, and internal analytics — balanced against individual rights.
Consent. Processing based on explicit opt-in: anonymized data use for AI training and benchmarks, and cookie consent where required by applicable law.
Legal obligation. Processing required to comply with applicable law, regulation, court order, or government request.
§5 Who we share data with
OYNYX does not sell personal information to any third party, and does not share personal information for cross-context behavioral advertising. Period.
Sub-processors
OYNYX uses the following sub-processors to deliver the services. The Client's data may be processed by these sub-processors in the course of service delivery:
| Sub-processor | Purpose | Location |
|---|---|---|
| HubSpot | Contact management, CRM | United States |
| Apollo | Contact/walkthrough lead capture, CRM, scheduling, and outreach | United States |
| Google Workspace | Email, calendar, internal documentation | United States |
| Retell AI | Voice AI layer | United States |
| Looker Studio | Insights reporting and data visualization | United States |
| Vercel | Website hosting, form processing, and form data storage | United States |
| [Payment processor — to be confirmed] | Invoice processing, payment settlement | [To be confirmed] |
As OYNYX builds and launches the ClientConnect™ and PartnerConnect™ platforms, additional sub-processors may be added (database hosting, authentication, monitoring, and other infrastructure services). Clients are notified at least 30 days before any new sub-processor is added, per the process described in Terms of Service §16.
Sub-processor data processing is governed by the OYNYX Data Processing Addendum (DPA), available at [URL].
Form submissions
Contact and walkthrough requests submitted through oynyx.com are handled by Apollo, our CRM and outreach platform (listed above), so we can respond and follow up. Career applications — and article feedback, once our Resources Center launches — are received instead by a serverless function that OYNYX operates directly on its hosting infrastructure in a United States region; those submissions are not routed through any third-party form service.
Career applications are delivered to OYNYX’s Google Workspace and are accessible only to OYNYX personnel with a business reason to see them. Résumés and other files attached to a career application are stored separately from Client and prospect records.
Form submissions are not shared with any party outside the sub-processors listed above, are not used for advertising, and are retained according to the periods in Section 7.
PartnerConnect™ Professionals
When a Client posts a job and a Professional is matched, the Professional receives job details necessary to perform the work (service type, location, timeline, requirements). The Professional does not receive the Client's full account data or End Customer records beyond what is needed for the specific job.
Legal requirements
OYNYX may disclose personal information when required by law, court order, subpoena, or regulatory requirement. OYNYX will notify the affected Client before disclosure unless prohibited by law.
With consent
OYNYX may share personal information with the individual's or Client's explicit written consent.
§6 Data security
OYNYX protects personal information through:
Access controls. Assignment-based access — only the specialist pod assigned to a Client's account can access that Client's data. Every assignment is documented. MFA is enforced on all OYNYX internal accounts. Client-side platform MFA will be enforced when the ClientConnect™ platform is live.
Encryption. Data encrypted at rest and in transit. All connections over TLS.
Credential management. Secrets and API keys managed in a secure vault, never in client-accessible code. Credentials used by the form-handling function are held as encrypted environment variables and are not present in website source code.
The scope wall. OYNYX never accesses Client systems (CRM, calendar, email server, practice management software). OYNYX works in its own system and hands data back through agreed channels.
Audit logging. Activity logging maintained for contact handling, escalation events, data access, Playbook changes, and system configuration changes.
Platform controls (on platform launch). Row-level security at the database level, append-only cryptographically chained audit trail, and database-level isolation between Client accounts — designed into the platform architecture and deployed when the ClientConnect™ platform is live.
§7 Data retention
| Data type | Retention period |
|---|---|
| End Customer data (Tiers A, B, C) | Duration of the Client's service agreement + 30-day export window after termination. Permanently deleted after the export window unless longer retention is required by law or agreed in the MSA. |
| Client account data | Duration of the service agreement + 30-day export window. |
| Professional profile and job history | Duration of the Professional's active network membership + 90 days. Performance data (ratings, completion history) may be retained in anonymized form. |
| Billing, invoicing, and tax records | Seven years from the transaction date, as required for tax compliance (including 1099-NEC filings). Applies to Client invoices and Professional payment records. |
| Website visitor data (analytics) | 26 months from collection, or as configured in the analytics platform (when implemented). |
| Contact form submissions | 12 months, or until the inquiry is resolved, whichever is longer. |
| Applicant data (careers), including résumés and attachments | 12 months from submission. Applicants may request earlier deletion. |
| Article feedback responses | 12 months from submission. Aggregate counts (how many readers found an article helpful) may be retained indefinitely in a form that contains no personal information. |
| Call recordings | 12 months from recording date, unless a longer period is required by law, regulation, or active dispute. See also Terms of Service §17. |
| Audit logs | Duration of the service agreement + seven years (when platform audit trail is live). Audit logs contain operational metadata (who accessed what, when, what action was taken) but do not contain conversation content or End Customer PII beyond identifiers necessary for the log entry. Current activity logs retained per sub-processor retention policies. |
How retention is enforced
Retention periods for form submissions, applicant data, and article feedback are enforced by a scheduled deletion process that runs against the stored records. Records that reach the end of their retention period are deleted automatically; OYNYX does not hold them pending a manual review.
Retention periods for Client and End Customer data are governed by the service agreement and the deletion process described in Terms of Service §19.
§8 Your rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
Access. Request a copy of the personal information OYNYX holds about you.
Correction. Request correction of inaccurate or incomplete personal information.
Deletion. Request deletion of your personal information, subject to legal retention requirements and active contractual obligations.
Portability. Request your data in a structured, machine-readable format (CSV, JSON). For Clients, this is the full data export described in Terms of Service §8.
Restriction. Request that OYNYX restrict processing of your personal information in certain circumstances.
Objection. Object to processing based on legitimate interest.
Opt out of profiling. Request to opt out of profiling that produces legal or similarly significant effects. See Section 11 for how OYNYX uses automated decision-making.
Withdraw consent. Where processing is based on consent (anonymized data use, cookies), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
How to exercise your rights
To exercise any of these rights, contact OYNYX at privacy@oynyx.com. OYNYX will verify your identity and respond within 45 days. If additional time is needed, OYNYX will notify you within the initial 45-day period and may extend by up to 45 additional days.
Appeals
If OYNYX denies a rights request, OYNYX will provide a written explanation of the denial. You may appeal in writing within 45 days of receiving the denial by contacting privacy@oynyx.com with the subject line "Privacy Rights Appeal." OYNYX will respond to the appeal within 60 days.
If the appeal is denied, you may contact your state Attorney General's office to file a complaint. Contact information for state Attorneys General is available at naag.org/find-my-ag.
For End Customers
Because OYNYX processes End Customer data on behalf of the Client (as data processor / service provider), End Customers should direct privacy requests to the Client's business first. If an End Customer contacts OYNYX directly, OYNYX will forward the request to the relevant Client and cooperate in fulfilling it.
§9 California privacy rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
Right to know. You may request what personal information OYNYX has collected, the sources, the business purposes, and the categories of third parties with whom it has been shared.
Right to correct. You may request correction of inaccurate personal information that OYNYX maintains about you.
Right to delete. You may request deletion of your personal information, subject to exceptions (legal obligations, active service delivery, exercising legal rights).
Right to opt out of sale or sharing. OYNYX does not sell personal information and does not share personal information for cross-context behavioral advertising. No opt-out is necessary because neither sale nor sharing occurs. OYNYX recognizes Global Privacy Control (GPC) and similar opt-out preference signals; because there is no sale or sharing to opt out of, no action is required in response to these signals.
Right to limit use of sensitive personal information. In the course of delivering services to Clients, OYNYX may process information that qualifies as sensitive personal information under the CPRA — including health-related appointment details for healthcare Clients and legal matter intake metadata for legal Clients. This information is processed solely to deliver the services under the Client's MSA, within the scope wall, and is not used for any purpose beyond service delivery. You may request that OYNYX limit the use and disclosure of sensitive personal information to what is necessary to perform the services.
Right to non-discrimination. OYNYX will not discriminate against you for exercising your privacy rights.
Authorized agents. You may designate an authorized agent to submit a privacy request on your behalf. OYNYX will verify both the agent's authority and your identity before processing the request. Authorized agents may submit requests to privacy@oynyx.com.
To exercise California privacy rights, contact privacy@oynyx.com. OYNYX will verify your identity before processing the request and respond within 45 days.
§10 State-specific privacy rights
Residents of Texas (TDPSA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Montana (MCDPA), and other states with comprehensive consumer privacy laws have rights similar to those described in Section 8, including access, correction, deletion, portability, and opt-out of targeted advertising (OYNYX does not engage in targeted advertising) and profiling with legal or similarly significant effects (see Section 11).
These state laws also require an appeals process for denied requests. The appeals process described in Section 8 applies. If an appeal is denied, you may file a complaint with your state Attorney General.
To exercise these rights, contact privacy@oynyx.com.
§11 Automated decision-making and AI
OYNYX uses artificial intelligence to answer contacts, qualify inquiries, triage urgency, match Professionals with Client jobs, and predict quality trends. The AI layer operates under the Client Playbook and within the scope wall.
No decisions with legal or similarly significant effects. The AI does not make decisions with legal, medical, financial, or employment consequences. Contacts that require judgment are escalated to a trained specialist. PartnerConnect™ matching is AI-assisted but all job assignments require human acceptance by both Client and Professional. Job applications are reviewed by a person; OYNYX does not use automated screening to reject an applicant.
Opt-out. You have the right to opt out of profiling that produces legal or similarly significant effects, as provided by Colorado, Virginia, Connecticut, Texas, and other applicable state laws. Because OYNYX's AI does not produce such effects, no profiling of this nature occurs. If you believe an automated decision has materially affected you, contact privacy@oynyx.com and OYNYX will review the decision with human oversight.
AI disclosure. OYNYX includes a disclosure in the initial greeting where required by applicable law, so that a caller knows when they are speaking with an automated system. The specific disclosure language is defined in the Client Playbook. See Terms of Service §17 for obligation allocation between OYNYX and the Client.
§12 Call recording
OYNYX may record calls handled on behalf of Clients for quality assurance, specialist training, and dispute resolution. Call recordings are stored securely and retained for 12 months unless a longer period is required by law, regulation, or active dispute.
For calls in jurisdictions requiring all-party consent (including California, Florida, Illinois, Pennsylvania, and Washington), the Client is responsible for ensuring consent is obtained. OYNYX provides a disclosure script for inclusion in the Playbook greeting. The specific obligation allocation is defined in Terms of Service §17 and the Client's MSA.
Call recordings are not used for AI model training unless the Client has explicitly opted in under the anonymized data provisions in Section 3. Legal and healthcare Client recordings are never used for training purposes.
§13 Cookies and tracking
OYNYX uses cookies and similar technologies on the Website for:
Essential cookies. Required for the website to function (session management, security). These cannot be disabled.
Analytics cookies. Not currently active. When implemented, analytics cookies will be used to understand how visitors use the site (page views, traffic sources, device information) and will be set only with your consent where required by applicable law.
OYNYX does not use advertising cookies, retargeting pixels, or cross-site tracking. OYNYX does not serve ads on its website and does not sell or share visitor data with advertisers.
You can manage cookie preferences through your browser settings. Disabling essential cookies may affect website functionality.
§14 Children's privacy
OYNYX services are designed for businesses, not for individuals under 18. OYNYX does not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where a higher age applies). If OYNYX becomes aware that it has collected information from a child, the information will be deleted promptly. If you believe OYNYX has collected information from a child, contact privacy@oynyx.com.
Minors in End Customer data
End Customer data processed on behalf of Clients may routinely include information about minors — for example, a parent booking a dependent's medical appointment, a child named in a legal matter, or a minor listed as an occupant in a property management context. This is a normal part of the Client's business operations, not information collected from minors by OYNYX. This data is processed solely on the Client's instructions, under the Client's data controller obligations, and within the scope of the Client's MSA.
§15 Breach notification
In the event of a security incident that results in unauthorized access to, disclosure of, or loss of personal information, OYNYX will:
Notify affected Clients without undue delay and no later than 72 hours after confirming the incident. Notification will include: what is known about the incident, what data is affected, what OYNYX is doing to contain and remediate the incident, and recommended steps the Client should take.
Notify affected individuals as required by applicable state breach notification laws. Where the Client is the data controller, OYNYX will cooperate with the Client in making required notifications.
Document the incident including the nature of the breach, the data involved, the timeline, the response actions taken, and the outcome. Documentation is available to the Client on request.
Remediate the root cause and implement measures to prevent recurrence.
§16 International data transfers
OYNYX is based in the United States. All sub-processors listed in Section 5 are located in the United States. Personal information collected by OYNYX is stored and processed in the United States.
Website delivery. Static website content — pages, stylesheets, images — is served from a globally distributed content delivery network and may be cached at edge locations outside the United States. That content contains no personal information. Form submissions and all other personal information processed through OYNYX's hosting infrastructure are handled in a United States region, not at the edge.
If OYNYX begins serving Clients or processing data of individuals located outside the United States, OYNYX will process that information in accordance with applicable data transfer requirements, including Standard Contractual Clauses (SCCs) where required. This section will be updated at that time to reflect the specific transfer mechanisms in use.
§17 Changes to this Privacy Policy
OYNYX may update this Privacy Policy from time to time. Material changes will be communicated to active Clients and Professionals via email at least 30 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.
Non-material changes (corrections, clarifications, formatting) may take effect immediately upon posting.
§18 Contact
For questions about this Privacy Policy, your personal information, or to exercise your privacy rights:
OYNYX [legal entity name to be added]
[Business address to be added]
Privacy requests: privacy@oynyx.com
Legal and DPA inquiries: legal@oynyx.com
Phone: (972) 267-8382
Both email addresses deliver to the same monitored inbox.