Who this draft covers
This draft describes oniyore.com and related Oniyore-operated pages that use this text. Controller: Oniyore. Postal address: 1280 Lexington Ave FRNT 2 #1079, New York, NY 10028, United States. Privacy contact: hello@oniyore.com.
How to make requests
Email hello@oniyore.com or use the privacy request form. We verify by email before acting.
Children
These services are not directed to anyone under 18. We do not knowingly collect personal information from minors. If we learn that we collected personal information from a minor, we delete it. Contact hello@oniyore.com if you believe a minor gave us data. COPPA: we also do not knowingly collect from children under 13. We do not sell or share the personal information of consumers under 16. Forms require confirmation that the submitter is 18 or older. There is no parent or guardian consent flow.
Services are for adults 18 or older. Every form submit requires confirmation of age and agreement to Terms and Privacy. Paid or account steps require an unchecked checkbox that must be ticked. Under-18 submissions are refused. Personal information of anyone under 13 is not collected knowingly (COPPA). Personal information of consumers under 16 is not sold or shared; opt-in would be required if that ever changed.
California (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of sale or sharing. Categories we may collect when you contact us or use the site: identifiers (name, email, phone, IP); commercial information (service requests); internet activity (pages, cookie/consent flags); and inferences we do not build for advertising. We do not sell or share personal information. We respond within 45 days (extendable once as the statute allows). Use Your Privacy Choices, Global Privacy Control (Sec-GPC / navigator.globalPrivacyControl), email, or the privacy request form.
Do Not Sell or Share / Global Privacy Control
Use Your Privacy Choices or send a Global Privacy Control (Sec-GPC / navigator.globalPrivacyControl) signal. We treat that signal as an opt-out of sale/share and of non-essential cookies and tags. Status appears on that page as “Opt-Out Request Honored” when the signal is present.
Email (CAN-SPAM)
Marketing email includes an unsubscribe link and a physical postal address line. Unsubscribe requests are honoured within 10 business days. Headers and subjects are not deceptive. Transactional mail about a job you asked for is separate from marketing.
Calls and texts (TCPA)
We do not place autodialed or prerecorded calls or marketing texts to a mobile number without prior express written consent. Where a phone field and call/SMS consent checkbox appear, that consent is optional and is not a condition of purchase. Reply STOP to opt out of texts. US Do Not Call registry: not subscribed. Cold calling and texting US numbers is OFF until the registry is subscribed and the scrub is wired.
Retention
Periods below are filled only where the code or an existing page states them. Everything else is TBD. This is not a promise that a deletion job runs.
| Category | Period | Where this comes from |
|---|---|---|
| Cookie consent record | Until the visitor clears site storage | option-fe-core/compliance/consent-storage.ts stores JSON under localStorage key cookie_consent. No server TTL in that file. |
| Contact and lead form fields (name, email, phone, message) | TBD | Submitted to api.oniyore.com from oniyore-fe-landing. No retention TTL in the landing form module reviewed. |
| Review text submitted by a visitor | TBD | option-backend SubmitReview stores the row. No deletion interval in the handler reviewed. |
| Analytics (GA4) | TBD | Measurement id is in file config. Vendor retention is not set in the repo. |
| Edge and application logs | TBD | No log-retention constant found in the workers or landing pages reviewed. |
| Backups | TBD | No backup retention period found in the legal or worker files reviewed. |
| Email suppression / unsubscribe | TBD | option-backend has an email suppressions migration. No retention interval in the footer template. |
| Checkout acceptance (timestamp and IP, as described on the MSA page) | TBD | oniyore-fe-landing MSA page says checkout records acceptance with a timestamp and IP. No retention number in that page or the checkout widget reviewed. |
| Operational records after cancel | TBD — current privacy page copy says up to 90 days; no deletion job found | oniyore-fe-landing/src/app/privacy/page.tsx text. Not a code schedule. |
Internal copy of this table: docs/compliance/retention-schedule.md.
Cookies and tags
Detail is on the Cookie Notice. Choices and Global Privacy Control are on Your Privacy Choices. Non-essential cookies and scripts load only after Accept all (or a saved grant). Reject all and Global Privacy Control keep them off. Reopen choices any time via Cookie settings in the footer.
- G-7EJ0ZCTWKW (GA4) — oniyore.com. Site analytics after a stored analytics-consent record. Evidence: infrastructure/lib/sendga4event-file-consumers.mjs FILE_CONFIG_IDS; oniyore-fe-landing docs/MEASUREMENT.md; option-fe-core analytics/ConsentedCollectors.tsx
- GTM-5SPZR9GS (GTM) — Suba client file config only (not oniyore.com). Tag container in that client file config. Evidence: infrastructure/lib/sendga4event-file-consumers.mjs suba-fe-landing
- G-TYY066NJ5M (GA4) — Suba client file config only (not oniyore.com). Analytics id in that client file config. Evidence: infrastructure/lib/sendga4event-file-consumers.mjs suba-fe-landing
- GTM-N65634SS (GTM) — Anna client file config only (not oniyore.com). Tag container in that client file config. Evidence: infrastructure/lib/sendga4event-file-consumers.mjs anna-consulente-fe-landing
- G-8TZ0J4BHGR (GA4) — personal-fe-landing file config (not oniyore.com). Analytics id in that file config. Evidence: infrastructure/lib/sendga4event-file-consumers.mjs personal-fe-landing
Searched and not found in option-root, oniyore-fe-landing, or option-fe-core: GTM-W937ZWKQ. It is not listed as a live tag.
Subprocessors and international transfers
The subprocessor list is generated from third parties found in the code and config reviewed for this draft. Where a region or transfer tool is not written in that code, the cell says so.
Data is processed in the United States and other countries.
Security incident
If we confirm a personal-data breach, the internal process is docs/compliance/incident-process.md. That draft says: contain, record, assess, notify affected people where the law requires it, and notify client controllers without waiting for a polished public post. Report a suspected incident to security@oniyore.com.
Rights and privacy requests
Email hello@oniyore.com or use the privacy request form for access, correction/rectification, deletion, or “Do Not Sell or Share.” We verify by email before acting. We aim to respond within 45 calendar days under US privacy law (California CCPA/CPRA; extendable as the statute allows), including when region is unknown on the form.
Sale and share
Oniyore does not sell or share personal information as those terms are defined under the CCPA/CPRA. Non-essential tags stay off when a visitor opts out or sends Global Privacy Control.
No Global Privacy Control signal on this response.