How We Handle Your Data
Your trust matters. Here's exactly what OneAboveAI collects, how we protect it, and how we use it to deliver your audit and growth work.
This Privacy Policy explains how Autonomix OU (trading as OneAboveAI) collects, uses, and protects your personal data. We are committed to GDPR and CCPA/CPRA compliance. For related legal documents, see our Terms of Service and Cookie Policy.
1. Data Controller
The data controller responsible for your personal data is Autonomix OU, trading as OneAboveAI, a company registered in Estonia (Registration number: [Registration Number] — to be confirmed; VAT: [VAT Number] — to be confirmed). Registered office: Harju maakond, Tallinn, Estonia, 11415. US correspondence address: Sheridan, WY, 82801, USA. For data protection inquiries, contact our Data Protection contact at privacy@oneaboveai.com.
2. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on Personal Data. "GDPR" means the EU General Data Protection Regulation (EU) 2016/679. "CCPA/CPRA" means the California Consumer Privacy Act as amended by the California Privacy Rights Act. "Services" means the Revenue Leaks Audit, Growth Audit, fix implementation, and Growth Engine offerings.
3. Information We Collect
When you run a Revenue Leaks Audit, we analyze your website externally and generate a diagnostic report. If you submit a form — contact, demo request, partner application, or resource download — we collect the details you provide, such as your name, email, company, phone, and message. If you purchase a fix, we collect payment information processed securely through Stripe; we never store full card details on our servers. We may also automatically collect technical data such as IP address, browser type, device information, and pages visited, through cookies and similar technologies (see Section 6).
4. Legal Basis for Processing (GDPR Article 6)
If you are located in the EEA, UK, or Switzerland, we process your Personal Data on the following legal grounds: (a) Consent (Art. 6(1)(a)) — for marketing communications, analytics, and non-essential cookies; (b) Performance of a contract (Art. 6(1)(b)) — for delivering Services you request (e.g., audit, fix implementation, payments); (c) Legal obligation (Art. 6(1)(c)) — for tax, accounting, and legal record-keeping; (d) Legitimate interests (Art. 6(1)(f)) — for security, fraud prevention, and improving our Services, balanced against your rights.
5. How We Use Your Information
We use your information to deliver and improve our services: to generate and share your audit report, to process payments and implement fixes you approve, to respond to your inquiries, to send you relevant updates if you've opted in, and to comply with legal obligations. We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.
7. Audit Data & Report Privacy
Your audit report is identified by a unique, unlisted slug and is only accessible to anyone who has that link. The report contains your site's technical metrics and any contact details you entered at checkout. We recommend treating report links as confidential. You can share, download, or request deletion of your report at any time by contacting privacy@oneaboveai.com.
8. Access for Implementation
If you purchase a fix, we'll request scoped, revocable access only to the specific systems required for that work. Access is collected through a secure form, used solely to implement the approved fix, and revoked once the work is verified and complete. We never request passwords via email or chat.
9. Sub-processors & Third-Party Services
We share personal data with the following trusted sub-processors, each operating under its own privacy policy and, where required, under Standard Contractual Clauses with us: Stripe (payment processing — PCI-DSS compliant), Vercel (hosting and infrastructure), Cloudflare (CDN, security, DDoS protection), Google (PageSpeed Insights API and Google Analytics), and Redis/Vercel KV (secure storage of audit reports). We share only the minimum data necessary to deliver the relevant service.
10. International Data Transfers
Some of our sub-processors (including Stripe, Vercel, Cloudflare, and Google) are located in the United States or other countries outside the EEA. When we transfer personal data outside the EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, adequacy decisions. You may request a copy of the relevant safeguards by contacting privacy@oneaboveai.com.
11. Data Retention
We retain lead submissions and audit reports for as long as needed to provide our services and support ongoing client relationships, and thereafter only as required for legitimate business or legal record-keeping (e.g., tax records for 7 years). Audit reports are typically retained for 24 months unless you request deletion earlier. You may request deletion at any time by contacting privacy@oneaboveai.com.
12. Data Security
We protect your data with industry-standard measures including encrypted transmission (HTTPS), secure storage, strict access controls, and regular security reviews. Payment data is handled entirely by Stripe, a PCI-DSS compliant provider. No method of transmission or storage is 100% secure, but we work hard to safeguard your information.
13. Your Rights (GDPR)
If you are located in the EEA, UK, or Switzerland, you have the following rights: (a) Right of access — to obtain a copy of your Personal Data; (b) Right to rectification — to correct inaccurate data; (c) Right to erasure — to have your data deleted; (d) Right to restrict processing; (e) Right to data portability; (f) Right to object — including to direct marketing; (g) Right to withdraw consent at any time (without affecting the lawfulness of prior processing); (h) Right not to be subject to automated decision-making with legal or significant effects. To exercise these rights, contact privacy@oneaboveai.com. We respond to verified requests within 30 days.
14. Your Rights (CCPA/CPRA — California)
If you are a California resident, you have the right to: (a) know what Personal Data we collect, use, and share; (b) request deletion of your Personal Data; (c) request correction of inaccurate Personal Data; (d) opt out of the "sale" or "sharing" of your Personal Data — we do not sell your Personal Data; (e) limit use of sensitive Personal Data; (f) not be discriminated against for exercising your rights. To exercise these rights, contact privacy@oneaboveai.com.
15. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. As our legal entity (Autonomix OU) is established in Estonia, the lead supervisory authority is the Estonian Data Protection Inspectorate (AKI), Tatari 39, 10134 Tallinn, Estonia — https://www.aki.ee/en. If you are located in another EU/EEA country, you may contact your local supervisory authority. California residents may contact the California Privacy Protection Agency (CPPA).
16. Automated Decision-Making & AI
Our Revenue Leaks Audit uses deterministic rules to generate findings — not AI decision-making that produces legal or similarly significant effects. We do not use your data for automated profiling that materially affects you. Any AI-assisted features (such as content summarization) are assistive only and are subject to human review where required.
17. Children's Privacy
Our Services are intended for users aged 16 and older. We do not knowingly collect Personal Data from children under 16. If we become aware that we have collected such data, we will delete it promptly. If you believe we may have collected data from a child under 16, please contact privacy@oneaboveai.com.
18. Third-Party Links
Our Website may contain links to third-party websites (e.g., social media profiles, payment providers, or partner sites). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing any personal data.
19. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date, and where required by law (e.g., GDPR), we will notify you by email or a prominent notice on the Website. Continued use of our services after changes constitutes acceptance of the revised policy.
20. Contact
Questions about this policy or your data? Contact us at privacy@oneaboveai.com (data protection), legal@oneaboveai.com (legal), or info@oneaboveai.com (general). You can also write to us at: Autonomix OU (trading as OneAboveAI), Harju maakond, Tallinn, Estonia, 11415, EU Office; or Sheridan, WY, 82801, USA, US Office.
21. Legal Entity
Autonomix OU, trading as OneAboveAI. Registered in Estonia. Registration number: [Registration Number] (to be confirmed). VAT: [VAT Number] (to be confirmed). Registered office: Harju maakond, Tallinn, Estonia, 11415. US correspondence address: Sheridan, WY, 82801, USA.
Autonomix OU (trading as OneAboveAI)
- EU Office: Harju maakond, Tallinn, Estonia, 11415
- US Office: Sheridan, WY, 82801, USA
- Registration: [Registration Number] (to be confirmed)
- VAT: [VAT Number] (to be confirmed)
- privacy@oneaboveai.com(data protection)
- legal@oneaboveai.com(legal)