Privacy policy.

Last updated: July 20, 2026 · Draft pending legal review

Onelios is operated by KCF LLC, which is the company responsible for the personal data described in this policy.

1. The short version

• We collect what we need to run your business online — nothing more.
• We never sell personal data. Not yours, not your customers'.
• Your customers' inquiries (leads, bookings) belong to you; we process them only on your behalf.
• You can download your site content and customer data, or delete your account from Settings.

2. What we collect and why

Information you give us

Your business details (name, trade, service area, services, hours), content you upload, and your account email. This is the raw material the AI uses to build and run your presence — it is the product working as intended, not a data grab.

Information generated by using the Service

What happens on your account (the receipt feed on your dashboard), counts such as website visits, quote requests and bookings, and standard technical logs that keep the Service secure and reliable. We use privacy-respecting analytics on our own site; we don't follow you around the internet.

Your customers' information

When someone requests a quote or books through a website we host for you, their details (name, contact, message) are processed by us as your service provider and delivered to you. We use this data only to operate your Service — delivering the quote request or booking to you, and sending the confirmation or review request you ask us to send — never for our own marketing, profiling, or resale. If your customers ask about their data, the relationship is with your business; we support you in honoring access and deletion requests.

3. How AI processing works

The AI generates content from the business information you provide. Prompts and outputs are logged so we can audit quality and show you the receipt trail. We do not use your private business data to train models for other customers, and our model providers are bound by agreements that prohibit them from doing so either.

4. Who can see your data

Our staff, on a need-to-run-the-service basis. Subprocessors we rely on to operate — hosting, email delivery, AI model providers — each under contracts limiting them to our instructions; the current list is available on request and we announce changes. Authorities, only when the law genuinely requires it, and narrowly. That's the list. There is no "marketing partners" paragraph because there are no marketing partners.

5. Security and retention

Data is encrypted in transit and at rest, access is role-restricted and logged, and every change to your business — human or AI — lands in an audit trail. We keep data while your account is active; when you delete content or close your account, it is removed from production promptly and from backups on their expiry schedule (at most 30 days), except where the law requires longer retention.

6. Your controls

• Export: download static HTML and CSV/JSON data with gallery links, free, up to 12 exports per website in 24 hours. Photo files and working forms, booking and email services are not included.
• Delete: remove specific content, specific leads, or your entire account.
• Correct: fix anything the AI knows about your business, any time, in plain language.
• Object or complain: use the contact form and a human reads it. If you're in a jurisdiction with a data authority, you may also contact them.

7. Cookies

We use essential cookies to keep you signed in and the Service working, and a privacy-respecting analytics cookie to understand aggregate usage. No cross-site ad tracking. Where consent is legally required, we ask, and "decline" is a one-click, equally prominent choice.

8. Children

The Service is for businesses and not directed at children under 16; we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

9. Changes to this policy

If we change this policy in any way that affects you, we'll say so plainly — in your Monday digest and by email — at least 30 days before it takes effect. We will never change "we don't sell your data" because a policy update said so quietly.

10. Contact

Use the contact form — a person reads it.