1. Who we are
Onyxlot ("we", "us", "our") provides lead generation and onboarding automation for introducing brokers (IBs) and signal groups. Onyxlot is a brand run by its founders and is not yet a registered company. When it becomes one, we'll update this page with the company's name and details.
For this website and any enquiry you send us, we are the "controller" of your personal data, which means we decide how and why it's used. Contact us at mohammedkhan.aiautomation@gmail.com or send us a DM on Instagram.
2. What we collect
What you give us
When you fill in the "Get started" form:
- Your name, Instagram handle, WhatsApp number (with country) and, if you choose, your email address.
- Business information: how many traders are under you, how many new traders you bring in a month, and anything you tell us about what's slowing your growth.
Anything you send us later by email, WhatsApp, Instagram or on a call, such as messages, call notes and the numbers you share about your business.
What's collected automatically
- Server logs. Our hosting provider (Netlify) records basic technical information when you visit, such as your IP address, browser type and the pages requested, to run and protect the site.
- Fonts. Our pages load fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address.
- The "Ask Onyxlot" box. Questions you type are answered from the FAQ on the page. We don't save them. They may appear briefly in our hosting provider's technical logs.
- Visitor statistics. We use Umami, a privacy-friendly analytics tool, to count visits and see which pages are used, roughly where visitors are (country, region and city, worked out from the IP address), how they found us, their device type, and which buttons are clicked. Umami doesn't use cookies, doesn't store your IP address and doesn't build a profile of you, so we can't identify you from it. The data is stored in the EU.
We don't use advertising pixels or tracking cookies.
3. How we use it, and why
| What we do | Legal basis (UK/EU GDPR) |
|---|---|
| Reply to your enquiry, review your numbers, arrange and hold a discovery call | Steps you've asked us to take before a possible contract, and our legitimate interest in responding to business enquiries |
| Decide whether we're a good fit and prepare a proposal | Legitimate interests |
| Deliver our service if you become a client | Performance of a contract |
| Keep the site secure and working | Legitimate interests |
| Count visits and see which pages and buttons are used, to improve the site | Legitimate interests (anonymous, cookie-free statistics) |
| Keep records we're required to keep, and handle legal claims | Legal obligation and legitimate interests |
We don't use your data for automated decisions that have legal or similarly significant effects on you, and we don't add you to marketing lists. If we ever want to send you marketing, we'll ask first, and you can opt out at any time.
4. Who we share it with
We don't sell your personal data. We share it only with service providers who help us run Onyxlot, and only as much as they need:
| Provider | What for |
|---|---|
| Netlify | Hosting this website and receiving form submissions |
| Google (Gmail, Google Fonts) | Our email inbox, where form submissions are delivered, and website fonts |
| Meta (WhatsApp, Instagram) | Messaging you when you've asked us to get in touch |
| Google reCAPTCHA | Spam protection on the form. Google checks the "I'm not a robot" box and receives technical data about your browser and device |
| Make (automation) | Sends our follow-up email after you send the form, using the details you gave us |
| Umami (analytics, EU-hosted) | Anonymous visitor statistics: pages viewed, approximate location, referrer, device type and button clicks |
| Calendly (scheduling) | Booking your call. After you send the form, your name and email are passed to Calendly so the booking page is filled in for you |
We may also share data if the law requires it, to protect our rights, or with a buyer or successor if the business is sold or reorganised. They would be bound by this policy.
5. International transfers
Some of our providers, and the people running Onyxlot, are based outside the UK and the European Economic Area, including in the United States and Saudi Arabia. When your data leaves the UK or EEA, we rely on recognised safeguards: adequacy decisions (including the UK–US data bridge and the EU–US Data Privacy Framework, where the provider is certified), or standard contractual clauses and the UK addendum offered by our providers.
6. How long we keep it
- Enquiries that don't go further: deleted within 12 months of our last contact.
- Clients: for as long as we work together, then up to 6 years for legal, tax and accounting records.
- Server logs: kept by our hosting provider for its standard short period.
7. Cookies and similar tech
We don't set advertising or analytics cookies, so you won't see a cookie banner. Our visitor statistics (Umami) work without cookies. The site stores one small value in your browser's session storage so the loading animation only plays fully once per visit. It never leaves your device and disappears when you close the tab. Netlify may use strictly necessary technical measures to deliver the site securely.
8. Your rights (UK and EU)
You can ask us to:
- give you a copy of the data we hold about you (access);
- correct it (rectification) or delete it (erasure);
- limit how we use it (restriction), or send it to you or another provider (portability);
- stop using it where we rely on legitimate interests (objection).
Email mohammedkhan.aiautomation@gmail.com. We'll reply within one month and won't charge you. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. We'd appreciate the chance to fix it first.
9. If you're in the US
We don't sell or share personal information for cross-context behavioural advertising, and we don't use or disclose sensitive personal information. Depending on your state (for example California, Virginia, Colorado or Texas), you may have the right to know what we collect, and to access, correct or delete it. We won't treat you differently for using these rights. To make a request, email mohammedkhan.aiautomation@gmail.com. We may need to confirm your identity first, and you can use an authorised agent.
The categories we collect are listed in section 2: identifiers (name, handle, phone, email), commercial information about your business, and internet activity limited to server logs. We collect them from you and your browser, for the purposes in section 3.
10. Data we handle for clients
When we run Instagram outreach and onboarding on behalf of a client (an IB or signal group), we process the personal data of that client's leads on the client's instructions. In that case the client is the controller and we act as their processor, under a written agreement with them. If you're one of those leads and have a question, contact the business that messaged you, or email us and we'll pass your request on.
11. Security
We use reputable providers, encrypted connections (HTTPS), access limited to the people who need it, and two-factor authentication on our accounts. No system is perfectly secure. If a breach puts you at risk, we'll tell you and the regulator when the law requires it.
12. Children
Our services are for businesses and adults only. We don't knowingly collect data from anyone under 18. If you think a child has sent us their details, contact us and we'll delete them.
13. Changes and contact
We'll update this policy when our practices change, for example when we register the company or add AI answers to the "Ask Onyxlot" box, and change the date at the top. For anything about your data, email mohammedkhan.aiautomation@gmail.com or send us a DM on Instagram.