Privacy Policy

Last updated: 07.10.2026

This is a translation. In case of discrepancies, the German version prevails.

1. Controller

ONINO GmbH Alter Schlachthof 33, 76131 Karlsruhe, Germany Email: team@onino.io · Contact form: onino.io/book-a-demo

Further details are available in our Imprint.

2. Data Protection Officer

You can reach our Data Protection Officer at team@onino.io (subject "Data protection"), or by post at the address above, marked "Attn. Data Protection Officer".

3. Scope

This Privacy Policy applies to:

• our website onino.io,

• our self-service demo at demo.onino.io,

• our social media profiles, and

• communication with prospects and business contacts.

It does not apply to investor platforms that our clients operate under their own brand using the ONINO software. The respective platform operator is the controller for those platforms, and its own privacy policy applies.

4. Website onino.io

4.1 Provision and hosting

Our website is hosted by Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands. Framer uses Amazon Web Services infrastructure and acts as our processor.

• Data: IP address, date and time of access, page accessed, referrer URL, browser and operating system.

• Purpose: delivering the website, ensuring stability and security, in particular defending against attacks.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and functioning website.

• Retention: Log data is deleted as soon as it is no longer needed for these purposes, at the latest after [30] days. ⚠ Check against Framer.

4.2 Consent management (Usercentrics)

We use the consent management platform of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. It stores your cookie banner choices (consent ID, time, consents given or refused, banner version) in your browser and logs them so that we can prove consent.

• Legal basis: Section 25(2) no. 2 TDDDG for storage in your browser; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR for proof of consent.

• Retention: Your choices stay in your browser until you change or delete them. We keep the proof of consent for [3 years]. ⚠ Check against the Usercentrics settings.

4.3 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It controls which analytics and marketing services are loaded. Those services load only after you have consented (section 4.5). Tag Manager itself sets no cookies, but your IP address is transmitted to Google when it loads.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is managing the services we use efficiently and in line with your consent choices.

• Third country: USA, see section 8.

4.4 Cookieless audience measurement

We use Framer Analytics (Framer B.V., see above) and Ahrefs Web Analytics (Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581) to produce aggregated statistics: page views, referring sites, country and device type.

Neither service sets cookies or assigns persistent identifiers. Your IP address is only hashed together with browser information using a key that changes daily, and it is not stored. This makes it impossible to recognise you across different days.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is analysing use of our website in anonymised form and improving it.

• Third country: Ahrefs is based in Singapore, see section 8.

4.5 Analytics and marketing (only with your consent)

We load the following services only if you consent in the cookie banner. The legal basis is then Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future, using the "Privacy settings" link in the footer.

• Retention: The lifetime of each cookie is listed in the service overview in section 11. Google keeps analytics data for 14 months.

• Note on Google: Google services are not triggered without your consent (Consent Mode in "Basic" mode).

4.6 Demo requests and booking

If you request a demo through our form, we process your first name, last name, email address, company, website, your notes, how you heard about us, and the page language.

If you book a meeting through our booking calendar, we also process the selected time slot and the details you provide when booking. The calendar is provided by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. It loads only after you have consented in the privacy settings or activated it with a click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Your details are transferred via Zapier (Zapier, Inc., USA) to our CRM system Attio (Attio Limited, United Kingdom), and our team is notified via Slack (Slack Technologies Limited, Dublin, Ireland). Meetings are usually held via Google Meet (Google Ireland Limited).

• Purpose: handling your request, holding the meeting, maintaining the business relationship, and analysing which channels prospects use to find us.

• Legal basis: Art. 6(1)(b) GDPR for handling your request and the meeting (pre-contractual steps). Art. 6(1)(f) GDPR for CRM management and the analysis of referral channels. Our legitimate interest is handling business enquiries in an orderly way.

• Retention: If no business relationship results, we delete your data 24 months after our last contact.

• Third country: Cal.com and Zapier process data in the USA. Slack and Google may also process data in the USA. Attio processes data in the United Kingdom. See section 8.

4.7 Newsletter (Brevo)

We use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as our processor for our newsletter. Sign-up uses a double opt-in procedure: you receive an email with a confirmation link.

• Data: email address, [name], time of sign-up and confirmation, and the IP address used. With your consent, we also record whether and when you open the newsletter and which links you click.

• Legal basis: Art. 6(1)(a) GDPR. Proof of consent is based on Art. 6(1)(c) GDPR.

• Unsubscribe: at any time via the link in every email or by writing to team@onino.io.

• Retention: until you unsubscribe. We keep proof of your consent for up to 3 years afterwards.

4.8 Contact by email

If you contact us by email, we process your details to handle your request. We use Google Workspace (Google Ireland Limited) for this.

• Legal basis: Art. 6(1)(b) GDPR if your request concerns or is aimed at a contract; otherwise Art. 6(1)(f) GDPR.

• Retention: as in section 4.6.

5. Self-service demo (demo.onino.io)

Our demo lets you try an investor platform in your own branding. All investment products, investors and transactions in the demo are simulated.

5.1 Hosting and security

The demo is hosted by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. It uses Cloudflare, Inc., USA, for delivery and protection against attacks. Both act as our processors. The same log data as in section 4.1 is processed, for the same purposes and on the same legal basis.

5.2 Branding without an account

Without an account, you can choose a logo, company name, colour, shape and font. These details are initially stored only in your browser and transferred to our servers when you create an account.

• Legal basis: Art. 6(1)(b) GDPR; Section 25(2) no. 2 TDDDG for storage in your browser.

5.3 Demo account

For the full demo, you create a free account. We process:

• your business email address and your password (stored only in encrypted form),

• the verification status of your email address and your login times,

• your branding,

• the demo assets you create (e.g. project name, description, terms, issuer, uploaded files).

Database, authentication and file storage are provided by Supabase, Inc. as our processor. The servers are located in Frankfurt am Main, Germany. Confirmation and login emails are sent via Supabase.

• Purpose: providing the demo.

• Legal basis: Art. 6(1)(b) GDPR (agreement on the use of the demo). Section 25(2) no. 2 TDDDG for the session token.

Please do not enter personal data of third parties or confidential information in demo assets.

5.4 Sharing via link

You can share your branded demo with colleagues via a link. Anyone who receives the link can create their own demo account and will then see your branding and your demo assets. You decide who you share the link with.

• Legal basis: Art. 6(1)(b) GDPR.

5.5 Transfer to our CRM

When you create a demo account, we transfer your email address, company name and the time of registration to our CRM system Attio. This helps us keep track of prospects interested in our product.

• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is managing business contacts. You can object at any time (section 9).

• Note: We only send you marketing emails with your separate consent.

5.6 Support chat (Intercom)

For the support chat in the demo, we use Intercom (Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18–21 St. Stephen's Green, Dublin 2, Ireland). The chat loads only after you have consented in the privacy settings. Intercom processes your messages, your email address where applicable, and technical data, and sets cookies.

• Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

• Third country: USA, see section 8.

5.7 Analytics in the demo

With your consent, we also use Google Analytics 4 in the demo (section 4.5). [We use Lovable's built-in visitor statistics only with your consent.] ⚠ Remove this sentence if Lovable Analytics is disabled (recommended).

5.8 Retention

We store your account data, branding and demo assets until you delete your account. You can request deletion at any time by emailing team@onino.io. Section 4.6 applies to the CRM record.

6. Social media

We have profiles on LinkedIn, X, Discord and YouTube. Our website only links to these profiles. No plugins are embedded, and no data flows to the networks unless you click a link.

When you visit our profiles, the respective operator processes your data under its own privacy policy. We only see your public interactions (e.g. comments, messages to us) and aggregated statistics.

• LinkedIn: For page statistics ("Page Insights"), we are joint controllers with LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (Art. 26 GDPR). The agreement is available at legal.linkedin.com/pages-joint-controller-addendum. It is best to exercise your rights directly with LinkedIn.

• X: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland.

• Discord: Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, the Netherlands.

• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Legal basis for our own processing: Art. 6(1)(f) GDPR. Our legitimate interest is communicating with prospects and the public.

7. Recipients

We only share your data where necessary for the purposes described:

• with the service providers named above, who act on our instructions as processors (Art. 28 GDPR),

• in individual cases with tax advisers, auditors or lawyers who are bound by professional secrecy,

• with authorities and courts where we are legally obliged to do so.

We do not sell your data.

8. Transfers to third countries

Some service providers process data outside the EU/EEA. We only transfer data there on the following bases:

• USA: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the recipient is certified. Otherwise we conclude EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

• United Kingdom (Attio): the European Commission's adequacy decision (Art. 45 GDPR).

• Singapore (Ahrefs; Supabase, Inc. as contracting party): EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

You can request a copy of the Standard Contractual Clauses at team@onino.io.

9. Your rights

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR),

• have inaccurate data corrected (Art. 16 GDPR),

• have your data erased (Art. 17 GDPR),

• restrict processing (Art. 18 GDPR),

• data portability (Art. 20 GDPR),

• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.

An email to team@onino.io is enough. Exercising your rights is free of charge.

Right to lodge a complaint: You can complain to a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

10. Obligation to provide data and automated decisions

You are not legally or contractually obliged to provide your data. Without the details marked as mandatory, however, we cannot handle your request or set up a demo account.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

11. Cookies and similar technologies

Cookies and similar technologies (e.g. local storage, pixels) store information on your device or read it from it. We distinguish between:

• Strictly necessary: e.g. storing your cookie choices and your login to the demo. Legal basis: Section 25(2) no. 2 TDDDG. No consent is required.

• Functional, analytics and marketing: only with your consent. Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

The overview below lists, for each service we use, the provider, the purpose, the legal basis, the cookies or entries stored, and how long they are kept.

Website onino.io

Strictly necessary (no consent required)

Usercentrics Consent Management Platform

• Provider: Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany

• Purpose: storing and proving your cookie banner choices

• Legal basis: Section 25(2) no. 2 TDDDG; Art. 6(1)(c) GDPR

• Storage: local storage entries ("uc_…", "ucData") ⚠ check in the browser; [12 months] ⚠ check against the Usercentrics setting

• Third country: none

Google Tag Manager

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

• Purpose: controlling the services that load only after your consent

• Legal basis: Art. 6(1)(f) GDPR

• Storage: no cookies

• Third country: USA (EU-U.S. Data Privacy Framework)

Framer Analytics

• Provider: Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, the Netherlands

• Purpose: anonymous audience measurement

• Legal basis: Art. 6(1)(f) GDPR

• Storage: no cookies; the IP address is only hashed and not stored

• Third country: none

Ahrefs Web Analytics

• Provider: Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581

• Purpose: anonymous audience measurement

• Legal basis: Art. 6(1)(f) GDPR

• Storage: no cookies; the IP address is only hashed and not stored

• Third country: Singapore (EU Standard Contractual Clauses)

Functional (only with your consent)

Cal.com

• Provider: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA

• Purpose: displaying the booking calendar and booking meetings

• Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG

• Storage: [cookies/entries ⚠ check in the browser]

• Third country: USA (EU-U.S. Data Privacy Framework)

Analytics (only with your consent)

Google Analytics 4

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

• Purpose: analysing website use

• Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG

• Cookies: "_ga" (2 years), "_ga_DZF7HRTLY3" (2 years)

• Third country: USA (EU-U.S. Data Privacy Framework)

Microsoft Clarity

• Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland

• Purpose: heatmaps and session recordings

• Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG

• Cookies: "_clck" (1 year), "_clsk" (1 day), "CLID" (1 year), "MUID" (1 year)

• Third country: USA (EU-U.S. Data Privacy Framework)

Marketing (only with your consent)

Google Ads conversion tracking

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

• Purpose: measuring whether our ads lead to demo requests or bookings

• Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG

• Cookies: "_gcl_au" (90 days), "_gcl_aw" (90 days)

• Third country: USA (EU-U.S. Data Privacy Framework)

OpenAI Ads Pixel

• Provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland

• Purpose: measuring whether ads in ChatGPT lead to demo requests or bookings

• Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG

• Cookies: "__oppref" ([lifetime] ⚠ check in the browser)

• Third country: USA ⚠ check the safeguard (DPF or Standard Contractual Clauses)

Demo demo.onino.io

Strictly necessary (no consent required)

Demo login (Supabase)

• Provider: Supabase, Inc. (servers in Frankfurt am Main, Germany)

• Purpose: keeping you logged in to the demo

• Legal basis: Section 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR

• Storage: local storage entry "sb-kwvpzlycodbpheuqinyf-auth-token", until you log out

• Third country: Singapore (contracting party; EU Standard Contractual Clauses)

Usercentrics Consent Management Platform

• as above under "Website onino.io"

Functional (only with your consent)

Intercom (support chat)

• Provider: Intercom R&D Unlimited Company, 2nd Floor, Stephen Court, 18–21 St. Stephen's Green, Dublin 2, Ireland

• Purpose: support chat

• Legal basis: Art. 6(1)(a) GDPR; Section 25(1) TDDDG

• Cookies: "intercom-id-tbezc08m" (9 months), "intercom-session-tbezc08m" (7 days), "intercom-device-id-tbezc08m" (9 months)

• Third country: USA (EU-U.S. Data Privacy Framework)

Analytics (only with your consent)

Google Analytics 4

• as above under "Website onino.io"

Change or withdraw your consent: at any time via the "Privacy settings" link in the footer. You can also delete or block cookies in your browser settings.

12. Changes

We update this Privacy Policy when our services or the legal situation change. The version published here applies.