Privacy Policy

OneHux Forge ("Forge," "we," "us," or "our") is a brand and product owned and operated by OneHux ("OneHux," our parent company). This Privacy Policy explains how we collect, use, disclose, and safeguard information when a business ("Vendor") uses OneHux Forge to train and deploy an AI agent, and when that agent interacts with a Vendor's own customers ("End Users") across connected channels such as WhatsApp, Instagram, Facebook Messenger, phone, or a website chat widget.

Using OneHux Forge also means you agree to OneHux's own group-wide Terms and Privacy Policy, which apply to every OneHux product, in addition to the Forge-specific terms set out here. Where this policy is silent on a point, OneHux's group-wide policy governs.

1. Information We Collect

Account information. When a Vendor signs up, identity is provided by OneHux SSO (our shared single sign-on system) — name, email address, and a unique account identifier. We do not separately collect or store passwords; authentication is handled entirely by OneHux SSO.

Business and training data. A Vendor may upload documents, FAQs, pricing sheets, website URLs, audio recordings, images, and Q&A pairs to train their agent. This content is processed, chunked, and converted into vector embeddings for retrieval-augmented responses, and is stored in a vendor-isolated database — one Vendor's training data is never accessible to another Vendor's agent.

Conversation data. Messages exchanged between a Vendor and their own agent (while testing or configuring it), and between an End User and a deployed agent (over WhatsApp, Instagram, Facebook Messenger, phone, or the website widget), are logged so the agent can maintain context within a conversation and so the Vendor can review conversation history and hand off to a human when needed.

Channel connection data. When a Vendor connects a channel (for example, a Facebook Page or WhatsApp Business number), we store the access credentials needed to send and receive messages on that channel. These credentials are encrypted at rest and are never displayed to anyone other than the connecting Vendor.

Payment data. Credit purchases and subscription payments are processed by OneHux Pay, our payment processing partner. We store a record of the transaction (amount, date, plan or credit package, and a payment reference) but never receive or store full card numbers, bank account numbers, or other raw payment instrument details — those are handled entirely by our payment processor.

Usage and device data. We collect standard technical data needed to operate the service securely, including IP address, browser/device information, and usage events (for example, which capability an agent used, and how many credits a request cost).

2. How We Use Information

• To create and maintain a Vendor's account and agent, and to authenticate sign-ins via OneHux SSO.
• To train a Vendor's agent on the data that Vendor supplies, so it can answer questions specific to that Vendor's business.
• To generate agent responses, using third-party AI model providers described in Section 4 below.
• To send and receive messages through the communication channels a Vendor has connected.
• To meter and bill usage against a Vendor's credit balance or subscription plan.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To provide customer support and respond to inquiries.
• To comply with legal obligations and enforce our Terms and Conditions.

3. How We Share Information

We do not sell personal information. We share information only as follows:

• With the Vendor's own agent and workspace. An End User's messages are shared with the specific Vendor's agent they are messaging, and are visible to that Vendor in their inbox — the same way a message sent to any business's WhatsApp number or support inbox would be.
• AI model providers (OpenRouter, Anthropic, Google Gemini, DeepSeek, ElevenLabs, FAL.ai) process message content and training data transiently to generate text, speech, image, or video responses. These providers are bound by their own data processing terms and do not use content sent through OneHux Forge to train their own foundation models, except where a provider's standard terms state otherwise for that specific model.
• Communication channel platforms (Meta — WhatsApp, Instagram, and Facebook Messenger; telephony providers for phone channels) receive and deliver messages as required to operate that channel, under each platform's own data policies.
• Payment processing is handled by OneHux Pay / Paystack, who receive the information necessary to process a transaction.
• Infrastructure providers (cloud hosting, database, and cache infrastructure) store and process data on our behalf under contractual confidentiality obligations.
• Legal and safety. We may disclose information if required by law, legal process, or to protect the rights, property, or safety of OneHux, our users, or the public.
• OneHux group companies. As a OneHux brand, Forge may share account-level information with OneHux for identity, billing, fraud-prevention, and platform-wide support purposes, consistent with OneHux's own Privacy Policy.

4. Meta Platform Data (WhatsApp, Instagram, Facebook)

Where a Vendor connects a Facebook Page, Instagram Business account, or WhatsApp Business number, OneHux Forge accesses only the data and permissions the Vendor explicitly authorizes during that connection — for example, the ability to send and receive messages on the Vendor's behalf, publish posts the Vendor requests, and read/respond to comments. We do not access a Vendor's personal Facebook profile, personal messages unrelated to their connected Page, or any data outside the scope of the permissions granted. Data obtained through Meta's APIs is used solely to operate the connected channel for that Vendor and is deleted upon disconnection, subject to the retention rules in Section 6.

5. Cookies and Similar Technologies

OneHux Forge uses a minimal set of cookies required for the service to function: an httpOnly authentication cookie that keeps a Vendor signed in, and no third-party advertising or tracking cookies. This cookie cannot be read by JavaScript running in the browser and is never used for cross-site tracking.

6. Data Retention

We retain account and conversation data for as long as an account remains active, and for a reasonable period afterward to comply with legal, accounting, or dispute-resolution obligations. Uploaded training files are retained only while a training source is pending or being processed; once training completes, only the extracted, embedded knowledge is kept — the original uploaded file is deleted, unless retained briefly to allow a retry after a processing failure. Channel credentials are deleted when a Vendor disconnects that channel.

7. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Vendors can access and manage most of their own data directly from their OneHux Forge dashboard. Anyone — Vendor or End User — may request deletion of their data at any time; see our Data Deletion page for exactly how.

8. Children's Privacy

OneHux Forge is intended for use by business owners and their customers and is not directed at children. We do not knowingly collect personal information from children under the age of 13 (or the minimum age required in your jurisdiction). If you believe a child has provided us with personal information, contact us using the details below and we will delete it.

9. Security

We use industry-standard safeguards to protect information, including encryption of channel credentials at rest, encrypted connections in transit, tenant isolation between Vendors' data, and access controls limiting who can view stored data. No system is completely secure, and we cannot guarantee absolute security, but we work to continuously improve our safeguards.

10. International Data Transfers

OneHux Forge and its service providers may process and store data in countries other than your own. Where required, we rely on appropriate safeguards for cross-border data transfer in accordance with applicable law, including the Nigeria Data Protection Act.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and, for material changes, provide additional notice such as an in-app notification or email.

12. Contact Us

Questions about this Privacy Policy or how OneHux Forge handles data can be sent to [email protected].