Who controls the information
The employer normally decides why employee information is used and is the data controller. ONBI provides the service and generally processes that information on the employer's instructions. ONBI is separately responsible for account, billing, security and product-contact information it collects for its own purposes.
Information the service may hold
Account and contact details; organisation, role and location memberships; rota and availability data; clock and break events; NFC card and security records; invitations and notifications; and subscription and invoice references. Stripe, rather than ONBI, receives full payment-card details.
How it is used
To provide the service, authenticate users, build rotas, verify attendance actions, maintain records, protect accounts, investigate faults and abuse, administer subscriptions, answer enquiries and meet legal obligations.
Location
Location may be checked during a clock action when the employer enables it. ONBI is not designed to continuously track employees away from those actions.
Service providers and transfers
ONBI uses specialist infrastructure providers including Supabase for database and authentication, Railway for hosted services and Stripe for subscriptions, invoices and payment collection. Cloudflare Turnstile protects public account registration from automated abuse. AI rota extraction is disabled unless separately approved and disclosed.
Retention and deletion
Records are kept only for the service, security and lawful employer retention needs. Employers can archive workplace membership while retaining necessary attendance evidence. Individuals can leave a workplace or request account deletion; some records may need to be retained by the employer or for security and legal claims.
Your rights
UK data-protection rights may include access, correction, deletion, restriction, objection and portability. Employee requests about workplace records should normally start with their employer.
Contact
Questions can be sent to privacy@onbi.ai. Do not email bank details, National Insurance numbers or passwords.