1. Who we are

onmsg ("we", "us", "our") provides website customer messaging software: an embeddable chat widget, an AI agent that answers from knowledge a customer supplies, visual conversation flows and a shared team inbox. This policy covers information we collect through our website at onmsg.app and through the onmsg service.

2. Information we collect

We collect information you give us directly, including:

Account details such as your name, email address and workspace settings
Messages you send through our contact form or the chat widget on this website
Content you upload as knowledge sources (pasted text, documents, imported pages)
Conversation data created when visitors use a chat widget on a site you operate, including message content and any details captured by a form or field step
Billing information processed by our payment provider. We do not store full card details ourselves

We also collect limited technical information automatically, such as your IP address, browser type and pages viewed, to keep the service secure and working.

3. How we use your information

To provide, operate, maintain, secure and support the onmsg service, including the AI features described in section 8, which answer from knowledge sources you supply
To answer your enquiries and provide support
To process subscriptions and send related account information
To detect abuse, spam and security problems
To send product communications where you have asked to receive them

Where information comes from a Google or Microsoft mailbox, our use of it is limited to the purposes set out in section 5. We do not use it to train, fine-tune, evaluate or improve any model, and we do not use it for advertising or profiling.

4. Data you control as a site operator

If you run a site on onmsg, you decide what knowledge you upload, what your flows collect from visitors, how long conversation data is retained (within the retention setting your plan allows), and who on your team can see it. You are the controller of that data; we process it on your behalf so the service can function. You can edit, reindex or delete knowledge sources at any time from your workspace.

5. Connected messaging channels and mailboxes

If you connect an external channel to your onmsg inbox (WhatsApp, Facebook Messenger, Instagram, Slack, Microsoft Teams, Telegram, Gmail, Google Workspace, Outlook.com or Microsoft 365), we receive the messages sent to that channel and deliver the replies your team writes. We store the access credentials you grant us (for example an OAuth refresh token or a bot token) encrypted at rest, and use them only to read new messages addressed to the connected account and to send your team's replies on that account's behalf. Disconnecting a channel from the Channels settings deletes the stored credential immediately.

Google user data. When you connect a Gmail or Google Workspace mailbox, onmsg requests the Google scopes gmail.readonly, gmail.send and userinfo.email. We use gmail.readonly to read new messages that arrive in the connected mailbox's Inbox so your team can see and answer them as conversations, and to skip newsletters, receipts and other automated mail that is not a customer writing to you. We use gmail.send only to send the replies your team writes in onmsg, as threaded responses from the connected address to an existing inbound message. We use userinfo.email to identify which mailbox was connected. We store the message text, sender, subject and metadata of ingested messages, and a reference to attachments; we do not download attachment contents. We do not use Google user data for advertising, do not sell it, do not let humans read it except with your explicit consent for support or as required for security or legal reasons, and do not transfer it to third parties except as needed to provide the service you asked for (for example to our hosting provider, and never to an artificial-intelligence or machine-learning provider) or where the law requires it. onmsg's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not send Google user data to any artificial-intelligence or machine-learning service; see section 8. You can revoke onmsg's access at any time from the Channels settings or at myaccount.google.com/permissions.

Microsoft user data. When you connect an Outlook.com or Microsoft 365 mailbox, onmsg requests the Microsoft Graph delegated permissions Mail.ReadWrite, Mail.Send and User.Read, and uses them in the same way and under the same limits as described for Google above: reading new Inbox messages to show them as conversations, creating and sending threaded replies your team writes, and identifying the connected mailbox. You can revoke access from the Channels settings or at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work accounts).

6. Data deletion

You can delete data yourself at any time: delete individual conversations or knowledge sources from your workspace, or disconnect a channel or mailbox to delete its stored credential. To delete your whole onmsg account, sign in to the onmsg app (iPhone, Android or chat.onmsg.app), open Settings (or Your sites, then Account) and choose Delete your account. This cancels any paid plan immediately and permanently deletes every site you own with its conversations, visitors, flows, knowledge and uploaded files, your connected channels and their stored credentials, your access to sites other people have shared with you, and your sign-in. Conversation history is also removed automatically when your plan's retention period ends (see Data retention below). Copies in encrypted backups are overwritten within 30 days. To request deletion of any data we hold about you, or to confirm a deletion, email hello@onmsg.app and we will complete it within 30 days. If you messaged a business that uses onmsg, on its website or on WhatsApp, Messenger or Instagram, see Data deletion for how to have your messages and contact details deleted.

7. Sharing your information

We do not sell your personal information. We share it only with:

Service providers who help us operate: hosting, storage, payment processing and email delivery. Where you use the included platform AI, the AI provider that generates the answer receives the knowledge text and the website-chat or API conversation needed to produce it, never Google or Microsoft mailbox data
An AI provider of your own choosing, if you configure a bring-your-own-key setup. In that case your usage is also subject to that provider's terms and privacy practices. Again, Google and Microsoft mailbox data is never sent to it
Professional advisors, and authorities where the law requires it

8. Artificial intelligence and machine learning

onmsg's AI features answer from the knowledge sources you provide and, for website chat, the conversation with the visitor. Two configurations exist.

Included platform AI. By default, answers are generated with the Google Gemini API (gemini-2.5-flash) using onmsg's own platform credentials, and knowledge retrieval uses the Gemini embedding model gemini-embedding-001. The knowledge text you upload and the website-chat conversation needed to answer a question are sent to that provider for the purpose of producing the response.
Bring your own key. You may instead connect your own provider account. The choices are Google Gemini, OpenAI, Anthropic, or OpenRouter, a gateway that routes to models hosted by other providers. Your content is then processed under your own agreement with that provider.

Google user data is never sent to an AI or machine-learning service. Message content, sender, subject, metadata, attachments and anything derived from them that we receive through the Gmail, Google Workspace or other Google APIs described in section 5 are never transferred to onmsg's platform AI, to a bring-your-own-key provider, to a model gateway or aggregator, or to any other machine-learning service, and are never used to create, train, fine-tune, evaluate or improve a generalised or foundational model. The same applies to mailbox data from Outlook.com and Microsoft 365. Mailbox conversations are answered by your team, and a conversation flow that would need a model on a channel hands the conversation to a person instead of calling one.

onmsg does not train, fine-tune or otherwise develop any artificial-intelligence or machine-learning model, and does not use your content for that purpose. We use the providers' API services rather than their consumer products, we do not enrol in any optional training, feedback or data-sharing programme, and we send nothing to provider review queues or dashboards. onmsg does not operate a self-hosted or offline model; every model is a third-party API service.

Limited Use compliance statement. The use of raw or derived user data received from Google Workspace APIs and Google APIs will adhere to the Google User Data Policy, including the Limited Use requirements. onmsg's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See onmsg.app/google-limited-use for the full statement.

9. Data retention

Conversation history is retained according to the retention setting configured on your plan. Idle conversations remain in retained history, inactivity is not the same as deletion. When a retention period ends, or when you delete data yourself, it is removed from the active service in line with our deletion processes.

10. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure or destruction. No online service can promise perfect security, so we also limit what we collect and how long we keep it.

11. Your rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you
Correct information that is inaccurate or incomplete
Request deletion of your personal information
Object to or restrict certain processing
Receive a copy of your data in a portable format
Opt out of marketing communications at any time

To exercise any of these, email hello@onmsg.app. If you are a visitor to a website that uses onmsg, contact that business first, they control the conversation data, and we will support their response.

12. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences and understand how the site is used. You can set your browser to refuse cookies, though some parts of the service may not work as expected if you do.

13. International transfers

We may process information in countries other than the one you live in. Where we do, we use appropriate safeguards for that transfer.

14. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "last updated" date above, and where appropriate we will tell you directly.

15. Contact us

Email: hello@onmsg.app
Website: onmsg.app

Privacy Policy