Privacy Policy
Who we are
ONIMA (ONIMA INTERNATIONAL LTD) runs a private portal at onima.krejt.tech for artists, labels and ONIMA staff. The portal shows YouTube, Spotify and Instagram figures, royalty statements and payments. ONIMA INTERNATIONAL LTD is the controller of the personal data described here.
Portal accounts and security log
For each portal account we store:
- name, email address and role;
- a hash of the password (never the password itself);
- passkeys and second-factor secrets, stored encrypted;
- sign-in sessions;
- a security log of sign-ins with the IP address and an approximate location derived from the IP address using the DB-IP City Lite database.
The purpose is security and account-abuse review. Raw activity events (pages opened, errors, with IP address) are kept for 180 days to about seven months. The sign-in and security audit log, including IP address and browser details, is kept indefinitely for security review. The per-account sign-in location history is kept while the account exists.
IP Geolocation by DB-IP.
Instagram data
If you click Connect on the Instagram page of the portal and log in with Instagram, we use the Instagram API with Instagram Login. We request these permissions: instagram_business_basic, instagram_business_manage_insights, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_messages.
What we read
- Account profile: username, name, account type, profile picture, and follower, following and media counts.
- Your media list with captions, dates, permalinks and per-post insights.
- Daily account insights: reach, views, accounts engaged, likes, comments, shares, saves, follows and unfollows, and profile link taps.
- Follower and engaged-audience demographics (country, city, age, gender), aggregated by Instagram.
- The hours when your followers are online (aggregated).
Comments
We read the comments on your recent posts and store them (comment text, the commenter’s username and time) so that you and ONIMA staff can answer, hide or delete them in the portal and switch comments on or off per post.
Direct messages
We read the direct-message conversations of the connected account and store them: the other person’s Instagram username and ID, the message text and any attachment links, and the times. We use them only to show them in the portal and to let you and ONIMA staff answer them (Instagram allows an answer within 24 hours of the person’s last message). Direct messages are personal data; they are visible only to the portal logins of the account owner and to ONIMA staff, they are never used for advertising or shared, and they are deleted when deletion is requested as described below.
Content publishing
A logged-in user can create and schedule posts (image, video or carousel, with a caption). The media files you upload are stored in our cloud storage (Amazon S3) so that we can publish them to your account.
How we use it
We show the account owner’s portal logins and ONIMA staff how the account performs, and we publish the posts you scheduled. We never sell Instagram data, never use it for advertising, and never share it with third parties other than the infrastructure providers that host it.
Access token
The Instagram access token is stored encrypted (AES-256-GCM) on our servers, refreshed automatically before it expires, and used only for that account.
Other data in the portal
- For ONIMA staff using the attendance tools: check-in and check-out times, an optional GPS position when clocking in or out and on production routes (only when the browser allows it), and sick-leave dates and uploaded doctor’s notes. Doctor’s notes are health data, stored in a separate restricted storage bucket and visible only to the employee who uploaded them and to administrators.
- For all users: page views and error reports with IP address in the activity log.
- Browser push-notification subscriptions per device, if you allow notifications.
Emails are sent through Resend and Amazon Web Services (SES).
Who can see your data
Only the portal logins of the account owner and ONIMA staff. Clients never see other clients’ data.
Where data is stored
Data is stored in our own PostgreSQL databases, on servers we operate ourselves and on servers rented from OVHcloud, with files stored in Amazon Web Services (S3). We also keep copies for testing, which stay on servers we operate.
How long we keep data
Disconnecting the account in the portal, or removing the app in Instagram, deletes the stored access token and stops syncing. The Instagram data we already collected (profile, insights, demographics, media list, comments, direct messages and scheduled posts) stays until deletion is requested as described below. Portal account and security log retention is described above.
How to delete your data
- In Instagram go to Settings → Apps and websites, remove the ONIMA-IG app and request data deletion. This calls our data deletion callback and deletes the account’s profile, insights, demographics, media list, comments, direct messages and scheduled posts.
- Or email e@onima.co. Media files you uploaded for publishing (stored in Amazon S3) are deleted on request by email.
Meta’s data deletion callback URL for this app is https://onima.krejt.tech/api/v1/instagram/data-deletion.
Your rights
You can ask for access to your data, correction, deletion, or object to how we use it. Email e@onima.co; we answer within 30 days.
Changes to this policy
We update this page when our practices change and change the “Last updated” date above.
Contact
ONIMA INTERNATIONAL LTD
Company number 14891876
Elsley Court, 20-22 Great Titchfield Street, London W1W 8BE, United Kingdom
e@onima.co