Privacy Policy

This policy explains how Onyxfish LLC (“Onyxfish”, “we” or “us”) handles personal information on this website, onyxfish.dev, and in our business: when you get in touch with us, and when we work with you as a client.

Each of our products has its own privacy policy, which covers the product and its website:

Private Sales: privatesales.onyxfish.dev/privacy

The short version

This website uses Google Analytics only if you agree to it. It has no advertising, forms or accounts.
If you email us, we use what you send to reply and to run our business.
If you’re a client, your contract with us governs any data we handle for you.
We don’t sell personal information, and we don’t share it for advertising.
You can ask us to see, correct or delete your information at any time, free of charge.

Who we are

Onyxfish LLC is a California limited liability company. We decide how the personal information this policy covers is used, so under the EU and UK GDPR and the Swiss Federal Act on Data Protection we are its “controller”. Our founder, Chris Groskopf, is responsible for privacy at Onyxfish.

Onyxfish LLC
2108 N Street Ste N
Sacramento, CA 95816
United States
privacy@onyxfish.dev

This website

onyxfish.dev has no advertising, forms or accounts. Its fonts, images and scripts are all served from our own site. The only exception is Google Analytics, and only if you agree to it (see the next section). The site is served only over HTTPS.

Amazon Web Services (AWS) hosts the site. Like any web host, AWS has to process your IP address and the details your browser sends with each request, such as the page you asked for and your browser type, in order to deliver pages to you. We don’t keep logs of those requests.

Analytics and cookies

With your permission, we use Google Analytics to see how many people visit this site, how they find it and what they read. We ask the first time you visit. Until you say yes, the site doesn’t load Google Analytics at all, and nothing is sent to Google.

If you agree:

Google Analytics sets two cookies on onyxfish.dev, _ga and _ga_EDP14KGS52. They hold a random identifier for your browser and last up to 13 months after your last visit.
It receives:
- the pages you visit and the site that sent you here;
- how you use each page, such as scrolling and following links to other sites;
- your browser, device type, screen size and language;
- your approximate location. Google works this out from your IP address, and says it doesn’t log or store the address.
Google processes this data for us as our service provider, under its data processing terms, on servers in the United States and elsewhere. Google deletes the event- and user-level data 2 months after it’s collected. We keep the aggregated reports Google Analytics produces, such as the number of visits each month, which don’t identify you.
We’ve turned off Google signals, all of Google Analytics’ advertising features, and sharing data with Google for its own products and services. We don’t use the data to advertise to you.

Google explains how it handles this data in How Google uses information from sites or apps that use our services.

Your choice is saved in your browser’s local storage, not in a cookie, and we don’t keep a copy of it on our servers. We ask again after 12 months, or sooner if what we collect changes. To change your mind at any time, choose Cookie settings at the bottom of any page. If you withdraw, we stop analytics and delete its cookies. If your browser sends a Global Privacy Control signal, we take that as a no and don’t ask, though you can still turn analytics on under Cookie settings.

When you contact us

When you email us, we receive your name, email address, what you write and anything you attach. We use it to reply to you and to keep a record of our correspondence. Our email provider, Google Workspace, stores these messages for us.

We won’t add you to a mailing list or send you marketing email unless you ask us to. If we’d like to quote something you’ve written to us, such as in a testimonial or case study, we’ll ask your permission first.

Clients and prospective clients

When we talk with you about a project, or work with you as a client, we keep the business contact details of the people we work with, along with our correspondence, proposals, contracts, invoices and payment records. We use them to provide our services, to bill for them, to keep business records and to meet our tax and legal obligations.

Most of this comes from you. We may also get your business contact details from your colleagues or employer, for example when you’re copied on a project email, from someone who refers you to us, or from your public professional profiles.

Data we handle for clients. In our consulting work we sometimes handle personal information on a client’s behalf, such as data about the client’s own customers or users. That information is covered by our agreement with the client, not by this policy. We handle it as the client’s service provider (a “processor” under the GDPR), and we use it only as the client instructs. If you think we hold your information because of work for one of our clients, please contact that client first. We’ll help them answer you.

Do you have to give us information?

No. You can read this website without giving us anything, and saying no to analytics doesn’t change how the site works. If you want to hire us, we need your contact and billing details to agree and carry out a contract, and the law requires us to keep some of them, such as invoices. Without them we can’t work with you.

We don’t make decisions about you based solely on automated processing, and we don’t profile you.

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We share it only:

with service providers who work for us, and only so they can provide their services to us:
- Amazon Web Services, which hosts this website;
- Google, for analytics (if you agree to it) and for our email (Google Workspace);
- our accountants, bank and payment processors;
when the law requires it, or to protect the rights, property or safety of Onyxfish, our clients or others;
if our business changes hands, for example in a merger or sale. The information would stay covered by this policy’s commitments, and we’d tell you if you’re a client or we’re in touch with you.

We may share aggregated statistics that don’t identify anyone, such as how many people visited this site.

Other websites

This site links to other websites, including our products’ sites and our founder’s site. They have their own privacy policies, and this policy doesn’t cover them.

Legal bases (EEA, UK and Switzerland)

If you’re in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

Consent: for Google Analytics and its cookies. You can withdraw consent at any time under Cookie settings. Withdrawing doesn’t affect what was collected before.
Contract: to provide the services you hire us for, and to take the steps you ask for before a contract.
Legitimate interests: our interests in delivering and securing this website, answering the people who write to us, finding and working with clients, running our business, and keeping records so we can establish or defend legal claims. We’ve weighed these against your interests and rights, and you can object (see below).
Legal obligation: to keep tax and accounting records.

International transfers

We are based in the United States, and we and our service providers store information there. If you contact us from outside the United States, your information will be transferred to and processed in the United States, where US courts and authorities may be able to access it.

Google and Amazon Web Services are certified under the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, and we rely on those certifications when we share your information with them. Where they don’t apply, we rely on the European Commission’s standard contractual clauses, and the UK and Swiss equivalents, in our providers’ data processing terms. You can ask us for a copy at privacy@onyxfish.dev.

How long we keep information

Analytics data: Google Analytics deletes event- and user-level data after 2 months. Its cookies last up to 13 months after your last visit. Aggregated reports that don’t identify you are kept.
Your consent choice: 12 months, in your browser.
Correspondence with people who aren’t clients: as long as we need it to keep the conversation going or to keep a record of our dealings with you.
Client records: for as long as we work together, and then for as long as tax, accounting and legal requirements call for, generally seven years.

After we delete information, copies can remain in our email provider’s and our own backups for a short time, until those backups are replaced.

Your rights

Wherever you live, you can ask us to:

tell you what personal information we hold about you and give you a copy;
correct it;
delete it;
stop using it for a particular purpose.

To make a request, email privacy@onyxfish.dev. It’s free. We may need to confirm who you are before we act. We’ll answer within 30 days, or tell you within that time if we need longer and why. Sometimes we have to keep information anyway, for example invoices the law requires us to keep. If so, we’ll tell you.

If you’re in the EEA, the UK or Switzerland, you also have the right to restrict our use of your information and to receive it in a portable form.

Your right to object

Where we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation, by emailing privacy@onyxfish.dev. We’ll then stop, unless we have compelling legitimate grounds that override your interests, or we need the information to establish or defend legal claims.

Complaints

If you’re unhappy with how we’ve handled your information, tell us at privacy@onyxfish.dev or by post at our address. We’ll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.

You can also complain to a data protection authority at any time: in the EEA, the authority where you live or work; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner. We’d be grateful for the chance to sort out any concern with you, but you don’t have to come to us first.

Do Not Track

We honor Global Privacy Control: a browser that sends it is treated as having said no to analytics. We don’t respond to the older Do Not Track signal, because no common standard says what it should do. We ask for your consent instead.

If you agree to analytics, Google collects information about your visits to this site over time, as described above. We’ve turned off the features that would let Google connect that information to your activity on other sites.

Children

This website and our services aren’t directed at children under 13, and we don’t knowingly collect personal information from them. If we learn that we have, we’ll delete it. If you’re a parent or guardian and think your child has sent us information, email privacy@onyxfish.dev.

Security

We protect the information we hold with reasonable administrative and technical safeguards, and only people at Onyxfish who need it can see it. No system is perfectly secure, so if something ever goes wrong that affects your information, we’ll tell you as the law requires.

Changes to this policy

When this policy changes, we’ll post the new version here with the date it takes effect, and list what changed in the version history. Earlier versions stay available at their own addresses. If a change is significant, we’ll post it at least 30 days before it takes effect. If we want to use information we already hold in a materially different way from what this policy describes, we’ll ask for your consent first.

Contact

Questions about this policy or your information: privacy@onyxfish.dev, or write to Onyxfish LLC, 2108 N Street Ste N, Sacramento, CA 95816, United States.