Ondera Privacy Policy

1.1. Account information: name, corporate email address, authentication data (including magic-link sign-in records and password hashes where a password is set), role (Buyer/Vendor), and company details provided during registration.

1.2. Profile & verification data: company website, LinkedIn profile, phone and WhatsApp numbers, geographic location, operational capabilities (services, languages and locales, workforce and specialist counts, capacity, quality-assurance practices, project history), and any official company registration documents submitted to achieve verification badges. Verification documents are stored privately and are accessible only to you and Ondera administrators.

1.3. Marketplace content: text, project parameters, and attachment files contained within project briefs, bids, deal-room milestones, deliveries, and reviews, together with moderation and flag history and acceptable-use attestations recorded with each brief and bid.

1.4. Communications: messages and file attachments exchanged in bid threads and deal rooms, and your correspondence with Ondera.

1.5. Technical log data: IP addresses, browser types, device identifiers, and platform interaction timestamps recorded automatically for security, authentication, and debugging purposes.

1.6. Transaction information: records of credit pack purchases made via our merchant of record (Paddle), credit ledger transactions, and connection/match history. We store transaction references and credit balances; we do not collect or store card numbers or financial account details on our servers. Ondera does not process payments between Buyers and Vendors.

2.1. To administer accounts, manage credit balances, compute capability match scores from profile data, and operate connection states, deal rooms, and notifications.

2.2. To operate the anonymized discovery layer: your identifying information is displayed in anonymized form until a Managed Connection is activated, after which your identity and — for Buyers — only the contact fields you selected to share are revealed to your counterparty.

2.3. To review verification submissions and grant verification levels.

2.4. To moderate briefs and bids before publication, investigate flags and misuse, prevent fraud and spam, and enforce our Terms of Service.

2.5. To send service notifications (in-app and by email, according to your notification preferences) and respond to your inquiries.

2.6. To maintain platform security, prevent unauthorized access, comply with our payment processor's policies, and meet legal obligations.

We do not actively monitor the content of private messages between Buyers and Vendors in the ordinary course. Messages and files are securely stored. In the event of a formal dispute, either party to a conversation may request that Ondera review the relevant thread as evidence. We may also access stored communications where strictly required for security, fraud prevention, or legal compliance.

4.1. With your counterparties: according to the anonymization rules above — anonymized capability information before a match; identity and your selected contact details after a Managed Connection activates; and deal-room content with your project counterparty.

4.2. Service providers (data processors): we share data with infrastructure providers strictly as needed to operate the platform: Supabase (secure cloud database, storage, and authentication hosting), Paddle (merchant of record for credit purchases and related tax handling), and the transactional email delivery service integrated with our platform infrastructure (used solely to send authentication and notification emails). These providers are bound by their own data processing and confidentiality obligations and may not use your data for other purposes.

4.3. Legal necessity: we may disclose data if required by applicable law, court order, or regulation, or to protect the rights, safety, and integrity of Ondera and its users.

4.4. Business transfers: in connection with a corporate registration, restructuring, merger, acquisition, or asset transfer, data may be transferred to the successor entity subject to this Policy.

We do not sell personal information.

5.1. We retain account and profile data while your account is active. If you request account deletion, your profile information is removed from public and counterparty view; however, credit and transaction records, moderation logs, and past communications in shared deal rooms may be retained as necessary for dispute resolution, fraud prevention, counterparty business continuity, and legal compliance, after which they are deleted or anonymized.

5.2. Verification documents are retained while verification is active and for a reasonable period thereafter, or deleted earlier upon request where no legal obligation requires their retention.

We enforce technical and organizational security measures, including HTTPS/TLS encryption in transit, Supabase Row Level Security (RLS) policies at the database layer (ensuring message contents and un-revealed identities cannot be read by unauthorized users), private storage buckets for verification documents and deal files, and signature-verified payment webhooks. No system is perfectly secure; please protect access to your email account, as it controls magic-link sign-in.

Depending on your jurisdiction — including under the EU General Data Protection Regulation (GDPR), the UK GDPR, and Egypt's Personal Data Protection Law (Law No. 151 of 2020) — you may have the right to access, correct, export (data portability), delete, or restrict the processing of your personal data, and to object to certain processing. You can manage much of your data directly in your profile dashboard, or exercise these rights by contacting hello@onderahq.com. Note that certain records (e.g., transaction history, submitted reviews, and dispute-relevant communications) may be retained where we have legal grounds to do so. If you are located in a jurisdiction with a data protection supervisory authority, you also have the right to lodge a complaint with that authority.

Ondera is managed from Egypt and hosted on global cloud infrastructure; your information may be stored and processed in countries other than your own. Where required by applicable law, we rely on appropriate safeguards for such transfers and maintain consistent security controls across all processing locations.

We use strictly necessary cookies and session tokens to keep you authenticated and to remember your preferences. We do not deploy third-party cross-site advertising trackers. Disabling necessary cookies will prevent sign-in.

Ondera is a B2B platform and is not directed at individuals under 18. We do not knowingly collect data from minors.

We may update this Policy from time to time. Material changes will be notified via the platform or by email, and the "Last updated" date will be revised.

Data controller: Ondera Marketplace Project · Cairo, Egypt. All inquiries (privacy and legal): hello@onderahq.com