Privacy
Last updated 13 May 2026
The short version
We collect the minimum we need to take your order: your phone number, the addresses you ask for delivery, the orders you place, and the messages you send Ona. We share order details with the restaurant that prepares your food and the rider who delivers it. We don't sell your data. We don't track you across the web.
What we collect
- Your phone number — so we can chat with you on WhatsApp.
- Your delivery addresses — so the rider knows where to go.
- Your orders — what you ordered, what you paid, when.
- Your messages — the chat history with Ona, kept so we can help you and improve the service.
- Basic device info — IP address, browser type, and clicks on links we send you, collected automatically when you interact with us.
Why we collect it
- To take your order, hand it to the restaurant, and get it delivered.
- To process payment.
- To answer questions and resolve problems with an order.
- To improve Ona — what's working, what's broken, what could be better.
- To meet legal obligations (tax records, fraud prevention).
Who we share it with
- The restaurant preparing your order — they get the order details and the name you gave us.
- The rider delivering your order — they get your address and phone number, for that delivery only.
- Payment processors — standard providers handle card details; we never store full card numbers ourselves.
- WhatsApp / Meta — the chat runs on WhatsApp, so message content and metadata are also subject to WhatsApp's own privacy policy.
- Service providers that help us run Ona — hosting, analytics, support tools — under contracts that require them to protect your data.
We don't sell your data. We don't share it for marketing purposes outside of Ona.
How long we keep it
- Active accounts: as long as you use Ona, plus a reasonable buffer for support and disputes (typically 12 months after your last order).
- Tax and accounting records: as long as Spanish law requires us to keep them (currently up to 6 years for invoices).
- Chat transcripts: kept while we still need them to help you. You can ask us to delete earlier conversations at any time.
When the retention period ends, we delete or anonymize the data.
Your rights
If you're in the EU or EEA, the GDPR gives you the right to:
- See what data we hold about you.
- Correct it if it's wrong.
- Have it deleted, subject to legal retention obligations.
- Export it in a portable format.
- Object to certain uses.
- Withdraw consent at any time.
To exercise any of these, email contact@oh-ona.com. We'll respond within 30 days.
If we can't resolve a concern together, you can complain to your local data-protection authority. In Spain, that's the Agencia Española de Protección de Datos (aepd.es).
Security
We use industry-standard measures — encryption in transit, encrypted storage, access controls on internal tools, regular review of who can see what. No system is perfect, but we take this seriously.
Cookies
This marketing site uses minimal storage — a single ona-lang entry in your browser's localStorage to remember your language preference, plus standard hosting logs. We don't use third-party tracking cookies.
Children
Ona is not for anyone under 16. We don't knowingly collect data from children. If you think a child has shared information with us, email contact@oh-ona.com and we'll delete it.
Changes
We may update this policy. If we make material changes, we'll let you know via WhatsApp or by posting a clear notice on this page. Continued use after a change means you accept it.
Get in touch
Questions, requests, or concerns about your data? Email contact@oh-ona.com. We read everything; you'll get a real reply.