Privacy Policy

Onyx Works is a managed AI operations firm. We build and then operate the growth systems behind service businesses and high-ticket retail — websites, lead capture, follow-up, outbound prospecting, and the dashboards that run them.

For questions about this policy or about the data we hold, the fastest route is email.

• Email: [email protected]
• Phone: +1 (516) 425-1711
• Mail: Onyx Works, 3779 Primrose Ct, Waldorf, MD 20602

This policy covers onyxworks.io, the forms and tools on it (including the Lead Leak Audit, the booking page, the live chat, and the opt-in form), the email and text messages we send, and the phone calls we take. It also explains how we handle business contact information used for our own outbound prospecting.

It does not cover data we process on behalf of a client under a services agreement — see Data we handle for clients, where the client, not us, decides how that data is used.

Information you give us. When you fill in a form, book a call, start a chat, opt in to messages, or email us:

• Name, business name, email address, phone number.
• Your website address and answers you provide about your business — for example the answers in the Lead Leak Audit, or what you tell the chat assistant.
• Your communication preferences, including whether you opted in to text messages or email, what exactly you agreed to, and the date and time you agreed to it.
• Anything else you choose to send us in an email, text, chat, or call.

Information collected automatically. Our site is a static site with no advertising trackers and no third-party advertising cookies. It does use analytics that set first-party cookies to measure how the site is used — see Cookies and tracking. Our hosting and messaging providers log ordinary technical data — IP address, browser type, pages requested, timestamps — for security, abuse prevention, and basic traffic measurement. Our email and text platform records ordinary delivery events (delivered, opened, clicked, replied, bounced, unsubscribed) so we know whether a message reached you and whether to stop sending.

Information from other sources. For outbound business prospecting we collect publicly available business information — company name, website, business address and phone, industry, public reviews and listings — and business contact details from third-party business-data providers. See Business contact data and outreach.

Calls and recordings. If you call a number we operate, or one we operate for a client, the call may be answered or assisted by an automated voice assistant, and may be recorded or transcribed. Maryland requires the consent of all parties to record a call, so where recording is in use you will be told at the start of the call and you can decline or ask for a human.

We only send text messages to a mobile number when the person who owns it has opted in — through our opt-in form, in writing, or by texting us first. Consent is never a condition of buying anything from us, and the consent checkboxes on our form are optional and unchecked by default.

The carrier rules that govern business text messaging require us to state this plainly, so here it is, in the exact terms carriers expect:

In plain English: we do not sell your phone number, and we do not hand your number or your text-message consent to anyone else so they can market to you. The only parties that touch it are the vendors who actually deliver the message for us — our messaging platform, the phone carriers, and support vendors acting on our instructions.

You can stop text messages at any time by replying STOP to any message from us. Reply HELP for help, or call +1 (516) 425-1711. Message frequency varies. Message and data rates may apply. The full messaging terms are in our Terms & Conditions.

We keep a record of your consent — what the form said, which boxes you checked, and when — because the rules require us to be able to show it. We keep that record for as long as you are opted in and for a period afterwards as proof that the messages we sent were permitted.

• To answer you. Replying to an inquiry, a chat, a form, or a call.
• To deliver what you asked for. Sending your Lead Leak Audit scorecard, a sample, a proposal, or a booking confirmation.
• To provide and operate our services for clients, and to bill for them.
• To send marketing — email, and text messages where you opted in — about our services. You can stop either at any time.
• To run our own outbound prospecting to businesses, as described below.
• To keep things working and safe — security, fraud and abuse prevention, rate limiting, debugging, and backups.
• To meet legal obligations, including keeping proof of messaging consent.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use your information to train publicly available AI models.

Part of what we do is find businesses that might want to work with us, or with a client, and reach out. That means we collect and hold business contact information — typically a company, a role, a work email address, and a business phone number — sourced from public websites and listings and from business-data providers.

This is business-to-business contact data used to contact people in their professional capacity. We do not use it for consumer marketing, and we do not text a business number on the strength of it — text messages go only to numbers that have opted in.

If you received an email from us and would rather we stopped, you can reply and say so, use the unsubscribe link, or email [email protected]. We will suppress your details so we do not contact you again, and we will tell you what we held about you if you ask.

We are an AI operations firm, so it is only fair to be specific about where AI touches your information.

• Live chat. The chat on our site is answered by an AI assistant. What you type is processed by our chat platform and an AI model provider to produce a reply, and it is stored in our CRM so we can follow up.
• Voice. Where we operate a voice assistant, calls may be transcribed and processed by AI to answer, take a message, or book an appointment.
• Drafting. We use AI to research businesses and to draft outreach and follow-up messages.
• A human approves what goes out. Outbound campaign messages are reviewed and approved by a person before sending. We do not use AI to make decisions that produce legal or similarly significant effects about you.

Our AI providers act as our service providers and are contractually barred from using your content to train their models.

We share personal information only in these situations, and never for someone else's marketing:

• Service providers who work for us, under contract and on our instructions: our CRM and messaging platform, phone carriers and messaging aggregators, website and application hosting, email delivery, calendar and video conferencing, AI model providers, business-data providers, and payment processing.
• Clients — if you are a lead generated for one of our clients through a system we run for them, your inquiry goes to that client. That is the point of the inquiry.
• Legal and safety — where we are required by law, or where it is necessary to investigate abuse or protect someone.
• A business transfer — if the business is sold or merged, information may transfer with it, subject to this policy.

Mobile phone numbers and text-message consent are carved out of all of the above except delivery and support: see Text messages and mobile information.

When we run a system for a client — a website, a follow-up sequence, a reactivation campaign against their customer list, a prospect engine, an inbound assistant — we handle personal information about that client's customers and prospects. In that work the client decides what the data is used for, and we act on their instructions under our services agreement.

If you are a customer of one of our clients and you want to see, correct, or delete your information, contact that business directly. If you contact us instead, we will pass the request to them and help them action it.

Our site does not run advertising cookies or cross-site ad trackers. The cookies it does set fall into two groups: measurement cookies, so we can count visits properly, and functional ones set by the embedded tools you choose to use — the booking calendar and the live chat widget — so those tools can hold a session and remember a conversation.

We measure traffic with Cloudflare Web Analytics, which is privacy-first: it sets no cookies, uses no client-side state, and does not fingerprint or follow you across other sites. It counts page views and referrers in aggregate so we know which pages are worth keeping.

We also use Google Analytics to understand how people move through the site — which page someone arrives on, what they read next, and where they leave. Unlike the Cloudflare measurement above, it does set cookies: first-party cookies in your browser, so that a return visit is recognised as the same visitor rather than counted as a new person every time.

We have deliberately switched off the two settings that would turn it into an advertising tool — Google Signals and ad personalisation. With those off, what it collects is not joined to your Google account, is not used to build advertising audiences, and is not shared for cross-context behavioural advertising. It tells us which pages earn their place, and that is the whole of what we use it for. Switching either setting back on would mean rewriting this section first.

If you would rather not be measured, your browser's cookie controls will block it, and Google publishes a browser add-on that opts you out of Google Analytics on every site that uses it.

If you arrive from one of our Facebook or Instagram ads and then complete the audit, we tell Meta that the ad worked. That report is sent from our server, not from your browser: it contains your email, phone and first name in an irreversible hashed form, along with the click identifier Meta itself added to the link you followed. There is no Meta code on this site, nothing loads from Facebook, and no cookie is set. If you did not arrive from an ad, no report is sent.

Email and text messages we send may include delivery and open tracking, and links may be tagged so we know a message was useful. If you would rather not be tracked, plain-text replies and unsubscribing both work.

We honour Global Privacy Control signals where they apply to us. We do not sell personal information, so there is nothing to opt out of on that front.

• Inquiries and leads — while there is a live conversation, and afterwards in our CRM unless you ask us to remove you.
• Messaging consent records — for as long as you are opted in, and for a period after you opt out, as evidence that the messages we sent were permitted.
• Suppression records — permanently, in minimal form. If you tell us never to contact you again, we have to keep enough to honour that.
• Client project and billing records — for the life of the engagement and as long afterwards as tax and contract law requires.

Our site and applications are served over HTTPS, credentials and API tokens are held as secrets rather than in code, administrative access to our dashboard is password-gated, and we work with established platform vendors rather than rolling our own storage. No method of transmission or storage is perfectly secure, and we will not claim otherwise — but if a breach affects your information and the law requires us to tell you, we will.

Depending on where you live you may have the right to request access to the personal information we hold about you, correct it, delete it, obtain a portable copy, opt out of targeted advertising or the sale of personal information (we do neither), limit our use of sensitive data, and appeal a decision we make about your request.

Onyx Works is a small business and does not meet the size thresholds that make most U.S. state privacy statutes — including the Maryland Online Data Privacy Act and the California Consumer Privacy Act — mandatory for us. We honour these requests anyway. Asking is the whole process.

Email [email protected] with what you want. We will verify that the request is really coming from you, usually by replying to an address or number already on file, and respond within 45 days. We do not charge for this and we will not treat you differently for asking. If we say no, we will tell you why and how to appeal.

Our services are for businesses. We do not direct our site or messaging at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email [email protected] and we will delete it.

If we change this policy we will update the date at the top of the page. If a change materially affects how we use information you have already given us — particularly anything to do with messaging consent — we will tell you directly rather than relying on you to notice.

Questions, requests, or complaints about privacy:

• [email protected]
• +1 (516) 425-1711
• Onyx Works, 3779 Primrose Ct, Waldorf, MD 20602