Privacy Policy

This policy explains what personal data Onomaco collects, why we collect it, and the rights you have over it.

Effective date: September 28, 2026

Data we collect

Account details you provide, such as your name and email address.
Order and billing data needed to process a purchase.
Usage and device data collected to operate and secure the service.

How we use it

We use personal data to run the service and take payments. We also use it to deliver what you buy, send order emails and keep the platform safe.

The free idea score

On our free score page you type one sentence about your idea. We store that sentence and its score. We keep them until you ask us to delete them.

To make the score, we send your sentence to the AI companies that run our models. We send it to OpenRouter. It hands it to the firm that runs the model, such as OpenAI, Anthropic or xAI.

We never sell your sentence. We never send it to Meta or Google for ads. If you buy, your sentence goes to Stripe with your order, so your build can start from it.

We use your email only to send what you ask for: your score, and four short notes only if you tick that box. We keep a record of the box you ticked. You can stop the notes at any time. A scrambled (hashed) copy of it may also go to Meta to measure our ads. See the next part.

Ads, cookies and your choices

We don’t sell your personal information for money. We do share some of it with Meta and Google to measure and improve our ads. That is the pages you view, cookie ids, your IP address, your browser details and a scrambled (hashed) copy of your email. When you buy, it can also include a hashed copy of your phone, name and address. California law may call this “sharing”.

In the US we do this unless you tell us not to. Everywhere else we wait until you press Accept.

On our own sales pages we also count how far you scroll, how long the page is open in view, and which of our buttons you press. We keep these counts ourselves. We never send them to Meta or Google. We never record your screen, what you type, where your mouse goes or the words on the page. The same choices turn these counts off.

To opt out, use the Do Not Sell or Share My Personal Information link at the bottom of every page. We also honor Global Privacy Control (GPC). If your browser sends it, we treat it as the same choice.

Server-side attribution

When you land on one of our pages from an ad, we record the ad platform’s click identifier from the link (fbclid, gclid, and similar). To connect a visit to a later purchase without placing anything on your device, our servers also derive a visitor identifier from your IP address and browser user-agent; it is salted, hashed, and rotates daily, so it cannot follow you across days. These identifiers may be attached to your order and included in the conversion reports we send to the ad platform that showed the ad.

When you buy, we tell the ad platform that showed you the ad about the sale, so it can tell the ad worked. With it we may send a scrambled (hashed) copy of your email and the ad’s click identifier. We also send your browser’s user-agent (the name and version of your browser and device) and the page you bought on. In the US, unless you opt out, we also send your IP address and the hashed details above. Elsewhere we send them only after you press Accept. If you opt out, we don’t send your user-agent, the page or your IP address. We still report the sale, but with none of your details.

Connected ad accounts

You can connect your own Meta ad account (Facebook and Instagram) and your own Google Ads account. We use them only to run the ads you ask for.

What we read: spend, clicks, results, and the lists of your ad accounts and Pages.
What we change: we create your campaigns and ads paused. We start or pause them only after you approve the budget by typing it in.
How we keep it: the key for each account is stored encrypted. We keep it until you disconnect, and keep your ad results while your account is open.
How to remove it: open Settings, then Integrations, and press Disconnect. We pause any ads we placed, then delete the key. You can also ask us to delete your data.

We use data from Google only as the Google API Services User Data Policy allows, including its Limited Use rules. We do not sell it or use it to show you other ads.

We share data only with the companies that help us run the service. For example, Stripe takes payments and Resend sends email. For our text AI we use four firms: OpenRouter, Anthropic, OpenAI and xAI. For pictures, video and voice we use three more: fal, ElevenLabs and Deepgram. The full list is in our Data Processing Addendum.

Your rights

You may request access to, correction of, or deletion of your personal data. To exercise these rights, email privacy@onomaco.com.

See how data deletion works.

Contact

Questions about this policy? Email privacy@onomaco.com.

Onomaco is run by Onomaco LLC, 119 Jonquil Ct, Mooresville, NC 28117.