OnKey is operated by EasyBotChat Inc(“EasyBotChat,” “we,” “us,” or “our”). This Privacy Policy explains what information we collect through the OnKey mobile app and the OnKey website (together, the “Service”), how we use and share it, and the choices you have.
OnKey is a private, AI-powered assistant that your employer provides to help you with work-related questions. You do not create an OnKey account yourself: your employer provisions your access, and you sign in using an ID, name, and PIN provided through your workplace. For most of the personal information described below, EasyBotChat acts as a service providerthat processes information on your employer’s behalf. By using OnKey, you agree to this Privacy Policy.
If you have questions, contact us at legal@easybot.chat or EasyBotChat Inc, 6116 N. Central Expressway, Suite 1440, Dallas, TX 75206.
The short version
- We collect the basics needed to run the app: your name, the language you choose, a PIN (stored only as a scrambled “hash”), your messages with the assistant, and some device and security information.
- Your conversations are confidential. By default, your employer receives only aggregatedtrends (for example, “many people asked about time off”) and does not see your individual messages. However, your employer can request individual conversations from us, and authorized EasyBotChat staff may review individual conversations internally for quality, safety, and to improve the Service. We limit who can access this information and treat it as confidential.
- If your workplace uses payroll sign-in, the last 4 digits of your Social Security Number are used once to confirm you’re an active employee and are then immediately discarded — we do not store them.
- We do not sell or share your personal information for advertising, we do not use ad trackers, and we do not collect your precise location.
- You can change your language, turn notifications on or off, or sign out anytime in the app. To access or delete your information, contact your employer (which provisions and removes your access); you may also email us at legal@easybot.chat and we will assist your employer.
This summary is for convenience only; the full policy below governs.
1. Information we collect
Information you provide
- Your name (first and last), associated with the access your employer provisions for you.
- Language preference (English, Spanish, French, or Portuguese).
- A 4-digit PIN that you create to sign in. We store this only as a one-way cryptographic hash; we never store or display the PIN itself.
- Date of birth — only in the rare case that more than one person shares your name and PIN, to tell accounts apart. Otherwise we do not collect it.
- Your messages and any files you choose to attach in a conversation with the assistant.
Information from your employer or its payroll provider
- Your job title and work location (a business address or site name), where your employer has provided it, so the assistant can give you more relevant answers.
- Payroll sign-in (only at workplaces that use it): to confirm you are an active employee, the app sends your first name, last name, and the last 4 digits of your Social Security Numberto be checked against your employer’s payroll provider (such as ADP or Paylocity). The last-4 SSN is used only for this live check and is then immediately discarded — it is never stored, logged, or shared. We retain only a non-sensitive worker identifier returned by the payroll provider.
Information collected automatically
- Device and app information: a randomly generated, per-install device identifier (used for security, such as keeping your account to one device at a time), your app version, and your operating-system version.
- Notification token: if you turn on notifications, a push-notification token so we can deliver messages to your device.
- Approximate region: a coarse country/region derived from your IP address, used for security and compliance logging. We do not collect GPS or precise location.
- Session and security information: sign-in times, sign-in attempts, and similar records needed to operate and secure your account.
What we do not collect
We do not collect your email address, phone number, precise/GPS location, advertising identifiers, your contacts, or your browsing or search history from other apps or websites. Voice input, if you use it, is transcribed on your device; the audio does not leave your phone.
2. How we use your information
We use the information above to:
- Provide, operate, and maintain the Service and answer your questions;
- Verify your identity and secure your account (including the one-device security feature and, where applicable, the live payroll check);
- Personalize answers (for example, using your role and language);
- Send notifications you’ve enabled (such as workplace updates);
- Review individual conversations internally — by authorized EasyBotChat personnel under confidentiality obligations — to monitor and improve answer quality, accuracy, and safety;
- Produce aggregated, de-identified insights for your employer (see Section 3);
- Respond to your employer’s requests for information it is entitled to receive (see Section 3);
- Detect, prevent, and respond to fraud, abuse, and security issues; and
- Comply with legal obligations and enforce our Terms of Service.
We do not use your information for advertising, and we do not sell it. We do not use your conversations to train third-party general-purpose AI models.
3. Your privacy and what your employer can see
OnKey is a tool your employer provides, and we process your information on your employer’s behalf. We design the Service to keep your individual conversations confidential, and we limit who can access them.
- By default, your employer receives only aggregated insights — combined trends across many users (for example, common topics or knowledge gaps) — and does not see your individual messages or your name attached to your messages.
- Your employer may request individual conversation information from us. Because OnKey is your employer’s tool and your employer is responsible for the information processed through it, your employer can request individual conversations, and we may provide them. We apply confidentiality controls to this access, similar to how an NDA limits access to authorized parties.
- EasyBotChat may review individual conversations internally. Authorized EasyBotChat personnel, under confidentiality obligations, may review individual conversations to operate the Service and to monitor and improve answer quality, accuracy, and safety.
Your employer separately manages your accessto OnKey — for example, it can add or remove you as an employee, and it provides the workplace information described above. Your employer’s own privacy practices govern the information it holds about you as your employer.
4. AI-generated answers
OnKey’s answers are generated by artificial intelligence, drawing primarily on the knowledge materials your employer provides. To produce an answer, your message and limited context (such as your first name, role, employer name, language, and the date) are processed by our AI provider, customGPT. Under our contract, customGPT does not use your conversations to train its own or others’ general-purpose AI models, uses the data only to generate your answers, and is contractually required to protect it to the same standard described in this Policy. AI answers are for general information only and are not legal, medical, financial, or other professional advice. AI can make mistakes; verify anything important.
5. How we share information
We share information only as described here:
- Service providers (subprocessors) who help us run OnKey, under contracts that limit their use of the information to providing services to us:
- customGPT— generates AI answers from your employer’s knowledge base;
- Knock and Expo (via Apple Push Notification service / Google Firebase Cloud Messaging) — deliver notifications;
- DeepL — translates app and workplace content (server-side; not your chat messages);
- Supabase — hosts our database;
- SendGrid — sends employer-facing email on our behalf.
- Your employer — the aggregated insights and account/roster information described in Sections 1 and 3, and individual conversation information your employer requests as described in Section 3. In addition, if you choose to contact an Admin directly through the app, the message you send and your identity (name) are shared with that Admin at your employer. This sharing happens only when you affirmatively choose to forward a question; the app shows you a notice before anything is sent.
- Legal and safety — when required by law, subpoena, or legal process, or to protect the rights, safety, or property of you, us, or others.
- Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising (as those terms are defined under California and other US state privacy laws).
6. Data retention
We keep the information we hold for as long as your access is active and for approximately 90 days after your employer offboards you from the Service, after which it is deleted or de-identified — unless a longer period is required by law or to resolve disputes. Aggregated and de-identified data, and compliance/audit records, may be retained longer.
Your conversation content is held by our AI provider, customGPT, which deletes chat threads approximately 12 months after they are created; we store only references to that content in our own systems. You may request deletion sooner as described in Sections 8 and 9.
7. How we protect your information
We use reasonable administrative, technical, and physical safeguards, including encryption in transit (TLS), encryption of sensitive data at rest, one-way hashing of PINs, and secure on-device storage (the device Keychain/Keystore). No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
8. Your choices
- In the app: change your language, turn notifications on/off, and sign out at any time in Settings.
- Notifications: you can also control push notifications in your device settings.
- Access and deletion: because your employer provisions and manages your access, you can ask your employer to access or delete your information or to offboard you. You may also email legal@easybot.chat, and we will assist your employer in responding. We may need to verify your request, and some information may be retained as described in Section 6 or as required by law.
9. Your US state privacy rights
Depending on where you live, US state privacy laws (such as the California Consumer Privacy Act, as amended by the CPRA, and similar laws in other states) may give you rights regarding your personal information, including the right to:
- Know/Access the categories and specific pieces of personal information collected about you;
- Delete personal information collected from you;
- Correct inaccurate personal information;
- Limit the use and disclosure of sensitive personal information to what is necessary to provide the Service (see the note below);
- Opt outof the “sale” or “sharing” of personal information and of certain profiling — note: we do not sell or share your personal information, so there is nothing to opt out of; and
- Not be discriminated against for exercising these rights.
How these rights work for OnKey. EasyBotChat processes your information as a service provideron behalf of your employer, which is the entity responsible (the “business”) for the information processed through OnKey. To exercise your rights, please contact your employer. If you contact us at legal@easybot.chat, we will forward your request to your employer and assist your employer in responding. We will verify requests as required by law and do not charge you for exercising these rights.
Sensitive personal information. We use the limited sensitive information we handle (a PIN stored only as a hash; the last-4 SSN used transiently for payroll verification and not retained; and date of birth only in the rare collision case) solely to provide and secure the Service, and not for any purpose that would trigger a separate right to limit its use.
Global Privacy Control. Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control do not change how we process your information.
Categories of personal information we collect (using California categories): identifiers (such as name and device identifier); customer records (such as name and, where provided by your employer, work location/title); internet or network activity (such as app interactions needed to operate the Service); geolocation (coarse region only); sensitive personal information (a PIN we store only as a hash, and the last-4 SSN used transiently for payroll verification and not retained); and other information you provide (such as your messages and date of birth in the rare collision case). We collect these for the business purposes in Section 2 and disclose them to the parties in Section 5.
10. Children’s privacy
OnKey is a workplace tool made available only to people your employer provisions as legally employed workers, and your employer confirms each worker’s eligibility, including age, for employment. OnKey is intended for working users who are at least 18 years old. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has been provided access in error, contact legal@easybot.chat and we will work with the employer to address it.
11. Where we operate and process information
EasyBotChat is based in the United States, and we and our service providers process and store information in the United States. OnKey is offered to employers and workers in the Americas. If you access OnKey from outside the United States, including from Canada or Latin America, you understand your information will be processed in the United States. Where additional local privacy laws apply to you, we will provide any further notices or rights required by those laws.
12. Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice (such as in the app). Your continued use of the Service after an update means you accept the revised Policy.
13. Contact us
EasyBotChat Inc
6116 N. Central Expressway, Suite 1440
Dallas, TX 75206
legal@easybot.chat