Privacy notice
Last updated 13 October 2026
- We collect what we need to run OnContext: your account details, the public pages of your website, and the searches people type into your search box.
- We don't store visitors' names or IP addresses with their searches, and the search widget sets no cookies.
- Searches are sent to OpenAI to write answers, and are deleted from OnContext after 90 days.
- We don't sell data or use it for advertising.
Who we are
OnContext is run by Super Nines Ltd, London ("we", "us"). If you have a question about this notice or your data, email hello@supernines.com.
There are two groups of people this notice covers:
- Customers: people who sign up to OnContext to add search to their website. For your account details we decide how data is used, so we are the controller.
- Visitors: people who use the search box on a customer's website. Here we act for the website owner, who is the controller; we are their processor. If you are a visitor, the website's own privacy policy also applies, and the website owner is the first place to ask about your data.
What we collect and why
If you have an OnContext account
| What | Why | How long |
|---|---|---|
| Email address and password (the password is stored scrambled; we can't read it) | To create your account, let you sign in and send account emails, such as password resets | Until you close your account |
| Company name, website address, widget settings | To set up and run search for your website | Until you close your account |
| Sign-in records kept by our hosting provider | To keep accounts secure | A short period set by the provider |
Legal basis: we need this to provide the service you signed up for (contract), and to keep it secure (legitimate interests).
Your website's content
When you add your website, we read its public pages (text, titles, links and image addresses), the same way a search engine does, and keep a search index of them. We only do this once our widget is on your website, and only for the website you registered. We keep the index while you use OnContext. If the widget is removed, we pause updates and delete the index 30 days later. We also delete it when you close your account.
Searches made on a customer's website
When someone searches using the OnContext search box, we store:
- what they typed;
- which website they searched, and which result they clicked;
- the time, and how long the answer took;
- a short visitor code worked out from their internet address. It changes every day and can't be turned back into the address. We use it to count visitors and stop abuse. We don't store the internet address itself. Our hosting provider's short-term technical logs may briefly include it, as for any website.
We use this to answer the search, to show the website owner what people search for, and to protect the service from abuse. Legal basis: legitimate interests of the website owner, on whose behalf we process it.
Visitors' searches are deleted automatically after 90 days. We keep daily totals (for example, "120 searches on 3 March"), which contain no search text. Answers to common questions are cached for up to 7 days so they load faster.
Please don't type personal details, such as health or financial information, into a search box. They aren't needed to find an answer.
What the search widget stores in a visitor's browser
The widget sets no cookies and doesn't track anyone across websites. It saves two small notes in the browser's own storage:
- how the search box should look on that website (refreshed every 5 minutes), so pages load without asking our server each time;
- a note that it has already checked in during this visit, which is cleared when the browser tab is closed.
Neither contains anything about the visitor. They are strictly necessary for the widget to work efficiently.
Our own website and dashboard
oncontext.io has no analytics or advertising trackers. When you sign in, your browser keeps a sign-in token so you stay signed in. Our home page loads fonts from Google Fonts, so your browser connects to Google, which can see your internet address.
Who we share data with
We use these providers to run OnContext. They may only use the data to provide their service to us:
| Provider | What they do | What they receive |
|---|---|---|
| Supabase | Database, sign-in, account emails and the servers that run search | All the data described above |
| OpenAI | Turns pages and searches into a searchable form and writes answers | Your website's page text, and visitors' search text with the page extracts used to answer it. Not names, emails or internet addresses. |
| Hostinger | Hosts oncontext.io | Standard web server logs when you visit oncontext.io |
| Google Fonts | Fonts on our home page | Your internet address when the page loads |
OpenAI says it does not use data sent through its API to train its models. Some of these providers process data outside the UK, including in the United States. Where they do, we rely on the safeguards in their data processing terms, such as the UK International Data Transfer Addendum or the UK–US data bridge.
We don't sell data, and we don't share it for advertising. We would only disclose it otherwise if the law requires us to.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict or object to how we use it;
- send it to you in a reusable format.
To close your account and delete your data, email hello@supernines.com from your account's email address. We'll reply within one month. If you are a visitor to a customer's website, contact that website first; we'll help them answer you.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.
Security
Data is sent over encrypted connections. Each customer can only see their own websites and searches, and staff access is limited to running and supporting the service.
For website owners: telling your visitors
Because you are the controller of your visitors' searches, your own privacy policy should mention that you use OnContext. You can copy and adapt this:
Changes to this notice
OnContext is in beta, so this notice may change. We'll update the date at the top. If a change affects how we use your data in a significant way, we'll email account holders before it takes effect.