Privacy Policy

How Ongiini handles your data — last updated 2 June 2026

1. Who is responsible

The controller of your personal data within the meaning of Article 4 (7) GDPR is:

Sebastian Küpers · Hibiskusweg 17b · 13089 Berlin · Germany · sebastian.kuepers@gmail.com · +49 170 2372987

Ongiini is the first project of the Common Intelligence Foundation, currently being formally established as a non-profit foundation in Estonia. Until that registration is complete, the service is privately funded and operated on a non-profit basis. After registration, the foundation will become the controller; you will be informed of that change in this policy.

The service is provided without charge and is not operated for profit.

Our processing does not meet the thresholds in Art. 37 GDPR for the mandatory appointment of a Data Protection Officer. You can reach us with any privacy enquiry using the contact details above.

2. What we process, why, and on what legal basis

Your phone number and message content

When you message the Ongiini WhatsApp number, we receive your phone number (as your WhatsApp identifier) and the content of each message you send — text, images, and voice notes. Voice notes are downloaded from Meta and transcribed to text on our own computer using an open-source speech-to-text model (Whisper). The original audio bytes are not retained after transcription; only the text transcript is processed and stored, the same way as any other text message.

Purpose: to read your question and provide an answer — i.e. to deliver the service you requested by initiating the conversation.

Legal basis: Art. 6 (1) (b) GDPR — performance of pre-contractual measures requested by you. By sending a message, you ask the service to respond.

Short-term conversation memory

We keep approximately the last 50 turns of your conversation (each turn = one message from you plus one reply) in a local file on the computer that runs Ongiini, identified by your phone number. Once the stored history grows beyond about 70 entries, the oldest entries are condensed into a single short summary line ("Earlier in this conversation: …") and the most recent ~40 turns are kept verbatim. Before any message is written to disk, we automatically scrub obvious personal data patterns from the text (email addresses, IBANs, credit-card numbers and Namibian-format ID numbers are replaced with placeholders such as [REDACTED:email]).

Purpose: to allow the assistant to follow a conversation across messages (so you don't have to repeat context).

Legal basis: Art. 6 (1) (b) GDPR — necessary to provide the conversation service you requested.

Long-term memory ("mem0")

Across all your chats, the assistant extracts a small number of typed facts about you and stores them as short text fragments. Categories are: [PROFILE] (location, role, family), [PREFERENCE] (language, style), [SITUATION] (ongoing topics), [COMMITMENT] (follow-ups, reminders), [QUOTE] (verbatim phrasing the assistant might re-use), and [EMOTION] (recent state). These facts are stored as numerical embeddings in a local vector database (qdrant), identified by your phone number, and are retrieved by semantic similarity each time you write so the assistant can recall relevant context. mem0 also maintains a separate local SQLite database that records when each fact was added, updated or deleted — this contains the fact text and metadata, but no full message content beyond the extracted fact itself.

Purpose: to make the assistant useful over time — to remember that you farm maize, that you prefer Afrikaans replies, that you previously asked about a school topic, etc.

Legal basis: Art. 6 (1) (b) GDPR — provision of the personalised service you requested. You can delete all of this at any time (see Section 6).

Community translation contributions (optional)

When you speak Oshiwambo (Oshindonga or Oshikwanyama) the assistant may invite you to translate one short English sentence into your dialect, to help build a free open dataset for future Oshiwambo AI tools. Each contribution you submit is stored as: the English source sentence, your translation, the dialect label, and a one-way salted hash of your phone number (not the number itself). Your translation is automatically scrubbed for personal-data patterns before being saved, the same way as any other message.

Purpose: to collect parallel Oshiwambo–English translation pairs that are reviewed by a native-speaker on our team and are intended to be published as an open dataset that any Namibian, researcher, or organisation can use to make AI tools speak Oshiwambo properly. The Common Intelligence Foundation reserves the right to choose the publication licence at the time of release.

Legal basis: Art. 6 (1) (a) GDPR — your explicit and informed consent. The invitation message explains, before you submit anything, that the contribution becomes a permanent part of the public-good dataset and cannot be retracted afterwards (similar to a Wikipedia edit). Submitting a translation is the act of consent. Art. 89 GDPR and § 27 BDSG ("Forschungsprivileg") additionally apply because the dataset constitutes scientific / community-infrastructure research output.

Intellectual-property terms. The licence you grant to the Common Intelligence Foundation when you submit a translation — a broad, perpetual, irrevocable, sublicensable right to use, modify, distribute, and publish your contribution as part of the open dataset — is set out in Section 10 of the Terms of Service. Please read it before contributing.

Permanence — important. Unlike the rest of your data described in this Section 2, contributions are not erased by the "delete my data" command. The reason is the same one Wikipedia gives for not unwinding individual edits: removing past contributions would compromise a public resource that other people now depend on. You can stop contributing at any time, and a request to "delete my data" will still wipe your conversation history, your long-term memory, and your usage log — it just doesn't wipe submissions you made into the open dataset.

Service updates (occasional outbound messages)

From time to time we may send you a short WhatsApp message from Ongiini AI about a new capability, a service outage, or a way to help — for example, an invitation to contribute Oshiwambo translations. These messages are sent through a pre-approved WhatsApp message template; their content is short and is never personalised beyond a generic announcement.

Reply STOP (or unsubscribe, opt out) at any time and we will permanently stop sending you these update messages. Your reply is recorded as a salted, one-way hash of your phone number in a separate opt-out store — we do not store the raw number for this purpose. Opting out does not delete your conversation history, your long-term memory, or your usage log; only the proactive outbound channel is switched off. You can still chat with the assistant normally afterwards.

Purpose: to keep users informed about meaningful changes to the service they already use, and to invite participation where useful (e.g. the community translation project).

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in keeping existing users informed about the service they have an active relationship with. The interest is proportionate because (a) messages are infrequent and tied to genuine service news, (b) we honour any opt-out immediately, and (c) the content is the same generic announcement for everyone, with no profiling and no personalisation beyond your phone number being the delivery address.

Usage log

We keep one line per message in a usage log: your phone number (used as identifier), a timestamp, the message kind (text / image / audio), the number of input/output tokens used, and a flag indicating whether the assistant used web search for that turn. The log does not contain the content of any message.

Separately, a structural trace file records, per message: number of model calls, token counts per call, latency, finish reason, and tool-call names + payload lengths. It deliberately does not record message content, tool arguments verbatim, or tool results — only structural signals.

A short-term in-memory rate-limiter tracks message timestamps per phone number to detect bursts of activity. This state lives only in process memory and is lost whenever the service restarts; it is not written to disk.

Purpose: to monitor fair use of the free monthly token allowance, to detect abuse, and to keep the service operationally sustainable.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in service sustainability and abuse prevention. The interest is proportionate because none of these records contain message content.

Website access logs (ongiini.ai)

The website is served via Cloudflare. For security and operational purposes, Cloudflare logs each request: source IP address, user-agent string, requested URL, timestamp, and HTTP status. Cloudflare also processes basic security signals (rate-limiting, bot detection).

The website does not set advertising cookies, does not load any analytics scripts, and uses your browser's localStorage only to remember your language preference (English / Afrikaans). This is technically necessary and does not require consent.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in security and operability.

Anonymous web chat (chat.ongiini.ai)

The web-chat version of Ongiini at chat.ongiini.ai works without any account. When you open the page, your browser generates a random session identifier (a UUID v4) and stores it in your browser's localStorage. That identifier is never combined with your phone number, email, or any other personal data — we receive it back on each request only so the assistant can follow the same conversation across consecutive messages within one browsing session. The conversation history for that session lives only in the server's working memory, capped at a few hours of inactivity and automatically discarded after that; it is never written to disk, never copied into long-term memory ("mem0"), and never recorded in the usage log. Restarting our server, closing your browser tab, or clicking "Clear conversation" in the chat interface all remove the session immediately.

Photos you attach in the web chat are processed the same way as on WhatsApp: the assistant reads the image in memory to answer your question and discards the bytes afterwards. The image itself is not persisted.

IP-based rate-limit. To prevent abuse of the open endpoint, we apply a sliding-window rate-limit per source IP address (read from the CF-Connecting-IP header set by Cloudflare). The limit state is kept only in working memory and is lost when the server restarts. Beyond rate-limiting, your source IP is not stored, logged on disk, or analysed.

Legal basis: Art. 6 (1) (b) GDPR (performance of the service you requested by opening the chat) for the conversation flow itself, and Art. 6 (1) (f) GDPR (legitimate interest in keeping the open endpoint available and safe from abuse) for the IP-based rate-limit.

3. Who else sees your data (processors and third parties)

• Meta Platforms Inc. (WhatsApp) — to deliver messages between you and us via the WhatsApp Business API, Meta receives, processes and routes them. Meta retains messages in line with its own policies. We have a data-processing relationship with Meta but cannot control Meta's own processing of your data — that is governed by Meta's terms and privacy policy.
• Tavily (Tavily Inc., a US-based provider) — used only when the assistant decides to perform a web search for your question. In that case, the assistant's search query (which may reference what you wrote) is sent to Tavily's API, and Tavily returns search results. Per Tavily's published privacy policy, Tavily may use search queries to improve its own service. If you do not want your search queries to be used in this way, you can object directly to Tavily at support@tavily.com. The exact processing location is governed by Tavily's own privacy practices.
• Cloudflare Inc. — hosts the website (ongiini.ai) and fronts the web-chat endpoint at chat.ongiini.ai together with the API at api.ongiini.ai. The CF-Connecting-IP header Cloudflare adds to each request is what we use for the chat rate-limit described in Section 2.8. Cloudflare does not have access to your WhatsApp conversation or any data on our local infrastructure.

The AI model used (Google DeepMind's Gemma 4 26B) is an open-weight model that runs locally on hardware we operate. Google does not receive any of your data through the use of this model.

Voice-note transcription is also performed locally by an open-source speech-to-text model (Whisper / faster-whisper). No third party receives the audio.

We do not sell, rent or share your data with anyone else. We do not use it for advertising. We do not use it to train any AI model. We do, however, run aggregate analyses across stored data for transparency reporting and research — only aggregate, statistical results are produced and published; individual conversations are never published. See the "Research, analytics & transparency reporting" section below for details. One nuance: when web search is invoked, Tavily — as a separate company governed by its own terms — may use the search queries it receives from us to improve its own service (see the Tavily entry above). Ongiini itself trains no model on user data.

Data Processing Agreements. Our two primary processors operate under formal data-processing terms required by Art. 28(3) GDPR:

• Meta's WhatsApp Business API is governed by Meta's Business Data Processing Terms and Business Data Transfer Addendum, incorporated by reference into the WhatsApp Business API terms we accepted.
• Cloudflare's Customer Data Processing Addendum is publicly published and automatically incorporated into our service terms.

Tavily does not currently publish a standalone Art. 28 GDPR Data Processing Agreement; its relationship with users is governed by its own published privacy policy and terms of service, including the SCC references for non-EU transfers cited there.

4. International data transfers

Meta and Tavily are based in the United States and process data there. Cloudflare also operates globally including in the United States. Transfers to the United States are based on the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) where the recipient is certified under it, otherwise on the European Commission's Standard Contractual Clauses (SCC) with supplementary technical and organisational measures.

For transfers under the SCCs, the supplementary measures we rely on include: (a) encryption in transit (TLS) for all API calls to processors; (b) data minimisation — US-based processors only receive the data strictly necessary for their service (Meta receives WhatsApp message routing per its API; Tavily receives only the model's search query at the moment a search is performed; neither receives access to our local memory, mem0 store, or usage logs); (c) no persistent storage of our memory data on the processor side — short-term JSON memory, the mem0 vector store, the usage log and the trace log all live on our own computer.

The Ongiini computer itself, where short-term and long-term memory are stored, is currently physically located in Germany (EU). Once the service moves to Namibia, processing will take place in Namibia.

5. How long we keep your data

• Short-term conversation memory: approximately the last 14 turns, summarised thereafter. There is no hard time limit; older turns roll out as new ones come in.
• Long-term memory ("mem0"): the extracted facts (vector embeddings in qdrant) and their mutation history (local SQLite log) are stored indefinitely until you ask us to delete them, or until the conversation has been inactive for an unusually long time and we decide to prune the data set during routine maintenance. The "delete my data" command wipes both.
• Usage log: stored indefinitely, but contains no message content.
• Trace file: stored indefinitely. Structural signals only — no message content, no tool arguments, no tool results.
• Cloudflare access logs for the website: retained by Cloudflare per its default retention (typically around 7–30 days).
• Anonymous web-chat sessions (chat.ongiini.ai): kept in the server's working memory only, evicted after approximately 6 hours of inactivity, or sooner when the in-memory capacity is reached (oldest-first eviction). Lost completely whenever the server restarts. Never written to disk.

You can delete your conversation memory at any time by sending "delete my data" on WhatsApp (see Section 6).

6. Your rights

Under the GDPR, you have the right to:

• Access (Art. 15) — find out what we have stored. Send "what do you remember about me?" on WhatsApp at any time. For the full dataset including timestamps and the usage log, email us at the address in Section 1.
• Rectification (Art. 16) — correct anything inaccurate. The simplest way is to tell the assistant the correct fact and the memory will be updated. Alternatively, email us.
• Erasure (Art. 17) — delete your data. Send "delete my data" on WhatsApp. Your conversation memory (short-term and long-term) is wiped immediately. The usage log line referring to that message is retained as anonymous statistics (no content, no identifier link).
• Restriction of processing (Art. 18) — limit how we use your data. Email us.
• Objection (Art. 21) — object to processing based on legitimate interest. Email us; you can also simply stop using the service.
• Data portability (Art. 20) — receive an export of your data in a machine-readable format. Email us; we'll send you a JSON export of your mem0 facts and short-term memory.
• Lodge a complaint with a supervisory authority. Since we are based in Berlin, the relevant authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. You may also complain to the supervisory authority in the country where you live.

Web chat (chat.ongiini.ai). The web chat has no separate "delete my data" command because there is nothing persistent to delete — see Section 2.8 for how the session-only data model works. Clicking "Clear conversation" in the chat interface clears the in-memory session immediately and wipes your local session identifier from your browser. Closing the browser tab and waiting a few hours has the same effect (the server-side session is dropped automatically after the inactivity window).

7. Research, analytics & transparency reporting

Part of the Common Intelligence Foundation's mission is to understand how AI access changes the lives of underserved communities — and to share what we learn openly. To do that, we run aggregate analyses across the data we already store for service operation.

The questions we ask the data. Examples:

• How many people use Ongiini per day, week, month — and how is the user base growing?
• What share of conversations relate to health, education, agriculture, contracts, daily life, or other topics?
• What roles or professions appear in our user base (farmers, students, teachers, parents, etc.), as inferred from conversation context?
• Which languages are people using, and how is that distribution shifting?
• How often does the same user return, and how does engagement change over time?
• When do people use the service — time of day, day of week?

Lawful basis. Art. 6 (1) (f) GDPR — legitimate interest of the foundation in understanding the impact of the service it operates, in reporting transparently on its work, and in contributing to the wider field of research on AI access in underserved communities. Where results are published as scientific research, Art. 89 GDPR and § 27 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG — the "Forschungsprivileg" or research privilege) also apply, with the safeguards described below. You may object to this processing at any time under Art. 21 GDPR — see "Your right to object" at the end of this section.

What we publish. Only aggregate statistical results — counts, percentages, charts, trends — that do not identify any individual. Such results may appear on the website (e.g. on a public /statistics page), in foundation reports, or in academic papers.

What we never publish.

• Individual conversation content, in full or in excerpt, where any reasonable risk of identifying a specific person exists.
• Phone numbers, narrow locations, names, or any other direct identifier.
• Quotes or examples that have not been independently reviewed and stripped of identifying detail.

Safeguards. The data analysed is the same data we already store for the service: short-term memory, mem0 facts, and the structural usage log (see Section 2). PII patterns are scrubbed before storage. Analysis is performed on our own infrastructure, by team members operating under a confidentiality obligation. Where a human-readable example is being considered for publication, it goes through a separate de-identification review before it can leave the foundation.

Your right to object. Because this processing relies on legitimate interest, you may object at any time under Art. 21 GDPR. Email us at the address in Section 1 with the subject line "object to research processing" and your phone number. We will mark your data as excluded from current and future aggregate analyses and publications. The service itself continues to work normally.

8. Automated processing and AI

Ongiini's replies are generated entirely automatically by an AI model — there is no human in the loop. The service does not make decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR; it provides information in response to your questions, and you decide what to do with that information.

AI-generated answers may be inaccurate, incomplete, or wrong. Do not rely on Ongiini's answers for medical, legal, financial, or other significant decisions. See the Terms of Service for the full disclaimer.

9. EU AI Act classification

Under Regulation (EU) 2024/1689 (the AI Act), Ongiini is a chatbot — a limited-risk AI system subject to the transparency obligations of Article 50. It is not a high-risk AI system under Annex III, and it does not engage in any of the prohibited practices listed in Article 5.

We meet the Article 50 transparency obligations by clearly identifying every interaction as AI-mediated: in the WhatsApp Business profile, in the assistant's first reply to every new user, in the disclosures on this website, and in this policy. The disclosures are provided in plain language at the point of first interaction (Article 50(5)).

The underlying model (Google DeepMind's Gemma 4 26B) is a general-purpose AI model. Under Article 25 of the AI Act, we accept the provider responsibilities for the integrated Ongiini chatbot system that we build on top of it.

10. Children

Ongiini is intended for general users in Namibia and is not specifically directed at children. We do not knowingly process personal data of children under 16. If you believe a child has used the service, please contact us and we will remove the relevant data.

11. Security

Conversation data is stored on a single computer operated by us, in Germany, behind a firewall and accessible only via authenticated administrative access. We apply state-of-the-art technical and organisational measures (Art. 32 GDPR), but no system is perfectly secure. If we become aware of a personal-data breach affecting your rights, we will notify the supervisory authority within 72 hours (Art. 33 GDPR) and, where required, inform you directly (Art. 34 GDPR).

12. Changes to this policy

If we change this policy materially, we will update the date at the top and, for substantial changes (e.g. new categories of processing, new processors, change of controller upon foundation registration), notify users via the WhatsApp service or on the website.