Privacy Policy

How Ongiini handles your data — last updated 21 May 2026

1. Who is responsible

The controller of your personal data within the meaning of Article 4 (7) GDPR is:

Sebastian Küpers · Hibiskusweg 17b · 13089 Berlin · Germany · sebastian.kuepers@gmail.com · +49 170 2372987

Ongiini is the first project of the Common Intelligence Foundation, currently being formally established as a non-profit foundation in Estonia. Until that registration is complete, the service is privately funded and operated on a non-profit basis. After registration, the foundation will become the controller; you will be informed of that change in this policy.

The service is provided without charge and is not operated for profit.

Our processing does not meet the thresholds in Art. 37 GDPR for the mandatory appointment of a Data Protection Officer. You can reach us with any privacy enquiry using the contact details above.

2. What we process, why, and on what legal basis

Your phone number and message content

When you message the Ongiini WhatsApp number, we receive your phone number (as your WhatsApp identifier) and the content of each message you send — text, images, and voice notes. Voice notes are downloaded from Meta and transcribed to text on our own computer using an open-source speech-to-text model (Whisper). The original audio bytes are not retained after transcription; only the text transcript is processed and stored, the same way as any other text message.

Purpose: to read your question and provide an answer — i.e. to deliver the service you requested by initiating the conversation.

Legal basis: Art. 6 (1) (b) GDPR — performance of pre-contractual measures requested by you. By sending a message, you ask the service to respond.

Short-term conversation memory

We keep approximately the last 50 turns of your conversation (each turn = one message from you plus one reply) in a local file on the computer that runs Ongiini, identified by your phone number. Once the stored history grows beyond about 70 entries, the oldest entries are condensed into a single short summary line ("Earlier in this conversation: …") and the most recent ~40 turns are kept verbatim. Before any message is written to disk, we automatically scrub obvious personal data patterns from the text (email addresses, IBANs, credit-card numbers and Namibian-format ID numbers are replaced with placeholders such as [REDACTED:email]).

Purpose: to allow the assistant to follow a conversation across messages (so you don't have to repeat context).

Legal basis: Art. 6 (1) (b) GDPR — necessary to provide the conversation service you requested.

Long-term memory ("mem0")

Across all your chats, the assistant extracts a small number of typed facts about you and stores them as short text fragments. Categories are: [PROFILE] (location, role, family), [PREFERENCE] (language, style), [SITUATION] (ongoing topics), [COMMITMENT] (follow-ups, reminders), [QUOTE] (verbatim phrasing the assistant might re-use), and [EMOTION] (recent state). These facts are stored as numerical embeddings in a local vector database (qdrant), identified by your phone number, and are retrieved by semantic similarity each time you write so the assistant can recall relevant context. mem0 also maintains a separate local SQLite database that records when each fact was added, updated or deleted — this contains the fact text and metadata, but no full message content beyond the extracted fact itself.

Purpose: to make the assistant useful over time — to remember that you farm maize, that you prefer Afrikaans replies, that you previously asked about a school topic, etc.

Legal basis: Art. 6 (1) (b) GDPR — provision of the personalised service you requested. You can delete all of this at any time (see Section 6).

Usage log

We keep one line per message in a usage log: your phone number (used as identifier), a timestamp, the message kind (text / image / audio), the number of input/output tokens used, and a flag indicating whether the assistant used web search for that turn. The log does not contain the content of any message.

Separately, a structural trace file records, per message: number of model calls, token counts per call, latency, finish reason, and tool-call names + payload lengths. It deliberately does not record message content, tool arguments verbatim, or tool results — only structural signals.

A short-term in-memory rate-limiter tracks message timestamps per phone number to detect bursts of activity. This state lives only in process memory and is lost whenever the service restarts; it is not written to disk.

Purpose: to monitor fair use of the free monthly token allowance, to detect abuse, and to keep the service operationally sustainable.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in service sustainability and abuse prevention. The interest is proportionate because none of these records contain message content.

Website access logs (ongiini.ai)

The website is served via Cloudflare. For security and operational purposes, Cloudflare logs each request: source IP address, user-agent string, requested URL, timestamp, and HTTP status. Cloudflare also processes basic security signals (rate-limiting, bot detection).

The website does not set advertising cookies, does not load any analytics scripts, and uses your browser's localStorage only to remember your language preference (English / Afrikaans). This is technically necessary and does not require consent.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in security and operability.

3. Who else sees your data (processors and third parties)

• Meta Platforms Inc. (WhatsApp) — to deliver messages between you and us via the WhatsApp Business API, Meta receives, processes and routes them. Meta retains messages in line with its own policies. We have a data-processing relationship with Meta but cannot control Meta's own processing of your data — that is governed by Meta's terms and privacy policy.
• Tavily (Tavily Inc., a US-based provider) — used only when the assistant decides to perform a web search for your question. In that case, the assistant's search query (which may reference what you wrote) is sent to Tavily's API, and Tavily returns search results. Tavily acts as a data processor for us; the exact processing location is governed by Tavily's own privacy practices.
• Cloudflare Inc. — hosts the website (ongiini.ai). Cloudflare does not have access to your WhatsApp conversation or any data on our local infrastructure.

The AI model used (Google DeepMind's Gemma 4 26B) is an open-weight model that runs locally on hardware we operate. Google does not receive any of your data through the use of this model.

Voice-note transcription is also performed locally by an open-source speech-to-text model (Whisper / faster-whisper). No third party receives the audio.

We do not sell, rent or share your data with anyone else. We do not use it for advertising. We do not use it to train any AI model.

4. International data transfers

Meta and Tavily are based in the United States and process data there. Cloudflare also operates globally including in the United States. Transfers to the United States are based on the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) where the recipient is certified under it, otherwise on the European Commission's Standard Contractual Clauses (SCC) with supplementary technical and organisational measures.

The Ongiini computer itself, where short-term and long-term memory are stored, is currently physically located in Germany (EU). Once the service moves to Namibia, processing will take place in Namibia.

5. How long we keep your data

• Short-term conversation memory: approximately the last 14 turns, summarised thereafter. There is no hard time limit; older turns roll out as new ones come in.
• Long-term memory ("mem0"): the extracted facts (vector embeddings in qdrant) and their mutation history (local SQLite log) are stored indefinitely until you ask us to delete them, or until the conversation has been inactive for an unusually long time and we decide to prune the data set during routine maintenance. The "delete my data" command wipes both.
• Usage log: stored indefinitely, but contains no message content.
• Trace file: stored indefinitely. Structural signals only — no message content, no tool arguments, no tool results.
• Cloudflare access logs for the website: retained by Cloudflare per its default retention (typically around 7–30 days).

You can delete your conversation memory at any time by sending "delete my data" on WhatsApp (see Section 6).

6. Your rights

Under the GDPR, you have the right to:

• Access (Art. 15) — find out what we have stored. Send "what do you remember about me?" on WhatsApp at any time. For the full dataset including timestamps and the usage log, email us at the address in Section 1.
• Rectification (Art. 16) — correct anything inaccurate. The simplest way is to tell the assistant the correct fact and the memory will be updated. Alternatively, email us.
• Erasure (Art. 17) — delete your data. Send "delete my data" on WhatsApp. Your conversation memory (short-term and long-term) is wiped immediately. The usage log line referring to that message is retained as anonymous statistics (no content, no identifier link).
• Restriction of processing (Art. 18) — limit how we use your data. Email us.
• Objection (Art. 21) — object to processing based on legitimate interest. Email us; you can also simply stop using the service.
• Data portability (Art. 20) — receive an export of your data in a machine-readable format. Email us; we'll send you a JSON export of your mem0 facts and short-term memory.
• Lodge a complaint with a supervisory authority. Since we are based in Berlin, the relevant authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. You may also complain to the supervisory authority in the country where you live.

7. Automated processing and AI

Ongiini's replies are generated entirely automatically by an AI model — there is no human in the loop. The service does not make decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR; it provides information in response to your questions, and you decide what to do with that information.

AI-generated answers may be inaccurate, incomplete, or wrong. Do not rely on Ongiini's answers for medical, legal, financial, or other significant decisions. See the Terms of Service for the full disclaimer.

8. EU AI Act classification

Under Regulation (EU) 2024/1689 (the AI Act), Ongiini is a chatbot — a limited-risk AI system subject to the transparency obligations of Article 50. It is not a high-risk AI system under Annex III, and it does not engage in any of the prohibited practices listed in Article 5.

We meet the Article 50 transparency obligations by clearly identifying every interaction as AI-mediated: in the WhatsApp Business profile, in the assistant's first reply to every new user, in the disclosures on this website, and in this policy. The disclosures are provided in plain language at the point of first interaction (Article 50(5)).

The underlying model (Google DeepMind's Gemma 4 26B) is a general-purpose AI model. Under Article 25 of the AI Act, we accept the provider responsibilities for the integrated Ongiini chatbot system that we build on top of it.

9. Children

Ongiini is intended for general users in Namibia and is not specifically directed at children. We do not knowingly process personal data of children under 16. If you believe a child has used the service, please contact us and we will remove the relevant data.

10. Security

Conversation data is stored on a single computer operated by us, in Germany, behind a firewall and accessible only via authenticated administrative access. We apply state-of-the-art technical and organisational measures (Art. 32 GDPR), but no system is perfectly secure. If we become aware of a personal-data breach affecting your rights, we will notify the supervisory authority within 72 hours (Art. 33 GDPR) and, where required, inform you directly (Art. 34 GDPR).

11. Changes to this policy

If we change this policy materially, we will update the date at the top and, for substantial changes (e.g. new categories of processing, new processors, change of controller upon foundation registration), notify users via the WhatsApp service or on the website.