Privacy Policy

Onexa is the controller of the personal data described here. If you have any questions about this policy or how your data is handled, contact us at support@onexa.me.

• Order details — the amount, currency, asset, network, wallet address, quoted rate, and fee for each order, so an order can be created, fulfilled, and supported.
• Contact details — your email address (and name, where available) collected by our payment provider during checkout and linked to your order for receipts and support.
• Payment data— card and billing details are entered on our payment provider's secure checkout. Onexa never sees or stores your full card number; we receive only confirmation of payment and limited transaction metadata (such as a transaction reference and method).
• Technical data — information your browser sends automatically, such as approximate device and browser type, and interaction data needed to operate and secure the site.
• Usage & analytics — we count visits using two first-party cookies that hold only a random identifier (no name, email, IP address or fingerprint), so we can see how many people use the site and which pages help them. The Meta Pixel additionally helps us measure our marketing. See our Cookie Policy for the detail.

• to create, process, and fulfil your orders;
• to provide customer support and respond to your messages;
• to detect, prevent, and investigate fraud, abuse, and security issues;
• to comply with legal, regulatory, and record-keeping obligations;
• to measure, maintain, and improve the service; and
• to understand which marketing is effective and to show relevant ads.

We do not sell your personal data.

Where data-protection law such as the GDPR applies, we rely on: performance of a contract (to fulfil your order), legal obligation (to meet compliance and record-keeping duties), legitimate interests (to secure and improve the service and prevent fraud), and consent (for non-essential cookies and analytics, where required). You can withdraw consent at any time.

• Payment provider — to process your payment and confirm your order.
• Analytics & advertising partners (such as Meta) — through cookies and the pixel, in line with the Cookie Policy.
• Infrastructure providers — hosting and database services that run the platform on our behalf, under appropriate confidentiality obligations.
• Authorities — where we are legally required to disclose, or to protect our rights, users, or the public.

Some of our providers may process data in countries other than yours. Where we transfer personal data internationally, we take steps to ensure it remains protected in line with applicable law, for example through appropriate safeguards or contractual protections.

We keep order records for as long as necessary to provide the service and to meet our legal, accounting, and compliance obligations, after which they are deleted or anonymised. Separately, a short-term history of your recent orders is kept on your own device (in your browser) for up to 7 days for your convenience; you can clear it any time by clearing your browser storage.

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls, and keeping payment card entry entirely on the payment provider's secure checkout. No system is perfectly secure, but we work to protect your data and to limit what we hold in the first place.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• delete your data ("right to be forgotten"), subject to legal retention duties;
• restrict or object to certain processing, including direct-marketing analytics;
• data portability, where applicable; and
• withdraw consent, and to lodge a complaint with your local data-protection authority.

To exercise any of these, contact us — we will respond within the time required by applicable law.

The service is not intended for anyone under the age of majority in their jurisdiction, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. When we do, we will revise the "last updated" date above and, where appropriate, notify you.

Email support@onexa.me or message us on Telegram.