Identity and contact details
Your name or nickname, email address, Discord user ID, username, avatar and relevant roles in the Onyx Discord server. Approved workers may also create separate Launcher sign-in details.
Privacy in plain English
How Onyx handles your information.
This policy covers the Onyx website, customer and staff accounts, chats, orders, Discord-assisted services, the Onyx Launcher and related support.
Last updated: 10 October 2026
The short version
We collect information needed to operate, secure and support Onyx services. We do not sell personal information. We limit access and sharing to the people and providers needed for those purposes.
Who is responsible
One policy across Onyx services
Onyx Services is responsible for deciding how the personal information described here is used. In data-protection language, Onyx Services is the controller.
This policy applies whether information comes directly from you, from an authorised customer or worker, from Discord, from a payment or service provider, or automatically from the website, Launcher or approved RuneLite plugin.
Questions and privacy requests can be sent to [email protected] or raised through an Onyx support ticket.
What we collect
Information connected to your account, order and use of Onyx
We collect different information depending on which features you use. We do not need every category for every person.
Orders and transactions
Order numbers, requested services, account characteristics, prices, payment status, refunds, disputes, assigned staff, progress, completion records and related communications. Payment providers may process the payment details needed for your chosen method.
Account access information
When required for an order, you may submit RuneScape or Jagex account identifiers, login details, authentication codes or a Bank PIN. These details are protected and access is restricted. Please do not send credentials through public Discord channels or ordinary chat messages.
Messages, files and content
Website chat and Discord ticket messages, support files, RuneLite screenshots, completion screenshots and descriptions, and other content you choose to submit. Content clearly submitted for public approval may become visible on our website or community channels after review.
Website and security information
IP address, approximate country or region, browser and device type, user agent, session and cookie identifiers, referral information, security checks, rate-limit events, chat diagnostics, and records of access or administrative actions.
Launcher and order-session information
Approved-device identifiers, operating system and app version, login and launch events, session heartbeats, diagnostics, relevant RuneLite activity, safety events, bank or item summaries, screenshots and optional customer-connection metadata. The dedicated Launcher guide explains this in more detail.
We do not intentionally ask for health, biometric, political, religious or other special-category information. Please do not include unrelated sensitive information in chats, uploads or order notes.
Why we use it
Delivery, security, support and accountability
We use personal information to provide requested services, manage accounts and permissions, communicate about orders, protect credentials, monitor authorised Launcher sessions, provide progress, prevent abuse, investigate incidents and disputes, maintain records and improve reliability.
Contract
To create and fulfil an order, provide support, communicate about the service, protect submitted account access and handle payment, completion or refund requests.
Legitimate interests
To secure our systems, prevent fraud or unauthorised access, enforce order rules, keep proportionate audit evidence, investigate disputes or missing items, and improve service reliability. We balance these interests against the rights of the people affected.
Legal obligation
To keep records or disclose information where tax, accounting, regulatory, court or other applicable law requires it.
Consent
For optional analytics and advertising measurement, and for any other activity where we specifically ask for consent. Consent can be withdrawn through cookie preferences or by contacting us.
Who receives it
Shared only where the service requires it
We do not sell personal information. Depending on the feature or order, information may be shared with the following recipients.
- The worker assigned to an order, but only to the extent needed to perform it. On supported Launcher orders, workers use protected sign-in rather than being shown submitted credentials.
- Authorised Onyx staff who need the information for order delivery, support, security, payment, moderation or dispute handling.
- Trusted service providers that help us host and operate the service, deliver messages and email, store or deliver images, monitor reliability and provide support. They may only use information for the services they provide to us or as the law requires.
- Discord for authentication, roles, tickets and order communications; and Google for reCAPTCHA plus optional Analytics or advertising measurement where enabled.
- Payment, cryptocurrency or other transaction providers selected for an order. They process payment information under their own notices as well as any instructions we give them.
- Professional advisers, insurers, law-enforcement bodies, regulators or courts where reasonably necessary, and a buyer or successor if the business is reorganised or transferred.
International processing
Some providers or team members may process information outside the UK. Where data-protection law requires it, we use an adequacy decision, approved contractual safeguards or another lawful transfer mechanism, together with proportionate security controls.
How long we keep it
No longer than the purpose requires
Retention depends on the information and why it exists. Account data is normally kept while the account is active and for a reasonable period afterwards. Order, payment, support, security and dispute records may be kept longer where needed to meet contractual, accounting, fraud-prevention, legal or evidential requirements.
Account credentials, authentication material and game sessions are treated separately from ordinary order history. Access is restricted and revoked when no longer valid; customers can also clear saved order credentials. We review whether saved credentials and related access material remain necessary rather than treating them as ordinary permanent profile data.
Short-lived codes, connection tickets, rate-limit records and temporary upload links expire sooner. Approved public posts may remain public until removed, while rejected or replaced material may be deleted or retained briefly for moderation and audit. Backups and logs may persist for a limited period before rotation.
Security
Layered protection, not impossible promises
We use proportionate technical and organisational safeguards designed to protect information, limit access to the people and systems that need it, detect misuse and keep appropriate records of sensitive activity. Access is limited according to role and order responsibility.
No internet service or storage method is 100% secure. If you believe information or an account may have been compromised, contact support promptly and change affected third-party credentials.
Your choices and rights
You can ask what we hold and how it is used
Rights depend on the circumstances and are not always absolute. We may need to verify identity before responding.
- Ask for a copy of personal information we hold about you.
- Ask us to correct information that is inaccurate or incomplete.
- Ask us to erase information or restrict how it is used, where the law provides that right.
- Object to processing based on legitimate interests or to direct marketing.
- Receive information you provided in a portable format where the right applies.
- Withdraw consent at any time without affecting earlier lawful processing.
- Complain to the UK Information Commissioner’s Office or another competent supervisory authority.
Children and young people
RuneScape-related services may appeal to young people. If you are under 18, involve a parent or guardian before placing an order, making a payment or submitting account credentials. We do not knowingly use children’s information for personalised advertising. A parent or guardian can contact us if they believe a child has provided information inappropriately.
Automated decisions
We use automated security and abuse checks, but we do not use personal information to make solely automated decisions that produce legal or similarly significant effects. Important access, order and moderation decisions can be reviewed by an authorised person.
Changes to this policy
We may update this policy when services, providers or legal requirements change. We will publish the revised policy here and change the date above. Where a change materially affects how existing information is used, we will provide an appropriate additional notice.
Questions about your information?
Email [email protected] or open a private support ticket. Please do not include passwords, Bank PINs or authentication codes in an ordinary privacy enquiry.