Legal

Privacy policy

Last updated: Oct 23, 2026

What we keep, why we keep it, who helps us, and the choices you have.

The short version

Onbehalf never holds your money, your private keys or your biometrics.
This website sets no cookies and runs no analytics or tracking.
The Console keeps only what it needs to work.
We never sell your data. We never use it for ads. We never use it to train AI models.
A few services in the United States help us run Onbehalf. They are listed below.
Onbehalf is in test mode today. No real money moves.

Who we are

Onbehalf is operated by Malcolm Henzaga. In this policy, "we" and "us" mean Onbehalf and Malcolm Henzaga.

"You" means anyone who visits getonbehalf.com, or who uses the Onbehalf Console at app.getonbehalf.com.

The Console is invite only. It is built for companies and the people who work for them. It is not for consumers.

This website

getonbehalf.com is a set of static pages. It sets no cookies. It runs no analytics and no tracking. The design partner form is the only place it asks you for anything.
Cloudflare hosts the website. Like any web host, it handles your IP address and basic request details. It uses them to deliver pages and to protect the site from attacks. We don't use them to follow you.
Verify runs in your browser. The receipt you drop in never leaves your device. We store nothing from it.
If you email hello@getonbehalf.com, your message arrives in our inbox at Google (Google Workspace). We keep your address and message so we can reply.

The design partner form

The form on getonbehalf.com/design-partners asks for four things: your name, your work email, your company, and what your agent will pay for. Nothing else. It sets no cookies.
We use your answers to reply to you, send you a link to book a call, and invite you to the design partner program.
Your answers are kept in Onbehalf's own database. We never sell them or share them for marketing.
To stop spam, the form has a hidden field that people never see, and a limit on how often one sender can submit. For that limit, we keep a scrambled code made from your IP address (a one-way hash), never the address itself. We delete it within 2 days.
We keep your answers until you ask us to delete them, or for 12 months after our last contact, whichever comes first. If you join the program, your details move into your Console, and the Console's rules apply.
To see, correct or delete your answers, email hello@getonbehalf.com.
If you book a call, the booking page is run by Google. Google's privacy policy applies to what you give it there.

The Console: what we keep

Only what the Console needs to work.

People: Names, work email addresses and roles. We use your email to send sign-in codes. Planned: invites. Receipts carry names and roles, never emails.
Your company: Its name, its agents, and who owns each agent.
Your rules: Limits, and who each agent can pay.
Recipients: Names and wallet addresses.
Payment requests: Amount, recipient, the reason your agent gives, a reference and the time.
Records: Decisions, approvals, receipts, stops and rule changes. Each one is signed. We also record each time records are downloaded, and each lost-passkey reset.
Outside IDs: Stripe IDs and chain transaction IDs.
Stripe: If you connect it, the access Stripe gives us, so we can act within your rules.
Connected wallets: Their public addresses only.
Passkeys: The public half and an ID. The private half stays on your device or in your password manager.
Agent keys: When you connect an agent, we show its key once.
Sign-in: Your active sessions, so you can sign out everywhere. For each session, we keep the browser you used and a scrambled code made from your IP address (a hash), never the address itself. Our sign-in service, Supabase, keeps your IP address in its own sign-in log.
Feedback: What you send us through the Console.
Design partners: The invite details (company, name and work email), how far setup has got, notes from our check-in calls, and whether a letter of intent is signed.

What we never touch

Your money: It moves from your own accounts, never through ours.
Private keys: No private keys or seed phrases, ever.
Biometrics: No face, fingerprint or other biometric. We don't even learn which one you used.
Cards and banks: No card numbers or bank logins. Stripe holds those.
Your agent's mind: No conversations or reasoning. We see the request and the reason it gives.

The website sets no cookies.
The Console uses a session cookie and a security token that blocks forged requests. Both exist only to keep you signed in safely.
No tracking cookies, anywhere. That is why there is no cookie banner.
You stay signed in for 30 days on a device. You can sign out everywhere, from the You page.

How we use it

To run the Console: sign you in, apply your rules, ask the right person and seal receipts.
To send the emails you need. Today: sign-in codes. Planned: invites, and "a payment needs your yes".
To keep Onbehalf safe: stop abuse, find bugs and look into security problems.
To improve Onbehalf from the feedback you send.
To run the design partner program.

We never sell your data. We never share it for ads. We never use it to train AI models. Onbehalf has no AI of its own.

Who can see it

People in your company see what their role allows.
Onbehalf's own admin view shows only what it takes to run and support the service: your company, your team, your setup progress and your feedback.
To look inside your Console, Malcolm uses "View as them". It needs your admin's yes first. It is read only and lasts one hour. A banner shows the whole time. Every read is recorded and sealed.
We open your data directly only when we need to run, fix or protect the service, or when the law requires it.
The services below see only what their job needs.
We share data when the law requires it, for example a valid court order.

Services that help us

All in the United States today. Each one sees only what it needs for its job.

Service	What it does for us	What it sees
Cloudflare	Hosts the website and the Console. Connects the Console to our database. Keeps our encrypted backups. Runs our domain.	Data passing through the Console and the design partner form. Our encrypted backups. Visitors' IP addresses.
Supabase	Our database and sign-in. US West (Oregon).	Everything the Console keeps, and what you send through the design partner form.
Resend	Sends our emails. US East.	Each email and the address it goes to. Today: sign-in codes. Planned: invites (name, company and a note) and payment emails (agent, amount, recipient, money source, reason and reference).
Stripe	Only if you connect your own Stripe test account.	We get permission to act on your account within your rules. Today: test refunds, charges and account credits. Your money stays in your Stripe account. Disconnecting removes our access and your agents' permissions there.
Coinbase	Only for a test-network wallet.	Your email and your test wallet. Coinbase holds the wallet key. We see public addresses and signatures only.
Google (Google Workspace)	Our email, including hello@getonbehalf.com and security@getonbehalf.com.	Your email address and message.
GitHub	Holds our code. Runs our build checks, and a weekly test that restores an encrypted backup.	Our encrypted backup, during that test. No other customer data.
Anthropic (Claude)	The AI tool we use to build and run Onbehalf. It is not part of the product.	Your data, only when we fix a problem or check a record.

Stripe, Coinbase and Google each have their own privacy policy for what you give them directly.

Where your data lives

Our services keep data in the United States. If you are outside the US, including in Singapore, your data is sent to the US and kept there.

Who decides about your data

Inside your Console, your company decides what goes in. We handle that data for your company and follow its instructions. (Under Singapore's PDPA, we act as a data intermediary. Under the GDPR, a processor.)
For this website, emails to us and the design partner program, Onbehalf decides.
If you use a company's Console, some requests go to your company's admin first. Your company controls that data.

How long we keep it

Today, everything in the Console is test mode.
Encrypted backups are deleted after 30 days.
Design partner form answers: until you ask us to delete them, or 12 months after our last contact.
If you ask, we delete your test workspace. Backups clear 30 days later.
Planned for live customers: sealed records are kept for seven years by default. You can export everything, anytime. If you leave, you get a full export, and we delete your data 90 days later.
A receipt you have already shared stays with whoever has it. We can't recall it.

How we keep it safe

Every connection is encrypted.
Backups are encrypted.
Sign-in uses a one-time code sent by email. Five wrong tries cancel a code.
Approving a payment needs your passkey. On a test network, your wallet signs it instead. Sensitive changes need a fresh passkey too, such as loosening a limit or adding a recipient.
Every approval, stop and rule change is signed and recorded.
The stop button never waits for a passkey.
No system is perfect. If a problem puts your data at risk, we will tell the people affected and say what we are doing about it.

Your choices

See or correct your details on the You page in the Console.
Export your records from your Console, any time.
Sign out everywhere, from the You page.
Disconnect Stripe, in the Console or in Stripe.
Ask us to delete your data.
Email hello@getonbehalf.com for anything else. We aim to reply within two working days, and to finish requests within 30 days.
If you are not happy with our answer, you can contact the data protection authority where you live.

Children

Onbehalf is for companies and people at work. It is not meant for anyone under 18. We don't knowingly collect their data.

Changes to this policy

When we change this policy, we update the date at the top.
For important changes, we tell Console users before they take effect.
We plan to form a company to run Onbehalf. When we do, that company takes over this policy and your data. We will tell you first.

Contact

Onbehalf, operated by Malcolm Henzaga
Data protection contact: Malcolm Henzaga
hello@getonbehalf.com
Postal address on request.