Privacy Policy

1. Information We Collect

We collect information you provide directly, information collected automatically, and information from third parties:

• Account & organization data — company name, domain, your name, email address, password (stored hashed), role, and billing details.
• Customer content — the emails, files, messages, records, and other data you and your users store in the Services.
• Usage & device data — log data, IP address, browser type, device identifiers, pages viewed, and feature interactions.
• Cookies & similar technologies — used for authentication, preferences, security, and analytics.

2. How We Use Information

• Provide, operate, maintain, and secure the Services.
• Authenticate users and protect against fraud, abuse, and security incidents.
• Process transactions and send related information, including confirmations and invoices.
• Respond to your requests and provide customer support.
• Send administrative and, where permitted, marketing communications (you may opt out).
• Improve and develop the Services and comply with legal obligations.

3. Legal Bases for Processing

Where the GDPR applies, we process personal data on the basis of contract performance, our legitimate interests, your consent (where required), and compliance with legal obligations.

4. How We Share Information

We do not sell your personal information. We share information only:

• With service providers (sub-processors) who process data on our behalf under contract;
• Within your organization, according to the permissions configured by your administrators;
• To comply with law, enforce our terms, or protect rights, safety, and security;
• In connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Customer content is retained according to your organization’s settings and is deleted following account termination, subject to backup cycles.

6. Security

We implement administrative, technical, and organizational measures designed to protect information, including encryption in transit, access controls, tenant data isolation, and malware scanning of uploads. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing or withdraw consent. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have specific rights. To exercise them, contact us using the details below. We will not discriminate against you for exercising your rights.

9. Cookies

We use strictly necessary cookies for authentication and security, and optional cookies for preferences and analytics. You can control cookies through your browser settings; disabling some cookies may affect functionality.

10. Children’s Privacy

The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us information, please contact us so we can delete it.

11. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where appropriate, provide additional notice.

12. Contact Us

If you have questions about this Policy or our privacy practices, contact us at privacy@onebusiness.ai.