Privacy policy

Privacy notice

This Privacy Notice for Oneprofile Software Company (“we,” “us,” or “our”), describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”).

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.

Summary of key points

This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics in the sections below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? We do not process sensitive personal information.

Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us.

Do we access your Google account data? Only if you sign in with Google, connect a Gmail mailbox, or connect Google Drive, and only to provide the features you chose. See section 15, “How do we handle Google user data?”

What happens when you connect an AI app? It works in your Oneprofile workspace as you, with the access you choose, and we send its answers only to that app. See section 16, “How do we handle AI apps you connect to Oneprofile?”

1. What information do we collect?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Sensitive information. We do not process sensitive information.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In short: Some information, such as your Internet Protocol (IP) address and browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

We also collect information through cookies and similar technologies.

2. How do we process your information?

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services.

3. When and with whom do we share your personal information?

In short: We may share information in specific situations described in this section and/or with the following third parties.

We may share your personal information in the following situations:

• Business transfers. In connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

• Affiliates. With our affiliates to honor this Privacy Notice.

• Business partners. To offer you certain products, services, or promotions.

We may share personal information with third parties in these categories: hosting and infrastructure; sign-in and accounts; payments and payouts; product analytics and error monitoring; advertising; customer support; our own team communication tools; AI model providers; email delivery; data sources used to research business contacts; and tools you choose to connect (CRMs, Slack, mailboxes, MCP servers), which receive only what you ask us to send them.

4. Do we use cookies and other tracking technologies?

In short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including to help manage and display advertisements or to tailor advertisements to your interests. The third parties and service providers use their technology to provide advertising about products and services tailored to your interests which may appear either on our Services or on other websites.

These are the providers we use on our website and our sign-up and sign-in pages, and what each is for:

• Google Analytics. Website analytics.

• Google Ads. Advertising and conversion measurement.

• X (Twitter) ads pixel. Advertising.

• PostHog. Product and website analytics, and experiments.

• Google Tag Manager. Loads the tags listed here.

• Framer. Website hosting and page-view statistics.

• Cal.com. The booking calendar on our demo page.

• Oneprofile referral cookie. Affiliate credit. It is set only when you arrive through a referral link.

You can refuse the cookies and tracking technologies that are not necessary by rejecting them in the cookie banner on our website. You can also block or delete cookies in your browser settings.

5. How do we handle your social logins?

In short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Google account). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, and profile picture, as well as other information you choose to make public on such a social media platform. Section 15 explains how we handle data we receive from Google.

We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend that you review their privacy notice.

6. Is your information transferred internationally?

In short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see “WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?” above), in the United States and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.

7. How long do we keep your information?

In short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

8. Do we collect information from minors?

In short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at support@getoneprofile.ai.

9. What are your privacy rights?

In short: You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

Withdrawing your consent:

If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us using the contact details provided.

Account information

You may at any time review or change the information in your account or terminate your account.

• Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Account information

You may at any time review or change the information in your account or terminate your account. Upon your request to terminate your account, we will deactivate or delete your account and information, unless we are required to retain it.

10. Controls for do-not-track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

11. Do we make updates to this notice?

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Revised” date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

12. How can you contact us about this notice?

If you have questions or comments about this notice, you may contact us by post at:

Oneprofile Software Company
455 Market Street
San Francisco, CA 94105
United States
support@getoneprofile.ai

13. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please fill out and submit a data subject access request.

14. Our browser extension

In short: If you use our browser extension, the information it handles is used only to provide and improve the Services you have asked it to perform.

Our browser extension works on the websites where you have asked it to perform actions for you. To do so, it may process information such as the details needed to connect it to your account, the content of the pages it works on, the messages you choose to send, and technical information about how those actions ran, including diagnostic information when an action does not complete.

We use this information to provide, maintain, troubleshoot, and improve our Services. We do not sell it or use it for advertising, and the advertising practices described elsewhere in this Privacy Notice do not apply to it. We do not share it with third parties except as needed to operate our Services. You can remove the extension at any time, and you may contact us to request access to or deletion of information it has shared with us.

15. How do we handle Google user data?

In short: We access Google user data only when you sign in with Google, connect a Gmail mailbox, or connect Google Drive, and we use it only to provide the features you chose. We do not sell it, use it for advertising, or use it to train generalized AI or machine learning models.

What Google user data we access depends on the features you use:

Sign in with Google: your name, email address, profile picture, and Google Account ID. We use them to create your Oneprofile account and sign you in.

Connected Gmail mailbox: your email address and Google Account ID, permission to send email from the mailbox (gmail.send), and permission to read the email messages in it (gmail.readonly), including their headers, bodies, and attachments.

Google Drive: only the individual files you choose in Google’s file picker (drive.file). We cannot see any other file in your Drive.

How we use it. With a connected Gmail mailbox, Oneprofile sends the emails in the outreach sequences you launch, and the replies you write or approve in the Oneprofile inbox, from your own address. It reads new messages that arrive in the mailbox to find replies from the people you email through Oneprofile, and bounce and out-of-office notices for your outreach emails. It shows them in your Oneprofile inbox, labels them, stops a contact’s follow-ups when they reply, and can draft an answer for you to review, or send it automatically if you turn that on. Oneprofile checks other new messages only to tell whether they belong to your outreach, then discards them without storing them. We do not import mail that arrived before you connected the mailbox, and we never change, label, or delete messages in your Gmail. Files you pick from Google Drive are imported into your Oneprofile workspace so the AI features can use them as context.

AI processing. To label replies and draft answers, we send the text of the relevant messages to Anthropic, which provides the AI models we use. Anthropic processes this data on our behalf and does not use it to train its models. We do not use Google user data, including data received from Google Workspace APIs, to develop, improve, or train generalized or non-personalized AI or machine learning models.

How we store and protect it. We store the access tokens Google issues for your account, the email address of each connected mailbox, the messages that belong to your outreach conversations (sender, recipients, subject, body, and attachments), and the content of Drive files you import. This data is stored with Google Cloud and PlanetScale. It is encrypted in transit with TLS and encrypted at rest, and only the systems that run the features above can access it.

Who can read it. Our staff do not read your email messages or Drive files unless you ask us to for specific messages (for example, when you contact support), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

How we share it. We do not sell Google user data or transfer it to advertising platforms, data brokers, or other third parties. We share it only with service providers that process it on our behalf to run the features above: Google Cloud and PlanetScale for hosting and storage, Anthropic for AI processing, and Clerk for sign-in. We may also disclose it to comply with applicable law, for security purposes, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.

How long we keep it and how to delete it. We keep this data while the related feature stays connected to your account. When you remove a mailbox from Oneprofile, we delete its access tokens and stop accessing it, and its conversations are removed from your account. Disconnecting Google Drive deletes its tokens and revokes our access at Google.

You can also remove Oneprofile’s access at any time on the Third-party connections page of your Google Account.

To have all Google user data we hold deleted, delete your account or contact us at support@getoneprofile.ai. We will delete it unless the law requires us to keep it.

Oneprofile’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

16. How do we handle AI apps you connect to Oneprofile?

In short: If you connect an AI app such as Claude, ChatGPT, Microsoft 365 Copilot or Cursor to Oneprofile, it works in your workspace as you, with the access you chose. What it sends us and what we send back to it are handled as described here.

You can connect AI apps to Oneprofile through our MCP server at api.getoneprofile.ai. When you connect one, you sign in with your Oneprofile account, pick one workspace, and choose read only or read and write. Making changes also needs a paid Oneprofile plan.

What we receive and keep. We keep a record of each connection: which app it is, who connected it, the workspace, the access chosen, and when it was last used. When the app calls one of our tools, we process what the call contains, such as search filters, table and column settings, rows from a file you ask it to import, and message drafts. We keep a log of each call (the tool, the connection and whether it worked) and a record of each change it made, with any credits it used, so that you and we can see what happened in your workspace. The data it creates or changes, such as tables, sequences and drafts, is stored in your workspace like anything you do yourself.

What we send to the app. A tool’s answer can contain information from your workspace, such as table rows, contact details, messages and replies. We send that answer only to the app you connected, over HTTPS. Once the app receives it, the app’s provider (for example Anthropic, OpenAI, Microsoft or Anysphere) processes it under its own terms and privacy policy, not this one. Please review them before you connect an app.

Credits. Some tool calls spend credits your workspace already holds, as the same actions do in Oneprofile. An AI app cannot buy credits or change your plan.

Disconnecting. You can disconnect an app at any time in Oneprofile under Settings > AI apps, or remove it in the app itself. A connection that goes unused for 30 days signs out on its own. When a connection is disconnected or signs out, its access ends at once, and we delete the connection record 30 days later. Records of past calls and changes are kept as described in section 7.

We do not sell data received through AI apps, use it for advertising, or use it to train generalized AI or machine learning models.