Privacy Policy

Who handles your information

This policy covers the Onepard website, owner accounts, hosted business chats and website widgets. Contact Onepard at support@onepard.com about privacy questions or requests.

Onepard handles account, billing administration and security information for its own service purposes. When a business uses Onepard to handle customer conversations and enquiries, that business decides the purpose and is generally the data controller; Onepard processes that information on its behalf. The business’s privacy notice also applies. Contact that business first about its use of your conversation or enquiry. We can help direct a request and assist the business where appropriate.

Account and business information

We receive your sign-in email and account identifier. If you choose Google sign-in, we receive basic account information such as your name, email and profile picture, not access to your Gmail inbox. We store business details you provide or ask us to read, including public website addresses, text, logo and image references, offerings, settings and update history. Information you paste may also contain personal information, so only provide material you are authorised to share. Logos you upload for display in your chat are stored as public images.

We keep plan, usage and payment references needed to administer your businesses. Polar handles checkout and payment details as merchant of record under its own privacy policy. Onepard does not receive or store your full payment-card number or security code through Polar checkout.

Chats, page context and enquiries

Chats do not require a visitor account. We store messages, AI replies, relevant page context and timestamps so a conversation can continue. Conversation history is available in the business’s dashboard. To generate an answer, relevant business information, your message, recent conversation and any relevant enquiry details are processed by our AI provider. Do not include passwords, payment-card details, identity documents, health records or other sensitive information in a chat.

On a website using our widget, page-aware replies may use the public page address, title, selected or visible public text, and product or image references. We limit what is collected, avoid known private pages and exclude private and form contents apart from public product-option identifiers. Website owners must still ensure the widget is used only on suitable pages. These safeguards cannot guarantee that public page text never contains personal information.

If you submit an enquiry, your name, email or phone number, request, related page or item, and submission time are saved for the business. The enquiry view shows your request and the conversation up to the point you sent it. We email your contact details and request to the business’s chosen enquiry address. The email includes a link that only the business owner can open to view the conversation. The business may retain and use the information under its own policy.

Browser storage and technical information

We use sign-in cookies and browser storage to keep accounts signed in, preserve setup or form drafts, and remember a chat on the same browser. A chat uses a signed conversation reference stored in your browser, including on a business’s website when the widget is installed. That reference can expire without deleting the saved conversation. Clearing browser storage does not delete server records.

The widget can report a public page address and a short code generated from public information to help detect website changes, even before the chat is opened. These alerts do not send the full page text. We use browser storage to limit repeated alerts. Our service and infrastructure can process IP addresses, request details, errors, usage and timing information for operation, security and abuse prevention. We may store IP addresses in records used to limit excessive requests.

We use Vercel Web Analytics to count visits and see which public Onepard pages are used. It does not set analytics cookies. If you allow Google Analytics, Google uses cookies to help us understand visits to those pages. You can change your choice in Analytics settings in the footer. These tools are for website measurement and do not collect chat messages, enquiry details or form entries. A business’s own website may use other cookies covered by its policy.

You can manage storage in your browser. Disabling it can affect sign-in, drafts and conversation recovery.

We use Cloudflare Turnstile, when enabled, to check for automated abuse during sign-in. Cloudflare processes browser and network signals for that check. See the Cloudflare Turnstile Privacy Addendum.

Why information is used

We use information to provide accounts and business chats, read and update authorised website information, answer questions, deliver enquiries and service emails, administer plans, prevent abuse, support users and meet legal obligations. Where data-protection law requires a legal basis for our own processing, we rely on performing our agreement, legitimate interests in operating and protecting the service, legal obligations, or consent where required. Businesses are responsible for the appropriate basis for their customer processing.

Service providers and other recipients

Vercel hosts Onepard, and Fly.io runs our public website reader. Supabase handles sign-in and stores data. We use OpenAI for answers, content preparation and matching questions to business information, and Resend for sign-in and enquiry emails. Google is involved if you choose Google sign-in or allow Google Analytics. Polar handles purchases under its own terms and privacy policy. We share only the information each provider needs for its role.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use customer conversations to train our own AI models. OpenAI’s API does not use submitted content for model training by default. We turn off conversation storage in the OpenAI API. OpenAI’s abuse-monitoring and other retention rules can still apply. See OpenAI’s data controls.

Business photos and logos can load from their original website or image host, which receives the resulting network request. Opening external links takes you to a website with its own privacy practices. We may disclose information when legally required, to address fraud or security threats, or in a business transfer subject to applicable protections and notices.

Storage, retention and international processing

Information is retained to provide the service and maintain business records, respond to customer instructions and requests, prevent abuse, resolve disputes and meet legal obligations. The appropriate period depends on the type of information, whether the account or business still needs it, and applicable legal requirements. We have not set an automatic deletion period for all chats, enquiries or imported website records. Cancelling a plan does not automatically erase those records.

Owners can delete pasted information from Business information. This removes it from active answers; it does not erase past conversations, emails already delivered or every retained record. Contact us for broader removal or account-closure requests. Some records may need to remain for legal, billing or security reasons. Provider backups and retention may follow separate lifecycles.

Our providers may process information in countries other than your own, including the United States. A database location alone does not mean all processing stays in that location. Transfer safeguards and processor arrangements required for a business’s use must be confirmed before that processing begins; contact us about those requirements. We do not promise a particular residency arrangement or certification that has not been agreed and verified.

Your choices and rights

Depending on applicable law, you may have rights to access, correct, receive a copy of, delete or restrict the use of personal information, object to certain processing, withdraw consent where it is the basis, or complain to a data-protection authority. Email support@onepard.com with your request. We may need to verify your identity and, for business-controlled chat data, work with that business. Please do not email passwords or identity documents unless we have agreed a suitable way to verify the request.

Contact support to request account deletion or a copy of your chats. Applicable legal deadlines and exceptions continue to apply. Onepard is not directed at children. If you believe a child has provided personal information without required permission, contact us and the relevant business.

Security and policy changes

We use access controls to limit who can see each business’s information. No online service can guarantee absolute security. Report a suspected privacy or security issue to support@onepard.com. We will update the date on this policy when it changes and provide further notice of material changes where required. This notice explains processing; it does not ask you to waive your privacy rights.