Privacy Policy

1What We Collect

Account data: Name, email, phone, company name, role during registration. Usage data: Pages visited, features used, automation runs, API calls — for product improvement only. Business data: Leads, contacts, invoices, tasks, approvals, and other data you input into your workspace. Device data: Browser type, operating system, IP address, and session identifiers for security and analytics.

2How We Use It

• Provide, maintain, and improve the Platform
• Process payments and send transactional notifications
• Send SLA alerts, approval requests, and automation notifications
• Generate anonymized, aggregated analytics for product improvement
• Prevent fraud, abuse, and security threats

We never sell your data. We do not use your data for advertising or profiling.

3Data Storage & Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Backups are taken daily and retained for 30 days. Access to production systems requires multi-factor authentication. For full details, see our Security page.

4Multi-Tenant Isolation

Every workspace operates as a fully isolated tenant. All database queries are scoped by tenant_id at the application layer. Your data is never accessible to other tenants. Sessions, file uploads, API keys, and automation rules are all tenant-scoped.

5Third-Party Services

We integrate with trusted providers who process only the data necessary for their function:

• Razorpay — Payment processing (PCI-DSS certified)
• Meta WhatsApp Business API — Optional messaging channel
• Meta Graph API — Optional social media publishing (Facebook, Instagram)
• LinkedIn API — Optional social media publishing
• Cloudinary — Media storage (SOC 2 certified)
• Resend — Transactional email delivery
• Google Gemini / OpenAI — AI content generation (opt-in, no data stored by providers)

6Social Platform Logins & Data

When you connect Facebook, Instagram, or LinkedIn accounts to OONH, we access only the permissions you explicitly grant. We use this data solely to publish content you create and schedule within the Platform. We do not access your personal social media profiles, friend lists, or private messages. You may disconnect social accounts at any time from Settings, which immediately revokes our access.

7Cookies

We use essential cookies for authentication and session management. We use analytics cookies (opt-out available) to understand product usage. We do not use advertising, tracking, or cross-site cookies. See our Cookie Policy for details.

8Your Rights

Under GDPR and applicable privacy laws, you have the right to:

• Access — Export all your data via dashboard or API
• Correct — Edit any inaccurate personal information
• Delete — Request complete account and data deletion
• Restrict — Limit how we process your data
• Portability — Receive your data in JSON/CSV format
• Object — Opt out of non-essential data processing

Exercise these rights by emailing [email protected]. We respond within 30 days. See our GDPR Compliance page for details.

9Data Retention

Active account data is retained during your subscription. After termination: 30-day recovery period, then permanent deletion. Billing records are retained for 7 years per Indian tax law (Income Tax Act, 1961). Anonymized analytics data may be retained indefinitely.

10Updates & Contact

We may update this policy with 30 days notice via email. For questions: [email protected] or our contact page.