Privacy Policy

We use the information we collect to:

• Provide, operate, and maintain the Service
• Execute actions you request (send emails, publish posts, sync calendars, transcribe audio) using your connected accounts
• Authenticate you and keep your account secure
• Communicate with you about your account, updates, and support
• Monitor usage against plan limits and enforce them
• Improve and develop new features based on aggregate, anonymized usage patterns
• Improve Kit by reviewing conversations from accounts that have left sharing on (see “Kit Conversations” above) and the feedback you give on its answers
• Understand how people find OneKit (the referral source you tell us, and the link that brought you to the site)
• Comply with legal obligations
• Deliver signature requests, verify signing state, create the completed PDF, and preserve an audit trail

We do not sell your personal information to third parties. We do not use your email content, contact lists, or documents to train AI models without your explicit consent. This exception does not apply to Google user data: we do not use Google user data to train AI models.

The Service integrates with third-party platforms. When you connect them, their own privacy policies also apply:

• Supabase — database, authentication, and file storage
• Anthropic (Claude) — AI responses and content generation. Prompts you send are processed by Anthropic subject to their usage policies.
• OpenRouter and model providers — AI request routing and processing. OneKit's shared AI service sends prompts and relevant context through OpenRouter to the provider serving the selected model, including Claude models and the default DeepSeek Mail classifier. The serving provider depends on the model and available routing.
• Groq — voice transcription. When you use the Whisper dictation feature, your audio is sent to Groq's transcription API (Whisper Large v3 model) for processing. The resulting text is stored locally on your device; audio is not retained by OneKit after transcription. Groq's data usage policies apply to audio processed through their API. Meeting notes use a local transcription engine and are never sent to any external service.
• Google — Gmail inbox access, sending and mailbox organization; contact lookup and sender photos; and Calendar and booking features
• Resend — transactional delivery of signing notices and short-lived links used to retrieve completed signed documents
• X (Twitter), LinkedIn, Instagram, TikTok, YouTube — social media publishing

We only request the permissions these services require to perform the actions you explicitly instruct.

OneKit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, market research, or AI model training. Google user data is used only for the connected user-facing features described in this policy, including background synchronization and AI briefs that you enable.

We share your information only in the following circumstances:

• Service providers — vendors who help us operate the Service (e.g. Supabase for the database, Stripe for payments, Sentry for crash reports, Vercel for hosting and cookieless site analytics, Resend for email) under confidentiality obligations
• Business transfers — if AISquads LLC is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction
• Legal requirements — when required by law, court order, or to protect our legal rights or the safety of others
• With your consent — for any other purpose with your explicit permission
• Signature participants — the sender and designated recipients receive the document, signing status, and completed signed copy as needed to complete the transaction

We retain your data for as long as your account is active or as needed to provide the Service. When you disconnect a third-party service, the selected connection and its credentials are removed. Content and derived records already created through the Service may remain, and other active connections to the same account continue to operate as described above. If you delete your account, we will delete or anonymize all of your personal data within 30 days, except where we are required to retain it for legal, tax, or compliance purposes.

Signed documents and their audit evidence are retained while the sender's account remains active so the sender and designated recipients can access the completed record. A deletion request may be limited or delayed where retention is reasonably necessary to preserve transaction evidence, resolve a dispute, prevent fraud, or comply with law. We will explain any applicable exception when responding to a request.

We use industry-standard security measures including encryption in transit (TLS) and infrastructure-level encryption at rest provided by our hosting platform. OAuth tokens are encrypted and stored in access-controlled databases with row-level security policies. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security but we take reasonable steps to protect your information.

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know — request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete — request deletion of your personal information, subject to certain exceptions
• Right to Opt Out of Sale — we do not sell personal information
• Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights

To exercise your rights, contact us at support@onekit.co. We will respond within 45 days.

If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — request correction of inaccurate or incomplete personal data
• Right to Erasure — request deletion of your personal data, subject to certain legal exceptions
• Right to Restrict Processing — request that we limit how we use your data in certain circumstances
• Right to Data Portability — request your data in a structured, machine-readable format
• Right to Object — object to processing of your data based on legitimate interests, including for direct marketing purposes

Lawful basis: We process your personal data on the basis of contractual necessity (to provide the Service you signed up for) and legitimate interest (to improve and secure the Service). Where we rely on consent (such as for optional email tracking), you may withdraw consent at any time.

To exercise any of these rights, contact us at support@onekit.co. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

The Service is operated from the United States. If you access it from outside the US, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you would like to request deletion of all data OneKit has stored in connection with your account — including OAuth tokens, platform user IDs, and any content you created through the Service — please contact us at support@onekit.co. Include the email address or username associated with your account so we can locate your data. We will process your request and permanently delete all associated data within 30 days.

You can also disconnect any individual platform (Instagram, X, LinkedIn, TikTok, YouTube, Gmail) at any time from within the OneKit app, which removes that connection and its stored credentials. See the Google section and Data Retention for how other active connections, local caches, and previously created records are handled.

If you have questions about this Privacy Policy or want to exercise your rights, contact us at: