Privacy Policy

What you give us

When you create an account or use OnePush, you may give us:

• Name, email address, and company details
• Payment details (handled by Stripe — we do not store full card numbers)
• Email content, contact lists, form submissions, and social posts you create
• Preferences such as notification settings

What we collect automatically

When you use the product or website, we typically collect:

• Log data (IP address, browser, device)
• How you use the product (features opened, basic usage signals)
• Delivery stats for messages you send (for example opens or bounces, when tracking is on)
• Cookies and similar tech — see the cookies section below

We use this information to:

• Run OnePush for you (accounts, sending, forms, social, billing)
• Charge your plan and keep your account working
• Send service emails (billing, security, product notices)
• Fix bugs, improve reliability, and understand what is breaking
• Spot abuse and fraud
• Meet legal duties (for example tax records)

We do not sell your personal data. We share it only when we need to:

• With processors that help us run the product (hosting, Stripe for payments)
• With delivery or social networks when you send or publish through them
• With authorities if the law requires it
• With others if you ask us to, or clearly agree

We use standard protections for a hosted SaaS product, including:

• Encryption in transit (HTTPS) and encryption at rest where we store data
• Access controls so only people who need access can reach production systems
• Backups and monitoring
• Staff access limited to what the job requires

No system is perfect. If something serious goes wrong, we follow the breach process below.

If GDPR applies to you, you can ask us to:

• Access — get a copy of personal data we hold about you
• Rectify — fix data that is wrong or incomplete
• Erase — delete data where the law allows ("right to be forgotten")
• Restrict — limit how we process your data in some cases
• Port — receive data in a common machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — where we rely on consent, you can pull it back anytime

Email privacy@onepush.app. We aim to reply within 30 days.

You can also complain to your local data protection authority if you think we got something wrong.

We use cookies for a few jobs:

Essential (needed for the site to work):

• Sign-in / session
• Security
• Basic load balancing

Analytics (only if you allow them):

• Rough usage stats so we know what to fix

Third party:

• We may load fonts from Google Fonts. Google can set cookies. See Google's privacy policy for that part.

You can clear or block cookies in your browser. Blocking essential cookies can break login.

Session cookies clear when you close the browser. Persistent ones can last up to about 12 months unless you delete them sooner.

We keep data only as long as we need it for the product, billing, or the law. In practice:

• Account data: while your account is open, then up to 7 years where tax or legal rules require it
• Personal email tracking data: about 30 days after delivery
• Email delivery logs: about 90 days (for debugging)
• Marketing emails from us: until you unsubscribe or ask us to delete
• Payment records: up to 7 years where required

After that we delete or anonymise what we can.

We aim to keep OnePush data in the EU / EEA.

If we ever need to send personal data outside the EEA, we use a lawful tool for that — for example Standard Contractual Clauses or an adequacy decision — not a free-for-all transfer.

Under GDPR we process personal data on these grounds:

• Contract — to provide the service you signed up for
• Legitimate interests — security, fraud prevention, and improving the product in ways that do not override your rights
• Consent — for optional tracking or marketing, where we ask
• Legal obligation — for example keeping invoices

Where we use consent, you can withdraw it. Use unsubscribe links or email privacy@onepush.app.

If a personal data breach risks people's rights, we will:

• Tell the relevant authority within 72 hours where the law requires it
• Tell affected people without undue delay when the risk is high
• Explain what happened, what it might mean, and what we are doing about it

Examples of processors:

• Stripe — payments (DPA in place)
• EU / EEA hosting providers — servers and storage (DPAs in place)
• Channels you connect — for example social networks you link for publishing

We only use processors under agreements that meet GDPR Article 28 expectations.

OnePush is not for people under 16. We do not knowingly collect their data.

If you are a parent and think a child signed up, email privacy@onepush.app and we will remove the account data we can find.

We may update this page when the product or the law changes. When we do, we will:

• Put the new effective date on this page
• Email you if the change is material

If you keep using OnePush after a material change, that means you accept the updated policy. If you do not, close your account.