This policy covers the personal data OneActor controls. The data in customers' projects and apps is covered by the Data Processing Agreement instead.
1. Who is responsible
The controller of the personal data described here is ONE ACTOR- SOFTWARE DEVELOPMENT, UNIPESSOAL LDA., Rua dos Barreiros, n.º 26 A, 9060-397 Funchal, Portugal, NIPC 519278267 ("OneActor", "we"). Privacy questions and requests: privacy@oneactor.com, or by post to the address above. We have not appointed a data protection officer; the law does not require one for our activity (GDPR Art. 37; Lei n.º 58/2019 Art. 13).
2. Two different roles
- We decide how your account, billing, sign-in, support and our website data are used. This policy covers that.
- You decide about the personal data inside your projects and the apps you build — your users' data, data in your code and in conversations with the agents. For that data we act on your behalf, under the Data Processing Agreement, and your own privacy notice informs your users.
3. What we collect, why, on what basis, and for how long
| What | Why | Legal basis (GDPR Art. 6(1)) | How long |
|---|---|---|---|
| Website visits: IP address, page, time, browser user-agent, referrer, in our CDN's access logs | Deliver the site, keep it secure, count visits in aggregate | Legitimate interest (f) in running a secure site | 30 days, then only aggregate counts without IP addresses |
| Account: email, name (optional), password (stored only as a bcrypt hash; none if you sign in only with Google), when you confirmed your email address, the version of the Terms you accepted and when, language and theme, organizations and roles | Provide your account and the Service | Contract (b) | While the account exists; then deleted within 30 days, except what the next rows require |
| Invitations: the email address of the person invited | Send the invitation and let them join | Legitimate interest (f) of the inviting organization and ours in providing the feature | Until accepted, revoked or expired, then deleted within 30 days |
| Sign-in and security: sessions (7 days, or 30 with "remember me"), password-reset records (1 hour), email-confirmation links (24 hours), the one-minute codes that finish a sign-in with Google, request counts per address and per client, organization audit log | Keep your account secure, stop abuse | Contract (b) and legitimate interest (f) in security | As stated; the organization audit log 2 years |
Signing in with Google, if you choose it: the identifier Google gives your Google account, the email address and name Google shares, that Google has verified that address, and when you last signed in to Google (asked only when you confirm a deletion with Google). We ask Google only for these (the openid, email and profile scopes) and never receive your Google password, contacts or other data, nor keep a Google access token | Sign you in with Google, connect it to your account, and confirm that it is you | Contract (b) | While Google stays connected to your account; a sign-in with Google that is not finished is deleted after 10 minutes at most |
| Billing: plan, subscription status, credit purchases and grants, usage records per project, the payment events the Merchant of Record sends us (which can contain your name, email address, phone number, billing address, tax identification number, payment information, and the order's date and price) | Charge for the Service, keep accounts | Contract (b); legal obligation (c) to keep accounting records | Usage details in our database for 90 days after they are settled, then in our billing archive for 2 years; accounting records 10 years (Código do IRC Art. 123(4)); the Merchant of Record's payment events 12 months, then only what the accounting records need |
| Project setup: the idea, answers and details you give in the project wizard, and the documents you attach | Create your project and its first plan | Contract (b) | With the project |
| AI requests: what the agents send to AI model providers, which can include your messages and code | Run the agents | Contract (b) | At the providers: see section 5. At our gateway: not kept |
| Service emails: messages we send you about your account, projects, deploys and billing | Operate the Service | Contract (b) | We keep no copy of the messages |
| Support: your messages and our answers | Help you | Contract (b) / legitimate interest (f) | 2 years after the conversation ends |
| Content reports and legal requests: the notifier's name and email, the report | Handle notices under the Digital Services Act and legal requests | Legal obligation (c) | 3 years |
The early-access list
Until OneActor opens, anyone can ask on this website to be told when it does. For that list:
| What we keep | The email address you give, the language of the page you used, the version of the consent text you agreed to, and the date and time of your request |
|---|---|
| Why | To write to you when OneActor opens. We use the list for nothing else: no newsletter, no marketing, no profile |
| Legal basis | Your consent (GDPR Art. 6(1)(a)), which you give by ticking the box on the form |
| Where | Amazon Web Services, our processor, in its Frankfurt region (eu-central-1) |
| How long | Until we have written to you that OneActor is open, then deleted within 30 days, whether or not you create an account. If OneActor has not opened 12 months after your request, we delete it then. The copies kept to recover from a failure are gone 35 days after a deletion |
| Withdrawing | At any time, without giving a reason: write to privacy@oneactor.com from the address on the list, and we delete it. Withdrawing does not affect what was done before |
To keep the form from being misused, we also count the requests sent from each network address for one hour. For that we keep a keyed hash of the address, never the address itself, and it is deleted automatically within a few days after that hour; the legal basis is our legitimate interest (f) in keeping the form working. Giving your email address is voluntary: without it we cannot tell you when OneActor opens. Your rights are in section 6.
We do not sell personal data, show advertising, build marketing profiles, or use analytics or tracking tools on our website or dashboard. We do not send marketing email.
Automated decisions. Some things happen automatically because of your balance or usage — for example work stops when your credit balance runs out, and a billing hold follows fixed steps. These follow the contract and are described in the Terms; you can always contact us about them.
4. Who receives your data
We use service providers (processors) to run OneActor. The current list, with what each does and where, is on our sub-processor page. In short:
- Amazon Web Services hosts the platform in the EU (Frankfurt) and sends our emails.
- AI model providers process what the agents send them (section 5).
- Link (Sold through Link, LLC, an affiliate of Stripe, United States), our Merchant of Record, sells you plans and credits and takes your payment on a checkout page hosted by Stripe. It receives your payment details directly, not from us. Under Link's terms, Stripe and we are independent controllers of the personal data collected for the purchase: Link processes it under its own privacy policy and may transfer it to countries other than yours, including the United States. Link may share with us the order data its terms name, which we use to credit your account and keep our accounts: your name, email address and phone number, billing address, payment information, tax identification number, and the order's date and price.
When you sign in with Google, your browser goes to Google, which signs you in under its own terms and privacy policy (for people in the EU, through Google Ireland Limited) and so knows that you use OneActor. Google is not our processor: it sends us what section 3 lists, and we send it nothing about you.
We share data with authorities only when the law requires it, and we check that a request is lawful.
5. AI model providers and transfers outside the EU
The agents use AI models run by other companies. When an agent works, the content it is working on is sent to the provider serving that model at that moment: OpenAI (through OpenAI Ireland Ltd) and Makora, which process in the United States, and Amazon Web Services EMEA SARL through Amazon Bedrock, which processes in the EU. For the US providers we rely on the European Commission's standard contractual clauses, with a transfer impact assessment. Each provider's location, safeguard and data retention are on the sub-processor page, and you can ask us for a copy of the safeguards.
We do not send data to providers or endpoints in China. Models developed in China are used only when run by a provider outside China.
Some of our other providers are part of US groups (for example AWS); they are covered by the same safeguards.
6. Your rights
You have the right to access your data, have it corrected, deleted or restricted, to object to processing based on legitimate interests, to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. You can take a copy of your data and delete your account yourself, in the dashboard's Settings (below). For anything else, or if you prefer, write to privacy@oneactor.com; we answer within one month (extendable by two months for complex requests, with notice).
You can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the authority where you live or work.
A copy of your data. In Settings → Your data, the owner of a workspace asks for an export of it: your account, the organization, its billing records, and each project's code with its full history, documents, databases, stored files and variable names. We email you when it is ready, and you download it from Settings for 30 days. What it holds, and in which formats: Where your data is processed.
Deleting your account. In Settings → Delete account (Leave or delete when you also belong to a team someone else owns, which you can leave there instead). You confirm with your email address and password, or, if you sign in only with Google, by signing in to Google again, and the account is deleted at once: you are signed out everywhere, a plan is cancelled, and the projects of the workspaces you own are taken offline, then deleted for good 10 days later. What section 3 says we must keep stays, without your name, email address or account. You can also write to privacy@oneactor.com from the account's email address.
7. Security
We protect personal data with measures appropriate to the risk: encryption of stored keys with per-project keys, separation of each project's workspace and database, hashed passwords, email addresses confirmed with a single-use link, single-use reset links, and restricted access for our staff. The measures are described in Annex 2 of the DPA. If a breach is likely to put your rights at high risk, we tell you without undue delay.
8. Children
OneActor is not intended for anyone under 18. We do not knowingly collect their data.
9. Changes
We update this policy when our processing changes, and tell account holders by email about important changes before they apply. Previous versions stay available.