Privacy policy
Last updated: 2026-09-24
This policy explains what personal data Onerift collects, why, and what rights you have. Part 1 covers this website. Part 2 covers the Onerift product.
Who we are
[legal name], [legal form], [registered address], registered at the RCS of [RCS city] under [RCS number], is the controller of the data this policy describes, except where Part 2 says we act as a processor. Contact: [privacy email].
Part 1 — This website
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, work email, company, message, from the contact form | To answer your request and arrange a demo | Steps before a contract, at your request (GDPR Art. 6(1)(b)) | 24 months after our last exchange |
| Pages viewed, device and approximate location, through Google Analytics | To see which parts of this site help | Your consent (Art. 6(1)(a)), given on the banner | 14 months after your last visit |
We do not use the contact form to send you marketing email. Without your consent, Google Analytics does not load.
Part 2 — The Onerift product
Where we are the controller
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account: name, email, organisation, role | To give you access and secure your account | Contract (Art. 6(1)(b)) | While the account exists, then 30 days |
| Sign-up and sign-in codes sent by email | To verify your email address | Contract (Art. 6(1)(b)) | Resend's log period |
| Conversations: your questions and the answers | To show you your history and continue a conversation | Contract (Art. 6(1)(b)) | Until you delete them, or until your membership or your organisation is removed |
Where we are a processor
When you connect an app, the agent reads and writes data in that app when you ask it to. For that business data, your organisation is the controller and we process it on its instructions, under the data processing terms in our Terms. Your app data stays in your apps; the agent reads it when you ask.
Your credentials
You enter an app's password or API key in a secure connection screen. The connection service we run stores it encrypted. No person on our team receives, reads or types it.
The AI model
The agent's answers come from a third-party AI model. On the trial, we send your question and the data the agent read to OpenRouter, under our own account. When your organisation adds its own model provider key, the question goes to the provider your organisation chose, under your organisation's own contract with it. Answers are generated by AI and can be wrong. The agent makes no decision that has a legal or similarly significant effect on you (Art. 22); before it changes data in an app, it asks you to confirm.
Who receives data
| Recipient | Role | What | Where |
|---|---|---|---|
| Resend, Inc. | Email delivery | Your email address and the email we send | United States |
| Google Ireland Limited | Website analytics, only with consent | Analytics data from this site | EU, with transfers to the United States |
| Vercel Inc. | Hosting of this website | Request data, including your IP address | United States and the EU |
| ElevenLabs, Inc. | Voice generation for the presentation video | The narration text, which holds no personal data | United States |
| OpenRouter | AI model on the trial | Your question and the data the agent read | [trial provider region] |
| [product host] | Hosting of the product | All product data in Part 2 | [product host region] |
This list is also the list of sub-processors in our data processing terms. We announce a change 30 days ahead.
Transfers outside the EU. Where a recipient is outside the European Economic Area, the transfer relies on the recipient's certification under the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses (Art. 45–46).
Your rights
You can ask us for access to your data, its correction, its deletion, a restriction of its use, or a copy in a portable format, and you can object to its use (Art. 15–21). Where we rely on your consent, you can withdraw it at any time, with no effect on what happened before: for analytics, use Cookie settings in the footer. Write to [privacy email]; we answer within one month.
You can complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or to the authority of your EU country.
We need your account data to provide the product; without it, you cannot use it (Art. 13(2)(e)).
This page is translated from the French version. The French version prevails.