Privacy Policy

1. Who We Are

oneBot is a product of One Finance Limited, based at:

Person responsible for content: Simon Streiner — simon@onebots.ai

This Privacy Policy is incorporated into and forms part of our Terms of Service. By accessing or using oneBot, you acknowledge that you have read, understood, and agree to the data practices described in this policy.

Transparency is one of our core values. This policy explains exactly what data we collect, where it goes, and how it’s protected. No lawyer-speak, no hidden clauses.

2. What Data We Collect

We collect only what’s necessary to run your bot and keep the platform working:

• Account information — name, email address, and password when you register
• Bot data — messages you send to your bot, bot responses, memory, personality settings, skills configuration, and usage preferences
• Technical data — IP address, browser type, device information, and cookies for session management and analytics
• Payment data — processed securely by our payment provider. We never see or store your credit card number, bank details, or other payment credentials. We only see transaction amounts and billing status for accounting purposes.
• Communication data — messages you send us via email or the contact form

3. Lawful Basis for Processing

Under GDPR, we process your personal data on the following lawful grounds:

• Contractual necessity — to fulfil our obligations under our Terms of Service (e.g., running your bot, managing your account)
• Legitimate interests — for fraud prevention, platform security, and internal analytics to improve the service
• Legal obligation — where we are required by applicable law to retain or disclose data (e.g., financial records)
• Consent — for analytics cookies and any processing not covered by the above (you may withdraw consent at any time)

4. How We Use Your Data

Your data is used exclusively to:

• Provide, maintain, and improve the oneBot platform
• Run your bot — including sending your messages to AI models for processing
• Store your bot’s memory, personality, and configuration so it works consistently
• Process payments and manage your account
• Communicate with you about your account, updates, and support
• Monitor platform performance, detect abuse, and prevent fraud
• Comply with legal obligations

5. AI Models & How Your Data Flows

oneBot offers two modes for AI access:

• Managed mode (default) — oneBot routes your requests through OpenRouter, our AI routing layer, which connects your bot to a wide range of AI models from leading providers. When you interact with your bot, your messages are sent through OpenRouter to the AI model you’ve selected.
• Own API keys — You may optionally provide your own API keys for supported providers (e.g., OpenAI, Anthropic, Google, Mistral). In this case, your requests are sent directly to that provider’s API without routing through OpenRouter. The respective provider’s privacy policy and terms apply. One Finance Limited does not store or have access to your API keys beyond what is required for the service to function.

Here’s how each provider handles your data:

OpenRouter

OpenRouter acts as a relay between oneBot and AI model providers. They process your requests to route them to the correct model. By default, OpenRouter does not store your prompts or responses — only metadata such as timestamps, model used, and token counts are logged. OpenRouter does not train on your data. For details, see OpenRouter’s Privacy Policy.

Anthropic (Claude)

Anthropic does not use API inputs or outputs to train its models. As of September 2025, Claude API logs are retained for a default period of 7 days before being automatically deleted. If a session is flagged by Anthropic’s trust & safety systems as violating their usage policy, those logs may be retained for up to 2 years for abuse detection. See Anthropic’s Privacy Policy.

OpenAI (GPT-4o, o3, o1, etc.)

When accessed via API (which is how oneBot uses OpenAI models), OpenAI does not use your data to train or improve its models. Data may be retained for up to 30 days for abuse monitoring, after which it is deleted. Zero Data Retention (ZDR) is available to qualifying enterprise users. See OpenAI’s Privacy Policy.

Google (Gemini)

When used via API, Google does not use your Gemini API inputs or outputs to train its models. See Gemini API Terms.

Meta (LLaMA)

LLaMA models are open-source and may be hosted by various providers through OpenRouter. The hosting provider’s privacy policy applies. Meta does not receive your data when open-source models are hosted by third parties.

Mistral

Mistral does not use API data to train its models. API input and output data may be retained by Mistral for up to 30 days for abuse monitoring purposes, after which it is deleted. See Mistral’s Privacy Policy.

Other Models & Providers

As of February 2026, oneBot supports 100+ AI models available through OpenRouter, from providers including but not limited to: Anthropic, OpenAI, Google (Gemini), Meta (Llama), Mistral, Qwen (Alibaba), DeepSeek, MiniMax, NVIDIA, xAI (Grok), Cohere, Perplexity, Writer, Microsoft, and others. Each provider operates its own data handling practices. When using any model, your data is processed according to that provider’s terms. The model currently powering your bot is always visible in your settings.

Open-source models (e.g., Llama, DeepSeek, Qwen) may be hosted by third-party inference providers via OpenRouter. In this case, the hosting provider’s privacy practices apply, not those of the original model developer.

6. Where Your Data Is Stored & International Transfers

All oneBot platform data is stored on Hetzner servers located in the European Union (Germany and Finland), subject to EU data protection law.

• All data at rest is encrypted
• All data in transit is protected by TLS encryption
• We employ strict access controls — even our own team does not access your personal data or conversations unless explicitly required for technical support at your request

International transfers: When your bot uses AI models via OpenRouter or directly via your own API keys, your message content is transmitted to AI model providers. Some of these providers (e.g., OpenAI, Anthropic) are based outside the EU. These transfers are necessary to deliver the service and take place under the providers’ own standard contractual frameworks or adequacy decisions. When possible, EU-based routing is used. You can review each provider’s data transfer practices via their respective privacy policies.

7. Security & Data Breach Notification

We implement technically and organisationally appropriate measures to protect your personal data against accidental loss, alteration, disclosure, or unauthorised access.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information and Data Protection Commissioner (IDPC) of Malta within 72 hours of becoming aware of it, as required by GDPR Article 33. If the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

8. Data Sharing

We share data only with the following parties, and only to the extent necessary:

• OpenRouter — to route your bot’s requests to AI models
• AI model providers — to process your bot’s conversations (as described above)
• Payment processor — to handle billing securely
• Hetzner — as our hosting provider (encrypted data storage)
• Law enforcement — only when legally compelled by applicable law

We do not share data with advertisers, data brokers, or any other third parties.

9. Analytics & Statistics

We collect analytics data on how our website and platform are used. This helps us understand what works, what doesn’t, and where to improve.

What we track:

• Page views, click patterns, and navigation flows on the website
• Platform usage statistics (e.g., which features are used most, bot activity levels)
• Error rates and performance metrics
• Aggregated billing data (total revenue, subscription status) — never your payment details

Analytics data is used internally and is never shared with third parties for marketing or advertising purposes.

10. Cookies

We use cookies for:

• Essential cookies — session management, authentication, remembering your preferences. These are required for the platform to function.
• Analytics cookies — to understand how visitors use our website. These are only set after you explicitly consent via our cookie banner.

How consent works:

• When you first visit our site, no analytics cookies are set — analytics scripts are completely blocked until you click “Accept all”
• If you choose “Essential only”, no analytics data is collected and any existing analytics cookies are removed
• You can change your preference at any time by clearing your browser’s local storage for our site, or by contacting us at hello@onebots.ai

Disabling analytics cookies will not affect the functionality of the platform.

11. Data Retention

We retain your data for as long as your account is active and the services are being provided.

Upon account closure:

• Your data will be deleted within 90 days as part of our standard deletion cycle
• If you request expedited deletion, we will process it within 30 days of your explicit request
• Some data may be retained beyond these periods where required by law (e.g., financial records for tax compliance)

Bot conversation history and memory can be deleted at any time from your dashboard while your account is active.

12. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct any inaccurate data
• Erasure — request deletion of your data (“right to be forgotten”)
• Restriction — request limitation of processing
• Portability — receive your data in a structured, machine-readable format
• Objection — object to certain types of processing
• Withdraw consent — for processing based on consent (e.g., analytics cookies)
• Lodge a complaint — with the Information and Data Protection Commissioner (IDPC) of Malta, our supervisory authority, if you believe your data has been mishandled

To exercise any of these rights, contact us at hello@onebots.ai or simon@onebots.ai. We will respond within 30 days.

13. Children & Minimum Age

oneBot is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you are under 18, you may only use oneBot under the supervision of a parent or legal guardian who agrees to these terms on your behalf. If we become aware that we have collected personal data from a person under 18 without guardian consent, we will delete that data promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Notify registered users via email at least 14 days before the changes take effect
• Update the “Last updated” date at the top of this page
• Clearly summarise what has changed in the notification

Continued use of the platform after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data in accordance with Section 11.

15. Contact & Supervisory Authority

For any questions or concerns regarding your privacy: