Privacy policy

Last updated: October 20, 2026

1. Who We Are

oneBot is operated by One Labs Bot Technologies Limited, located at:

One Labs Bot Technologies Limited

Company number (CRO): 817724

Unit 2, 2 Bridge Street

Athlone, Co. Westmeath, N37 F1W4, Ireland

One Labs Bot Technologies Limited is the controller of your personal data under the General Data Protection Regulation (GDPR). For data protection questions, write to support@onebuddy.app.

This Privacy Policy is incorporated into and forms part of our Terms of Service. This policy explains how we process your personal data when you visit our website or use oneBot.

Transparency is one of our core values. This policy explains exactly what data we collect, where it goes, and how it’s protected. No lawyer-speak, no hidden clauses.

2. What Data We Collect

We collect only what’s necessary to run your bot and keep the platform working:

Account information — name, email address, and password when you register
Bot data — messages you send to your bot, bot responses, memory, personality settings, skills configuration, and usage preferences
Technical data — IP address, browser type, device information, and cookies for session management and analytics
Payment data — processed securely by Stripe (our payment processor). One Labs Bot Technologies Limited is the contracting party; Foxx – Verein zur Förderung einer zukunftsorientierten Lebenskultur acts as seller of record for payments processed via Stripe. We never see or store your credit card number, bank details, or other payment credentials. We only see transaction amounts and billing status for accounting purposes.
Communication data — messages you send us via email or the contact form
Website chat — if you use the chat on our website, your messages and the name and e-mail address you give us
Advertising measurement data — only if you consent to marketing cookies; see section 9a

Special categories of data (GDPR Article 9): We do not collect or process special categories of personal data as defined in GDPR Article 9, such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. Our service is a general-purpose AI chatbot and does not offer health, medical, biometric, or financial advisory features. If you choose to share such information in conversations with your bot, we strongly advise against it. We do not systematically process, analyse, or categorise such data, and it is not used for any purpose beyond the transient operation of the chat.

3. Lawful Basis for Processing

Under GDPR, we process your personal data on the following lawful grounds:

Contractual necessity — to fulfil our obligations under our Terms of Service (e.g., running your bot, managing your account)
Legitimate interests — for fraud prevention, platform security, and internal analytics to improve the service
Legal obligation — where we are required by applicable law to retain or disclose data (e.g., financial records)
Consent — for statistics and marketing cookies, the Meta Pixel and the Meta Conversions API (sections 9a and 11), and for any processing not covered above. You may withdraw consent at any time through “Cookie Settings”.

4. How We Use Your Data

Your data is used exclusively to:

Provide, maintain, and improve the oneBot platform
Run your bot — including sending your messages to AI models for processing
Store your bot’s memory, personality, and configuration so it works consistently
Process payments and manage your account
Communicate with you about your account, updates, and support
Monitor platform performance, detect abuse, and prevent fraud
Comply with legal obligations

We never sell, rent or trade your data. We do not use your conversations, bot data or Google data for advertising or profiling. If you consent to marketing cookies, we use the Meta Pixel and the Conversions API to measure our own advertising (section 9a).

5. AI Models & How Your Data Flows

When you create a bot, an EU-hosted model from Lyceum is preselected. In the bot’s advanced settings you can choose another model instead – from Lyceum, or from a wide range of providers via OpenRouter:

Lyceum (EU) — EU-hosted AI models. Your bot’s conversations are processed within the European Union.
OpenRouter — our AI routing layer to a wide range of models from leading providers. Your messages are sent through OpenRouter to the model provider you’ve selected.
Own API keys — You may optionally provide your own API keys for supported providers (e.g., OpenAI, Anthropic, Google, Mistral). In this case, your requests are sent directly to that provider’s API. The respective provider’s privacy policy and terms apply. We do not store or have access to your API keys beyond what is required for the service to function.

Outside strict GDPR mode, some requests can reach OpenRouter even if your bot runs a Lyceum model: image analysis, background summaries, and skills that make their own AI call.

Strict GDPR mode (opt-in, per bot) offers a fully GDPR-ready path. It allows only EU-hosted Lyceum models for all AI processing, including images and summaries. It also allows only skills and channels classified as GDPR-safe; switching it on removes all others. Web search then uses Brave Search, which receives the search query itself (not your conversation). Brave Software, Inc. is certified under the EU-US Data Privacy Framework.

Skills and channels you install (for example Google services, voice or image generation, WhatsApp or Telegram) connect to their own third-party providers, which are shown with each skill before you install it. See our Sub-Processors page for the pre-installed ones. They are all classified as GDPR-safe and stay available in strict GDPR mode; any other skill you install yourself.

Here’s how each provider handles your data:

Lyceum

Lyceum Technology Germany GmbH (Berlin, Germany) hosts AI models in the European Union. Your bot’s conversations are processed there to generate responses, according to Lyceum’s data processing terms.

OpenRouter

OpenRouter acts as a relay between oneBot and AI model providers. They process your requests to route them to the correct model. By default, OpenRouter does not store your prompts or responses — only metadata such as timestamps, model used, and token counts are logged. OpenRouter does not train on your data. For details, see OpenRouter’s Privacy Policy.

The following providers are reached through OpenRouter (or directly with your own API key) when you select one of their models:

Anthropic (Claude)

Anthropic does not use API inputs or outputs to train its models. As of September 2025, Claude API logs are retained for a default period of 7 days before being automatically deleted. If a session is flagged by Anthropic’s trust & safety systems as violating their usage policy, those logs may be retained for up to 2 years for abuse detection. See Anthropic’s Privacy Policy.

OpenAI (GPT-4o, o3, o1, etc.)

When accessed via API (which is how oneBot uses OpenAI models), OpenAI does not use your data to train or improve its models. Data may be retained for up to 30 days for abuse monitoring, after which it is deleted. Zero Data Retention (ZDR) is available to qualifying enterprise users. See OpenAI’s Privacy Policy.

Google (Gemini)

When used via API, Google does not use your Gemini API inputs or outputs to train its models. See Gemini API Terms.

Meta (LLaMA)

LLaMA models are open-source and may be hosted by various providers through OpenRouter. The hosting provider’s privacy policy applies. Meta does not receive your data when open-source models are hosted by third parties.

Mistral

Mistral does not use API data to train its models. API input and output data may be retained by Mistral for up to 30 days for abuse monitoring purposes, after which it is deleted. See Mistral’s Privacy Policy.

Other Models & Providers

As of February 2026, oneBot supports 100+ AI models available through OpenRouter, from providers including but not limited to: Anthropic, OpenAI, Google (Gemini), Meta (Llama), Mistral, Qwen (Alibaba), DeepSeek, MiniMax, NVIDIA, xAI (Grok), Cohere, Perplexity, Writer, Microsoft, and others. Each provider operates its own data handling practices. When using any model, your data is processed according to that provider’s terms. The model currently powering your bot is always visible in your settings.

Open-source models (e.g., Llama, DeepSeek, Qwen) may be hosted by third-party inference providers via OpenRouter. In this case, the hosting provider’s privacy practices apply, not those of the original model developer.

No major provider trains on your data when accessed via API. This is a requirement we prioritise when selecting our infrastructure. We will always inform you if this changes for any provider.

6. Google User Data

When you connect your Google account to oneBot, your bot gains access to certain Google services on your behalf. This section explains exactly what data is accessed, how it is used, and how it is protected.

6.1 What Google Data We Access

oneBot may request access to the following Google services, depending on the features you enable:

Google Calendar — read and write access to your calendar events. Data is retrieved live via the Google Calendar API and is not stored on our servers.
Google Tasks — read and write access to your task lists. Data is retrieved live via the Google Tasks API and is not stored on our servers.
Google Contacts — read and write access to your contacts. Data is retrieved live via the Google People API and is not stored on our servers.
Google Drive — access to files you specifically select or reference (drive.file scope — user-selected files only). File contents are not stored on our servers.
Google Docs, Sheets, Slides & Forms — read and write access to specific documents you reference in your bot interactions. Document contents are not stored on our servers.
YouTube — read-only access via the YouTube Data API v3. Data is not stored on our servers.

You choose which Google services to connect. You can disconnect any service at any time from your dashboard.

6.2 How We Use Google Data

Google data is used exclusively to provide the bot features you request. Here is how it works:

Your bot retrieves data from the relevant Google API in real time
The retrieved data is sent to your selected AI model to generate a response (see Section 5 for how AI models handle data)
The AI model does not retain Google data beyond the current session
Google data is retrieved live each time — it is not copied to or stored on our servers

Bot memory: In some cases, your bot’s AI may selectively store small pieces of derived information from Google data in its long-term memory (for example, remembering a birthday from your contacts to send you a reminder). This is not automatic — it only happens when the AI determines it is useful for your requested features. You can view and delete all bot memory entries at any time from your dashboard.

6.3 Google User Data — Limited Use Disclosure

oneBot’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
We do not sell, lease, or trade Google user data to third parties. We do not allow humans to read Google user data, except:
- with the user’s affirmative agreement (e.g., for technical support you request),
- as necessary for security purposes (e.g., investigating abuse),
- to comply with applicable law.
We do not use Google user data to determine creditworthiness or for lending purposes.
We do not use Google user data to train, improve, or develop any artificial intelligence or machine learning model, whether our own or any third party’s.

6.4 OAuth Tokens & Security

When you connect your Google account, we securely store the OAuth tokens required to access your Google services:

OAuth tokens are stored in our PostgreSQL database (bots table), protected by strict database access controls and network isolation — the database is not publicly accessible
Tokens are encrypted with AES-256-GCM using a per-bot encryption key when transmitted to the bot runtime
Tokens are only decrypted in memory at runtime — refresh tokens never leave the server in plaintext
Access tokens are short-lived and automatically refreshed as needed

6.5 Revoking Google Access & Data Deletion

You can disconnect your Google account from oneBot at any time:

From your dashboard: Disconnect any Google service with one click. OAuth tokens are immediately invalidated and permanently deleted from our database.
From Google: You can also revoke oneBot’s access at any time via myaccount.google.com/permissions.

Since Google data is retrieved live and not stored, there is no stored Google data to delete upon disconnection. If your bot’s memory contains derived information from Google data (e.g., a remembered birthday), you can delete those memory entries manually from your dashboard at any time, or they will be deleted automatically upon account closure.

YouTube data: Any YouTube-derived data in your bot’s memory will be deleted within 30 days of revoking YouTube access, or immediately upon request.

6.6 YouTube-Specific Disclosures

oneBot uses the YouTube Data API v3 to provide YouTube-related features. By using these features, you also agree to be bound by the YouTube Terms of Service.

YouTube API usage is also subject to the Google Privacy Policy.

You can revoke oneBot’s access to your YouTube data at any time via the Google security settings page.

7. Where Your Data Is Stored & International Transfers

All oneBot platform data is stored on Hetzner servers in Nuremberg, Germany (European Union), subject to EU data protection law.

All data at rest is encrypted
All data in transit is protected by TLS encryption
We employ strict access controls — even our own team does not access your personal data or conversations unless explicitly required for technical support at your request

International transfers: Whether your data leaves the EU depends on the choices you make for your bot. With a Lyceum model, AI processing takes place in the EU. When your bot uses models via OpenRouter, via your own API keys, or via skills and channels with non-EU providers, your message content is transmitted to providers some of which (e.g., OpenAI, Anthropic, Google) are based in the United States or other countries outside the European Economic Area (EEA). In strict GDPR mode, AI processing stays in the EU; only web search queries are sent to Brave Search (USA), which is certified under the EU-US Data Privacy Framework.

These transfers are protected by:

Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to GDPR Article 46(2)(c), which we have entered into with each relevant sub-processor
Adequacy decisions where applicable, including the EU-US Data Privacy Framework for certified US providers (e.g. Brave Search)
Additional technical safeguards, including encryption in transit (TLS) and at rest

When possible, EU-based routing is used. A full list of sub-processors with their locations and transfer mechanisms is available on our Sub-Processors page.

8. Security & Data Breach Notification

We implement technically and organisationally appropriate measures to protect your personal data against accidental loss, alteration, disclosure, or unauthorised access.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission (Ireland) within 72 hours of becoming aware of it, as required by Article 33 GDPR. If the breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay.

We share data only with the following parties, and only to the extent necessary:

Lyceum — to process your bot’s conversations with EU-hosted AI models, if you chose a Lyceum model
OpenRouter — to route your bot’s requests to AI models, if you chose an OpenRouter model (and outside strict GDPR mode as described in Section 5)
AI model providers — to process your bot’s conversations (as described above)
Providers of skills and channels you install — only while installed, as disclosed with each skill
Payment processor — to handle billing securely
Hetzner — as our hosting provider (encrypted data storage)
Google API Services — to retrieve and display your Google data (Calendar, Tasks, Contacts, Drive, Docs, Sheets, Slides, Forms, YouTube) when you use these features. Data is retrieved live and is not stored on our servers. See Section 6 for full details.
Cookiebot — to record your cookie choice
Google Ireland Limited — for Google Analytics, only with your consent to statistics cookies
Meta Platforms Ireland Limited — only with your consent to marketing cookies; see section 9a
Law enforcement — only when legally compelled by applicable law

We do not sell data and do not share it with data brokers. We share data with Meta only as described in section 9a.

9a. Meta Pixel and Conversions API: Joint Controllership with Meta

If you consent to marketing cookies, our website uses the Meta Pixel, and our app reports certain events to Meta through the Meta Conversions API: a registration, the start of a checkout, the start of a trial and a subscription. This lets us measure whether our advertising on Facebook and Instagram works, and lets Meta show our advertising to people who may be interested. The Pixel may set the cookies _fbp and _fbc and transmits, among other things, your IP address, browser data, the page visited and the event.

For the collection of this data on our website and in our app, and for its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers under Article 26 GDPR. We have agreed with Meta how we share our obligations; the essence of that agreement is Meta’s Controller Addendum (www.facebook.com/legal/controller_addendum). We provide the information in this section, and we obtain your consent. You can exercise your rights against us or against Meta.

After the transmission, Meta processes the data as a controller of its own, for its own purposes, under Meta’s privacy policy (www.facebook.com/privacy/policy). Meta may also process the data in the United States; for that transfer Meta relies on the safeguards described in its privacy policy.

Legal basis: your consent (Article 6(1)(a) GDPR and regulation 5 of S.I. No. 336 of 2011). You can withdraw it at any time through “Cookie Settings”, with effect for the future.

10. Analytics & Statistics

We collect analytics data on how our website and platform are used. This helps us understand what works, what doesn’t, and where to improve.

What we track:

Page views, click patterns, and navigation flows on the website
Platform usage statistics (e.g., which features are used most, bot activity levels)
Error rates and performance metrics
Aggregated billing data (total revenue, subscription status) — never your payment details

Analytics data is used to improve our website and platform. Google Analytics runs only with your consent to statistics cookies, and Google Ireland Limited processes that data for us. Analytics data is not used for advertising.

11. Cookies

We use Cookiebot to ask for your consent. When you first visit our site, only necessary technologies run. In the banner you can choose “Accept all”, “Reject all” or set your choice per category in “Settings”:

Necessary — your cookie choice, security and the website chat. These run without consent.
Statistics — Google Analytics and our own click statistics. Only with your consent.
Marketing — the Meta Pixel and the Meta Conversions API (section 9a). Only with your consent.

You can change or withdraw your choice at any time through “Cookie Settings” at the foot of every page. Rejecting statistics and marketing does not affect the platform. Details and the full list of cookies are in our Cookie Policy.

12. Data Retention

We retain your data for as long as your account is active and the services are being provided.

Upon account closure:

Your data will be deleted within 90 days as part of our standard deletion cycle
If you request expedited deletion, we will process it within 30 days of your explicit request
Some data may be retained beyond these periods where required by law (e.g., financial records for tax compliance)

Bot conversation history and memory can be deleted at any time from your dashboard while your account is active.

Under the General Data Protection Regulation, you have the right to:

Access — request a copy of all data we hold about you
Rectification — correct any inaccurate data
Erasure — request deletion of your data (“right to be forgotten”)
Restriction — request limitation of processing
Portability — receive your data in a structured, machine-readable format
Objection — object to certain types of processing
Withdraw consent — for processing based on consent (for example statistics and marketing cookies)
Lodge a complaint — with the Data Protection Commission in Ireland (www.dataprotection.ie), our lead supervisory authority, or with the supervisory authority of the EU country where you live or work

To exercise any of these rights, contact us at support@onebuddy.app. We will respond within one month. Where requests are complex or numerous, we may extend this by two further months and will tell you why.

14. Children & Minimum Age

Age requirements:

18 years or older: You may create and use an account independently.
16 to 17 years old: You may only use oneBot with the verified consent of a parent or legal guardian who agrees to these terms on your behalf. The parent or guardian is responsible for supervising the minor’s use of the platform and assumes all liability for it.
Under 16 years old: You are not permitted to create an account or use oneBot in any capacity. This restriction is in accordance with GDPR Article 8 and EU Digital Services Act requirements.

We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a person under 16 without proper consent, we will delete that data promptly. We reserve the right to request proof of age or parental consent and to suspend or terminate accounts where age requirements are not met.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Notify registered users via email at least 14 days before the changes take effect
Update the “Last updated” date at the top of this page
Clearly summarise what has changed in the notification

Continued use of the platform after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you may close your account before the effective date and request deletion of your data in accordance with Section 12.

16. Contact & Supervisory Authority

For any questions or concerns regarding your privacy:

One Labs Bot Technologies Limited — Data Protection