Privacy Policy

1. Who we are and what this covers

OneHall is provided by Dev Inception Limited, a company registered in Canada ("we", "us"). This policy explains how we handle personal information when you visit our websites, use the OneHall Hub, OneHall Chat, OneHall People (including the OneHall People Tracker), OneHall Projects or OneHall Finance on the web, desktop or phone (the "Services"), or contact us.

It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). Words such as "controller" and "processor" have the meaning those laws give them.

2. Our two roles: controller and processor

The Services are used by organisations — your employer, or a company you work with. Most of the personal information in the Services is put there by, or recorded for, that organisation. Who decides what happens to it depends on what it is:

If you use the Services through your employer or another organisation, that organisation is responsible for your information in its Hub, and its own privacy notice applies. Questions and requests about that information — including asking for a copy, a correction or deletion — are best sent to the organisation first. If you contact us about it, we will pass your request on and help the organisation answer it.

3. Information we collect

3.1 You give us

• Account details — name, work email address, password (stored only as a one-way hash), profile photo, job title, department, phone number, time zone and preferences.
• Organisation and billing details — organisation name, logo and settings, the plan and products chosen, and the billing contact. Card details are entered into a form provided by Stripe and go directly to Stripe; we receive only a reference to the card, its brand, last four digits and expiry.
• Support and correspondence — what you tell us when you contact support, email us, or answer our messages.
• Early-access registrations — when you register on the early-access page of our website: your name and work email address; your phone number and job title if you give them; your company's name, country, size and industry; the products you are interested in; whether you register for the early-adopter price or only want to hear when products open; when you would like to start; any message you write; and whether you agreed to be contacted about the registration and to receive product news.

3.2 Your organisation puts into its Hub (Customer Data)

• OneHall Hub — members and their roles and product access, security settings, invitations, the audit log of important actions, support requests.
• OneHall Chat — messages, reactions, files, shared documents and whiteboards, call participation and duration, and call recordings where someone records a call.
• OneHall People — employee profiles and documents, contracts and compensation, leave and absence (which may include health information), attendance and time, clock-in location where location-checked clock-in is turned on, the network address time is recorded from (to tell office days from remote ones), expenses, recruitment and candidate records, performance and engagement records, policy acknowledgements, and privacy requests.
• OneHall People Tracker — working time, activity levels, idle time, the network address it connects from, time per application (if turned on), website domains (if turned on), whether the microphone or camera is in use, device names, notes people add, and screenshots (if the add-on is bought and turned on). Section 11 explains this in full.
• OneHall Projects — projects, tickets, tasks, comments, documents, time entries and test records.
• OneHall Finance — customers, suppliers and their contacts, invoices, bills, expenses, payments, bank statements you upload, ledger entries, payroll calculations and tax figures.

3.3 We collect automatically

• Sign-in and security records — sign-in times, IP address, browser and operating system, device name, and whether two-step verification was used, to keep accounts secure and let you see and end your sessions.
• Device details for the apps — for the desktop and phone apps, the app version and operating system, and for phone notifications a push token that identifies the app installation.
• Service logs — technical records of requests and errors, including IP address, to operate, secure and fix the Services.
• With an early-access registration — the campaign link or the website that brought you to the page, and a one-way coded form of your network address (never the address itself), which we use only to stop abuse of the form. The form is protected by Cloudflare Turnstile, a check that tells people from automated programs: it runs in your browser and sends Cloudflare technical information about your browser and your IP address, and we receive only whether the check was passed.
• Usage counts — for example how many members, messages or tickets a Hub has, which the Hub shows to its administrators and which we use to run and bill the Services. We do not use third-party analytics or advertising trackers in the Services or on our websites.

3.4 From others

• Your organisation — when an administrator invites you, they give us your name and email address.
• Stripe — whether a payment succeeded, and the card reference above.
• Services you connect — if your organisation imports from another tool or connects an integration, the content it chooses to bring in.

4. How we use information, and our legal bases

For Customer Data, we act on the organisation's instructions and the organisation decides the legal basis. For the information we control, we rely on the following:

Under PIPEDA we rely on your consent, which may be implied by your use of the Services for these purposes, and you may withdraw it subject to legal and contractual restrictions. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you. We do not make decisions producing legal or similarly significant effects about you by automated means.

AI and DUA. The Services include DUA, an assistant available to everyone who uses them. DUA does two things. It answers questions about your organisation's own records: those answers are produced by our own software, from records you are already permitted to see, and DUA refuses what your role may not see. When our software does not recognise how a question is worded, the question itself is sent to a large language model run by OpenAI, only so that it can choose which of our lookups answers it; your organisation's records are not sent for this. DUA also helps with writing (for example summarising, improving or drafting text): the text you give it, and your instruction, are sent to the same model and its suggestion is returned to you to use or discard. Nothing is sent to OpenAI unless a person asks DUA for it. We ask OpenAI not to store what we send; it may keep it for a limited period to detect abuse, as its terms describe, and under its terms for this service it does not use it to train its models. DUA's suggestions are generated text and may be wrong: check them before relying on them. Where message translation is turned on, it runs on a translation service we operate ourselves; the text is not sent to a third party.

5. How we share information

• Within your organisation. Information in a Hub is visible to the people in that organisation according to the roles and settings its administrators choose. Administrators can export the Hub's data.
• Our subprocessors, listed in Section 6, who help us run the Services under contracts that restrict them to that purpose and require them to protect it.
• Services your organisation connects. When your organisation connects its own payment gateway, an import or another integration, we exchange data with it on the organisation's instructions. Those providers are responsible for what they do with it.
• Our staff, only as needed to provide and secure the Services and to answer support requests. When support staff view a Hub to resolve a request, the session is recorded in the Hub's audit log.
• Legal reasons. Where the law, a court order or a valid request from an authority requires it, or where needed to protect people's safety or our rights. For Customer Data, we direct authorities to the organisation where we can, and tell it unless the law forbids us.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, information may pass to the new owner, who must continue to protect it as this policy describes. We will give notice before that happens.

We never sell personal information.

6. Subprocessors and service providers

We run our own databases, file storage, search, call media and translation software on servers we rent from infrastructure providers in their data centres; no other company operates that software or reads your data. The companies below process personal information for us. We announce a new subprocessor here, and by email to Hub owners, at least 30 days before it starts processing Customer Data.

When your organisation connects its own Stripe or PayPal account to OneHall Finance to collect payments, or connects another integration, that provider acts for your organisation, not for us, and is not our subprocessor.

7. Where information is stored, and international transfers

• The Services are hosted in data centres in the United States and the European Union, where encrypted backups are also kept. Our subprocessors may process information in the locations listed in Section 6. We are based in Canada.
• EU, EEA, UK and Swiss customers. We do not currently offer hosting inside the EU or the UK. Transfers from the EEA to Canada rely on the European Commission's adequacy decision for Canada (for organisations subject to PIPEDA). Transfers to other countries without an adequacy decision — including the United States unless the recipient is certified under the EU-U.S. Data Privacy Framework — rely on the EU Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, together with the security measures in Section 9. You can ask us for a copy of the safeguards at [email protected].
• Canadian customers. Your information may be processed outside Canada, where it is subject to the laws of that country and may be accessible to its courts, law-enforcement and national-security authorities.

8. How long we keep information

9. How we protect information

• In transit: every connection to the Services uses TLS.
• At rest: servers use encrypted disks; backups are encrypted; secrets for connected services (such as payment-gateway and import credentials) are additionally encrypted in the database.
• Passwords are stored as salted one-way hashes; recently used passwords cannot be reused; repeated failed sign-ins lock the account and are rate-limited.
• Two-step verification with an authenticator app, and single-use backup codes stored as hashes.
• Sessions use short-lived tokens in cookies that scripts cannot read; refresh tokens rotate on every use, and reuse of an old one ends the whole session family.
• Separation between organisations: every query is scoped to the organisation, backed by database row-level security.
• Least privilege: role-based access inside every product, field-level restrictions on HR records, and restricted access for our staff.
• Audit trail: a tamper-evident (hash-chained) audit log of important actions.
• Payments: card numbers never reach our servers.

We are open about the limits too. Messages in OneHall Chat are not end-to-end encrypted: our servers can read them in order to display, search and export them. We have not yet completed an independent certification such as SOC 2 or ISO 27001. No system is perfectly secure; if we learn of a breach affecting your information, we will notify the organisation responsible (and, where we are the controller, you and the authorities) as the law requires.

10. Your rights and how to use them

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — to know what we hold and receive a copy.
• Correction — to have inaccurate information corrected.
• Deletion — to have information erased, subject to legal exceptions.
• Portability — to receive information you provided in a machine-readable format.
• Restriction and objection — to limit or object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent, at any time, without affecting earlier processing.
• California residents — to know the categories and specific pieces of information collected, used and disclosed; to delete and correct; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information (we use it only as permitted); and not to be discriminated against for using these rights. You may use an authorised agent.
• Complain to a supervisory authority — in the EU, your local data protection authority; in the UK, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner of Canada or your provincial commissioner.

How to ask

• Yourself, in the product. You can view and edit your profile in your settings, and download a copy of the data held about your account from your profile settings ("Export my data").
• Information in an organisation's Hub — contact that organisation; its administrators can export, correct and delete it, and OneHall People tracks such requests and their due dates. If you cannot reach them, write to us and we will pass it on.
• Anything else — email [email protected] with "Privacy request" in the subject line.

We may need to confirm your identity before acting, usually by asking you to write from the email address on the account. We answer within one month (GDPR and UK GDPR), 30 days (PIPEDA) or 45 days (CCPA), and tell you if we need an extension the law allows. Using your rights is free unless a request is manifestly unfounded or excessive.

11. Workplace monitoring and the OneHall People Tracker

The OneHall People Tracker is a desktop app some organisations use to record their staff's working time. If your employer uses it, this is what it means for your privacy. The full terms, including your employer's duties, are in Section 18 of our Terms of Service.

Your employer is responsible

Your employer decides whether to use the Tracker, which settings to turn on, who in the organisation can see the results, and how long screenshots are kept. It is the controller of your monitoring data; we process it only on its behalf, never sell it, and never use it for our own purposes. Your employer must tell you why and how it monitors, have a lawful basis, and meet any works-council, union or local-law requirements before it starts.

What is recorded

• Nothing until you have agreed to the monitoring notice in the Tracker and started a session. Recording pauses when you pause and when your computer is locked or asleep.
• Working time: starts, pauses, stops, breaks, and the project or task you chose.
• Activity level: the share of each interval with keyboard or mouse input — never what you typed or clicked. There is no keylogging.
• Where your mouse pointer is on the screen, read once a second, and (where your system offers it) how long ago your keyboard and mouse were last touched. This is used on your computer only, to tell your own input from a script that fakes it. The pointer's position is dropped after about ten minutes; it is never sent to your employer or to us and never stored, and it is not a record of what you clicked or looked at.
• Time the Tracker could not vouch for: when a stretch looks made by software, or one of your screens could not be captured, your employer is told when it began and ended and one line saying what was seen. It is held back from your hours until whoever approves your time decides.
• Idle time, marked as idle, which you and your manager can keep or discard.
• The applications you use and how long each was in front, if your employer turned this on — the application's name only, never window titles or on-screen content.
• Website domains (for example example.com), only if your employer turns this on — never the page, its title, what you searched or typed. Private and incognito windows are never recorded.
• Whether your microphone or camera is in use (yes or no), so that time on calls is not marked idle — never what is said or seen.
• The network (IP) address your computer connects from, with your time, so your employer can tell office days from remote ones. You and your manager see "office" or "remote"; administrators with monitoring permission also see the address.
• If your connection drops, your time and activity are kept on your computer and sent when you are back online, with when the connection went and came back.
• Screenshots of your whole screen, only if your employer bought the Screenshots add-on and turned it on, only while you are tracking, and not where your organisation operates in a country where screenshots are blocked (Section 18.3 of the Terms). A screenshot shows whatever is open on your screen. The Tracker shows you when screenshots are on. Your employer can have them blurred on your computer before they are sent.
• Notes you add yourself — to idle time, held time, a screenshot or a day — shown to whoever reviews them.

What stays on your computer

• A detailed timeline of your day — which application or site was in front, and when — is kept on your own computer for 30 days to help you fill in your time. It is for you alone and is never sent to your employer or to us.
• You can mark applications and sites as private. Time in them counts as "Private": its name is not recorded and it is not kept in your timeline. It does not change screenshots, which show your whole screen.

Who sees it, and for how long

• You can see your own time and activity in the Tracker, and your screenshots under Time Tracker → My time.
• Your manager can see them for the people they manage, and never anyone else's. People in your organisation with monitoring permission can see them too.
• Only those people can delete screenshots, except that where your employer allows it you can delete one of your own within a day; the record then says you did.
• Screenshots, activity and network addresses are kept for the periods your employer sets (section 8 lists the defaults), then permanently deleted. Time records are kept as long as your employer keeps them.

Your choices and rights

• You can decline the monitoring notice; the Tracker then records nothing for you. Your employer may have other ways of recording working time.
• You can withdraw at any time from inside the Tracker; recording stops at once.
• When the notice changes in substance, you are asked to agree again, and nothing is recorded until you do.
• To get a copy of your monitoring data, screenshots included, or to ask for correction or deletion, ask your employer's administrators first. If they do not respond, write to [email protected] and we will pass your request to your employer and help it answer.
• Consent at work is often not freely given. Where the law says so, your employer must rely on another legal basis and consult your representatives; you can complain to your data protection authority if you think monitoring is unlawful.

12. Children

The Services are for organisations and their staff and are not intended for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

13. Cookies and similar technologies

Our marketing website (onehall.dev) sets no cookies. It remembers your light or dark theme choice in your browser's local storage, which never leaves your device.

The Services use only cookies that are strictly necessary to sign you in and keep your session secure. Because they are necessary, they do not need consent, and there is no advertising, analytics or cross-site tracking cookie.

The Services also keep your preferences (such as theme and layout) and a copy of your profile in your browser's local storage, so screens open quickly. The desktop apps keep your sign-in in your operating system's secure credential store, and the phone apps in the device keychain or keystore. Signing out removes them.

14. Emails and notifications

We send service emails that are part of the Services — verification, invitations, security alerts, trial and billing notices, and notifications your settings allow. Product notifications can be turned off in your notification settings, and phone notifications in your device settings. We do not send marketing email to Users without the consent the law requires, and every marketing email has an unsubscribe link.

If you register on our early-access page, we email you once to confirm the registration, at most once a day however often the form is sent, and then contact you only about the registration, plus product news if you ticked that box. The confirmation repeats only the products you chose and the early-adopter price. To stop these emails, withdraw your consent or have your registration removed, write to [email protected].

15. Changes to this policy

We update this policy when the Services or the law change. Each version is dated at the top of the page. For a material change we give Hub owners at least 30 days' notice, and everyone is asked to review and accept the new version the next time they sign in, as described in our Terms of Service.

16. Contact us

• Privacy questions and requests: [email protected] (subject "Privacy request"). Our privacy lead is responsible for this policy and answers these messages.