Privacy Policy

Last updated 25 October 2026

This policy explains how Divhunt GmbH, Chamerstrasse 172, 6300 Zug, Switzerland, UID CHE-297.885.332 ("we"), handles personal data as the controller for OneType. OneType is a product of Divhunt. Contact: admin@onetype.ai. We have not appointed a data protection officer.

1. What this policy covers

our website onetype.ai, including the chat assistant on it;
the OneType app (app.onetype.ai) and the people who sign up and work in it;
billing, support and security.

It does not cover conversations between a customer's agent and that customer's visitors. There we process data on the customer's behalf, under our Data Processing Agreement, and the customer's own privacy policy applies.

2. Data we process, why, and for how long

Contract = needed to give you the service; legitimate interest = needed to keep it safe and working; legal obligation = the law requires it.

data	why	legal basis (GDPR / Swiss FADP)	how long
Account: name, email, password (stored only as a secure hash), profile photo, workspaces and roles	to run your account and your team	contract	until you delete your account; we then anonymise it straight away (your name and email are removed)
Sign-in sessions: a session token and your browser's name	to keep you signed in safely	contract, legitimate interest (security)	up to 30 days per session
Billing: billing name, address, VAT number, plan, invoices. Card details are held by Stripe, not by us	to charge for the service, tax and accounting	contract, legal obligation	invoices as long as Swiss law requires (10 years); the rest until your workspace is deleted
Security records: the audit log of actions in your workspace, including the IP address; our web server logs, including IP addresses	to protect accounts and the service, and to investigate abuse	legitimate interest	audit log 365 days; server logs are rotated by size
Emails we send you (verification, invitations, notifications, billing)	to run the service	contract	as long as needed to send them
Messages to our support address	to help you	contract, legitimate interest	as long as needed to handle your request
Chats with the assistant on onetype.ai: your messages and anything you choose to share	to answer your questions about OneType	legitimate interest	kept until deleted; write to admin@onetype.ai to have a conversation deleted
Website preview at onetype.ai/try: the address you enter, the public pages we read from it, and your questions to the preview agent	to show you an agent trained on your site	legitimate interest (you asked for the preview)	deleted 30 minutes after you start it, unless you sign up and keep the agent
Website usage with Google Analytics, only if you accept analytics: an online identifier in cookies, pages viewed and actions, device and browser type, approximate location	to understand how the website is used and improve it	consent	14 months in Google Analytics; you can withdraw consent at any time

Our founders and authorised staff can see account data, including email addresses, in internal tools to run, support and secure the service, and to understand how it is used; access is limited to people who need it for these purposes, and we do not use it for advertising.

We don't sell personal data, and we don't use it for advertising.

If you choose "Continue with Google" to create an account or sign in, we ask Google for the openid, email and profile information. Google tells us your email address, your name and an identifier of your Google account. We store the identifier, your email address and your name. We do not receive your Google password, and we do not store your Google profile picture.

We use this information to create your OneType account or find the one you already have, and to sign you in. We keep the identifier so you can sign in with Google again, even if you later change your email address. We keep the link to your Google account (the identifier, the email address Google gave us and the dates it was created and last used) until you delete your OneType account, which removes it.

If you created your account with Google only, it has no password until you set one with "Forgot password". Google receives the fact that you are signing in to OneType, under its own privacy policy.

Google user data (Google Drive)

When you connect Google Drive to an agent:

What we access: only the files you pick in Google's file picker (Google's drive.file permission), never the rest of your Drive, and the email address of the Google account, to show which account is connected.
How we use it: we read the files you picked to build that agent's knowledge. We store passages from them, and search data made from those passages, on our servers in the EU, and read the files again when they change. The agent answers visitors from them, and the passages that fit a question are sent to our AI providers to write the answer (see our sub-processors). We use this data for nothing else.
How we store it: Google access tokens are stored encrypted and are never shown to anyone.
How we share it: we don't sell it, use it for advertising, or use it to train AI models. No one at OneType reads it unless you ask us to (for example, for support), it is needed for security, or the law requires it.
How to delete it: when you disconnect Google Drive, you choose whether to keep what was already read (it is then never read from Drive again) or to remove it. Removing a Drive source, or deleting your workspace, deletes what we read from those files. You can also remove OneType's access in your Google account settings.

OneType's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Cookies and browser storage

onetype.ai (website)

We measure how many people visit onetype.ai with Cloudflare Web Analytics: cookieless, aggregate analytics, no personal data and no cross-site tracking. If you accept analytics in our cookie banner, we also use Google Analytics (see below). No advertising cookies.
The chat assistant keeps your current conversation in your browser's session storage, which clears when you close the tab.
The preview page (/try) loads Cloudflare Turnstile to check that you are a person. For that check, Cloudflare receives your IP address and signals from your browser.
Our staff sign in to the site's content editor with a login cookie that only they receive.
Cookie settings choice ot_consent: remembers your cookie choice (analytics accepted or rejected). It is set for onetype.ai and its subdomains, holds no personal data and lasts 180 days, then we ask again. Strictly necessary.
Google Analytics cookies _ga and _ga_<container-id> (only if you accept analytics): _ga distinguishes users, _ga_<container-id> keeps session state; both last up to 2 years (Google's default). They are set only after you accept analytics.

app.onetype.ai (the app)

Session cookie __Host-onetype_session: keeps you signed in. It is secure, not readable by scripts, and lasts up to 30 days. It is strictly necessary.
Sign-in-with-Google cookie (named like the session cookie, ending in -google): a short-lived cookie (10 minutes) that carries sealed checks for your Google sign-in. It is not readable by scripts and is deleted when the sign-in finishes. It is strictly necessary.
Local storage: remembers your choices in the app (for example the active workspace or last agent). Strictly necessary or functional.
Third parties:
- When the human check is on, sign-up loads Cloudflare Turnstile to block bots.
- When you connect Google Drive, Google's file picker is loaded.
- When you choose Continue with Google, you are sent to Google to sign in, and back to OneType.

The chat on our customers' websites stores no cookies. By default it keeps the conversation in session storage only. The customer decides how it is used on their site.

If you accept analytics in our cookie banner, we use Google Analytics on our website onetype.ai (not in the app at app.onetype.ai) to see how the website is used: which pages are viewed, where visitors come from, and which device and browser they use and roughly where. We do not ask for or send your name or email address to Google Analytics. Google Analytics sets cookies in your browser and sends this data to Google LLC, which processes it for us as our processor. We do not use it for advertising.

Your choice: analytics is off until you choose. If you reject it, we set no Google Analytics cookies. You can change your mind at any time with "Cookie settings" in the footer; withdrawing does not affect what happened before. If your browser sends a Global Privacy Control signal, we treat it as a rejection of analytics.
Legal basis: your consent.
How long: Google Analytics keeps this data for 14 months, then deletes it.
Transfers: Google may process this data in the United States and other countries. Transfers are protected by the standard contractual clauses and, where available, the EU-US Data Privacy Framework.
Not in the chat widget or the app: we do not use Google Analytics inside the chat widget that runs on your website or in the app at app.onetype.ai.

4. Who receives data

Our service providers (sub-processors) receive data only as needed to run OneType: hosting, storage, AI models, search, email and payments. The full list is on our sub-processors page. We may also share data with professional advisers or with authorities when the law requires it.

5. International transfers

We are in Switzerland (which the EU recognises as protecting data adequately) and our servers are in Germany. Some providers, like the AI model companies, are in the United States; for them we use the EU's Standard Contractual Clauses (with the Swiss addendum) or the EU-U.S. and Swiss-U.S. Data Privacy Framework.

6. Your rights

You can ask to see your data, correct it, delete it, limit how we use it, or get a copy to take elsewhere, and you can object to processing based on legitimate interest. You can also withdraw any consent you gave.

Write to admin@onetype.ai. We answer within one month.
You can delete your account yourself in the app.
You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority in your EU country.

7. Security

We protect data with encryption in transit, encrypted storage of secrets, hashed passwords, strict separation between workspaces, access limited to authorised personnel, and daily backups. Details are in Annex 2 of our Data Processing Agreement.

8. Changes

If we change this policy in a way that matters, we tell you in advance by email or in the app.