Privacy policy

Onetab AI Data Privacy Policy

1. Introduction

Your privacy is important to us. Onetab.ai Corporation and its group companies (“Onetab.ai”, “we”, “us” or “our”) are committed to respecting your privacy while you use our website and services, including OneTab HR, Onetab People for Slack, AI agents, workflow automation, integrations and related platform features.

This Policy explains how we collect, use, store, share, protect and delete Personal Data and Sensitive Personal Data.

As a global organization, we aim to comply with applicable data protection laws, including, where applicable:

EU General Data Protection Regulation 2016/679 (GDPR).
California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
Privacy Act 1988 (Australia), including the Australian Privacy Principles (APP).
Data Protection Act 2018 (UK) and applicable UK GDPR requirements.
Information Technology Act 2000 and applicable rules in India.
Personal Data Protection Act 2012 (Singapore).

The laws applicable to a particular individual or processing activity depend on the circumstances.

2. Scope and Policy Statement

This Policy applies to personal information processed through our websites, applications, products, integrations, AI agents, workflow automation services and business operations.

It covers information relating to customers, workspace members, website visitors, prospective customers, business partners, vendors, candidates, employees, contractors and other individuals whose information we process.

Depending on the service and processing activity, Onetab.ai may act as a data controller or processor. For example, we may determine the purposes of processing account and website information, while a customer may determine the purposes for which employee, candidate or other workspace data is processed through our platform.

Where we process data on behalf of a customer, the applicable customer agreement and data processing terms may also apply.

3. Definitions

Personal Data: Information relating to an identified or identifiable individual.

Personal Information: Information that identifies, relates to or can reasonably be linked to a consumer or household under applicable privacy laws.

Sensitive Personal Data: Personal data classified as sensitive under applicable law, including certain health, biometric, genetic, racial, ethnic, religious or other protected information.

Processing: Any operation performed on personal data, including collection, storage, use, disclosure, transfer or deletion.

Consent: A freely given, specific and informed indication of agreement to processing where consent is the applicable legal basis.

Data Subject: An identifiable individual whose personal data is processed.

Data Controller: An entity that determines the purposes and means of processing personal data.

Data Processor: An entity that processes personal data on behalf of a controller.

Third Party: An entity other than the individual, controller or processor that is involved in or receives data through an authorized arrangement.

AI Agent: An AI-powered system configured to respond to instructions, process information or perform authorized tasks.

Sub-processor: A third-party provider engaged by a processor to perform certain processing activities.

4. Data We Collect

The information we collect depends on the services you use, the features you enable, the information you provide and the permissions you grant.

4.1 Account and Workspace Information

We may collect account identifiers, names, email addresses, profile information, authentication records, workspace identifiers, workspace membership, roles, permissions and account preferences.

4.2 Customer and Business Information

We may collect information provided during service provision, customer support, sales, subscriptions, business relationships and other interactions with Onetab.ai.

4.3 AI Prompts and Conversations

When you use AI chat, agents or related features, we may process:

Prompts, messages and instructions you submit.
Conversation history and context required to respond to your requests.
Files, documents and other content you upload or submit.
AI-generated responses and outputs.
Relevant information retrieved from services you have connected and authorized.
Agent configuration, preferences and memory where these features are enabled.

4.4 Workflow and Automation Data

When you create or execute workflows and automations, we may process workflow configurations, execution inputs and outputs, task status, timestamps, error information, execution logs and related technical metadata.

The information processed depends on the workflow configuration and the permissions granted to the workflow or agent.

4.5 Connected Services and Integrations

When you connect third-party applications, we may process information made available through the relevant integration, such as authorized messages, documents, records, identifiers, events and metadata.

The scope of collection depends on the permissions you authorize and the functionality of the integration. We do not claim to access all information in a connected service unless the relevant permissions and implementation allow it.

4.6 Integration Credentials

We may process OAuth access tokens, refresh tokens, API credentials and other authorization information required to establish and maintain integrations.

These credentials are used to authenticate authorized requests and maintain the integrations you configure.

4.7 Usage and Technical Information

We may collect service usage information, timestamps, device and browser information, diagnostic records, application logs, security events and information needed to troubleshoot issues and maintain service reliability.

Cookies and similar technologies may also collect information as described in our applicable Cookie Policy.

4.8 Billing and Support Information

We may process subscription details, billing status, transaction references and other payment-related metadata. Payment card details may be processed directly by our payment service providers.

We may also process information you provide when contacting support or submitting feedback.

4.9 Business, Recruitment and Employment Information

Depending on our business activities and the services used, we may collect business partner and vendor information, candidate information, employee information and related employment records.

4.10 Website and Marketing Information

We may collect information submitted through website forms, marketing interactions, events, professional networking platforms and other communications with Onetab.ai.

5. Purposes and Lawful Basis of Processing

We may process personal data for the following purposes:

Providing, operating and maintaining our products and services.
Creating and managing accounts, workspaces, roles and permissions.
Responding to prompts and generating AI outputs.
Executing user-authorized agent actions and workflow automations.
Connecting third-party applications and retrieving authorized information.
Maintaining conversation context, preferences and configured agent memory.
Managing subscriptions, payments and customer relationships.
Providing customer support and resolving technical issues.
Monitoring service performance, investigating errors and improving reliability.
Protecting accounts, preventing fraud and detecting unauthorized activity.
Complying with legal obligations and establishing or defending legal claims.
Conducting recruitment and employment-related activities where applicable.
Managing business relationships, communications and marketing where permitted.

Where required by applicable law, we rely on an appropriate legal basis, such as performance of a contract, consent, compliance with a legal obligation or legitimate interests.

Where consent is the applicable legal basis, you may withdraw it as permitted by law. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

6. Processing Sensitive Personal Data

We process Sensitive Personal Data only where permitted by applicable law and where an appropriate legal basis and any required additional conditions are satisfied.

Depending on the circumstances, these may include explicit consent, protection of vital interests or another legally authorized basis.

You should not submit sensitive information to an AI agent or connected service unless it is necessary for your request and you are authorized to provide it.

Customers are responsible for ensuring that their use of the platform to process sensitive information complies with applicable law and their contractual obligations.

7. Data of Minors

Our services are not intended to be used by children where their use would violate applicable law or age restrictions.

We process information relating to individuals below 18 years only where permitted by applicable law and for an authorized purpose, including applicable travel or immigration activities where relevant.

Where required, we obtain consent from a parent or legal guardian. If you believe that we have collected a child’s personal information unlawfully, contact us so that we can review the matter and take appropriate action.

8. Direct Marketing

Where permitted by applicable law, we may use contact information to communicate with you about our products, services, events and relevant business updates.

You can opt out of marketing communications using the unsubscribe mechanism provided or by contacting us. Opting out of marketing does not prevent service-related, security or legally required communications.

Where applicable, California residents may request information about disclosures of personal information for direct marketing purposes as provided by law.

9. Events and Initiatives

This Policy applies to participants and speakers at events organized by Onetab.ai.

We may process registration information, contact details, attendance information and other information necessary to organize events and related activities.

Where third parties assist with event organization, information may be shared with them to the extent necessary and subject to applicable legal requirements.

10. Google API Services and Google Cloud Platform Compliance

Onetab.ai’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Our application uses Google Workspace APIs solely to provide user-requested functionality, including authorized AI agent actions and workflow automation within the platform.

Access to Google user data is limited to the functionality explicitly authorized by the user and is used only to deliver and operate the requested services.

Google Workspace API data is not used to develop, improve or train generalized artificial intelligence (AI) or machine learning (ML) models.

We do not sell Google Workspace user data or use it for advertising.

Any transfer or processing of Google user data by third parties is subject to the applicable Google API Services User Data Policy and relevant contractual requirements.

11. Onetab People for Slack

Onetab People is the Slack app for OneTab HR. It enables authorized users in a Slack workspace to work with OneTab HR hiring data, including jobs, candidates, screening, interviews and offers.

This section describes information received from Slack and how we use it. The rest of this Policy also applies.

11.1 Information We Receive from Slack

Depending on the app functionality you use, we may receive:

Slack workspace ID and name.
Slack user IDs of individuals who use Onetab People.
Messages and files, such as resumes or job descriptions, that a person sends directly to Onetab People.
Messages in which someone mentions @Onetab People.
Buttons pressed, forms submitted and use of the /onehr command.
An access token issued by Slack when the app is installed.

Onetab People does not read channel history, other direct messages, workspace member lists or Slack email addresses through the described integration functionality.

11.2 How We Use Slack Information

We use this information to:

Carry out each request in the person’s own OneTab HR account, subject to the role and permissions assigned to that person.
Process authorized hiring requests and related files.
Save Onetab People conversations as OneTab HR conversations and process submitted files as resumes or documents where the relevant functionality supports this.
Send responses to the person’s direct message with Onetab People rather than to Slack channels.

We do not sell this information, use it for advertising or share it with other customers.

11.3 Retention and Deletion

Onetab People conversations and files are retained while the customer’s OneTab HR account remains active, subject to applicable account settings, contractual obligations and legal retention requirements.

Technical identifiers of Slack messages used to avoid processing a message twice are automatically deleted after seven days.

When Onetab People is uninstalled from a workspace or its access is revoked, we delete the associated Slack access token and Slack account links and stop receiving data through that connection, in accordance with the applicable integration behavior.

A person can disconnect their own Slack account using the /onehr disconnect command.

To access, export or delete your data, email hello@onetab.ai. We verify requests and process deletion within 30 days, except where the law requires us to retain information.

12. Artificial Intelligence

12.1 AI Processing Across Onetab AI

Onetab AI uses artificial intelligence models to generate responses, analyze information, assist with tasks and execute authorized workflows.

Depending on the product, agent and features used, the information processed may include prompts, conversation context, uploaded files, workflow inputs and outputs, and relevant information retrieved from connected services.

The information necessary to answer a request may be transmitted securely to the AI provider configured for that feature.

12.2 AI Providers and Data Use

For Onetab People for Slack, requests and relevant OneTab HR data are sent securely to OpenAI through its API to generate responses.

Under the applicable OpenAI API terms described for this service, submitted data is not used to train OpenAI’s models and may be retained by OpenAI for up to 30 days for abuse monitoring.

For other Onetab AI features, the AI providers, processing locations, retention arrangements and applicable terms may differ depending on the models configured for the service.

We do not use Slack data or customer data to train AI models.

Data accessed through Google Workspace APIs is not used to develop, improve or train generalized AI or ML models, as described in Section 10.

12.3 AI Accuracy and Limitations

AI-generated responses may be inaccurate, incomplete, biased or out of date. You should independently verify important information before relying on it, particularly for legal, medical, financial, employment or other consequential decisions.

AI outputs are not a substitute for qualified professional advice.

12.4 AI Agents and Actions

AI agents and workflows may retrieve information or perform actions in connected services within the permissions and configuration you authorize.

You are responsible for reviewing agent instructions, connected-service permissions and outputs. Where approval controls are available, review consequential actions before approving them.

For Onetab People, actions that contact candidates always wait for a person’s approval.

Do not assume that every agent or workflow requires approval for every action. Review the controls available for the specific feature you use.

13. Sub-processors

Onetab.ai uses third-party service providers to operate its services. The following providers are identified for OneTab HR and Onetab People for Slack.

Sub-processor	Purpose	Location
Google Cloud Platform	Hosting, database and file storage	India (asia-south1, Mumbai)
OpenAI	AI language model processing for the Onetab People recruiter	United States
Stripe	Subscription payments	United States
Twilio SendGrid	Transactional email	United States
Slack	Message delivery between users and Onetab People	United States

Other Onetab AI features may use additional providers for AI processing, hosting, storage, integrations, analytics or other operational functions.

We will update the relevant provider information when material changes occur. Processing by third parties is subject to applicable contractual, privacy and security requirements.

14. Data Retention and Disposal

We retain personal data only for as long as reasonably necessary to provide our services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, enforce agreements and maintain security.

Retention periods depend on the type of data, the product or feature used, customer configuration, applicable agreements and legal requirements.

Different retention periods may apply to:

Account and workspace information.
AI conversations, prompts and generated outputs.
Uploaded files and documents.
Agent memory and user preferences.
Workflow configurations, execution logs and outputs.
Integration credentials and account links.
Security, diagnostic and audit records.
Billing and legally required business records.

Where supported, users may delete relevant content, disconnect integrations or request account deletion.

When an integration is disconnected or uninstalled, we remove associated credentials and related data in accordance with the relevant integration’s deletion procedures. Data already imported into the platform or retained by a third-party service may require a separate deletion request or action.

Information may remain in backups until the applicable backup lifecycle expires. Backup data remains subject to appropriate safeguards and is not retained longer than reasonably necessary for legitimate operational or legal purposes.

Specific retention practices for Onetab People are described in Section 11.3.

15. Data Security

We implement technical, organizational and physical safeguards intended to protect personal data against unauthorized access, loss, alteration, disclosure and destruction.

These safeguards include, as applicable:

Physical security: Facility access controls and monitoring measures.

IT infrastructure: Encryption and access control measures.

Platform data: Customer data is stored on Google Cloud Platform in Mumbai, India. Network traffic uses HTTPS with TLS 1.2 or higher, and customer data is separated between customers.

Slack integration: Requests from Slack are verified using Slack’s signing secret. Slack access tokens are encrypted at rest using AES-256-GCM and are not shared with other customers.

Access management: Access is restricted according to authorized roles and operational requirements.

Oversight and training: Privacy and security practices are reviewed by responsible personnel, with privacy training for employees and contractors.

Incident response: We maintain procedures for reviewing and responding to security incidents and personal data breaches.

No method of transmission, storage or security control can guarantee absolute security. We continually review and improve our safeguards as appropriate.

16. CCTV Surveillance

CCTV monitoring in common areas is conducted where permitted by applicable law for legitimate security and safety purposes.

CCTV footage is accessed and retained according to applicable legal requirements and our internal retention procedures.

17. Group Entities and Data Transfers

Personal data may be transferred to Onetab.ai Corporation, its subsidiaries and authorized service providers where necessary to operate our services, support customers or fulfill other purposes described in this Policy.

Our service providers may process information in countries other than the country where you reside. Where required, we implement appropriate safeguards for international data transfers in accordance with applicable law.

The processing location of a particular service depends on the relevant provider and feature. For example, Google Cloud Platform hosting described in this Policy is located in Mumbai, India, while the listed OpenAI, Stripe, Twilio SendGrid and Slack services have the locations specified in Section 13.

18. Your Rights

Depending on your location and applicable law, you may have the right to:

Request access to personal data we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of personal data.
Request a copy of your data in a commonly used, machine-readable format where applicable.
Object to or request restrictions on certain processing activities.
Withdraw consent where processing is based on consent.
Opt out of certain marketing communications.
Lodge a complaint with an applicable data protection authority.

18.1 How to Make a Request

Email our Data Privacy Officer at the verified contact address provided in Section 20. Include the email address associated with your account and describe the request.

For Onetab People-specific requests, you may also contact hello@onetab.ai. You may be asked to provide additional information to verify your identity and protect your data.

We will respond within the period required by applicable law. Where legally permitted, we may retain information necessary to comply with legal obligations, resolve disputes, prevent fraud or maintain security.

18.2 Disconnecting Integrations and Deleting Data

Where supported, you can disconnect third-party integrations through the available account controls or the relevant integration commands.

Disconnecting an integration stops future access when the disconnection or revocation process succeeds. It does not necessarily delete content already imported into Onetab AI or copies retained by the third-party provider.

You may submit a separate deletion request for applicable data. Deletion is subject to verification, legal requirements and the retention practices described in this Policy.

19. Policy Revisions and Publication

We may update this Policy as our products, processing practices, service providers or legal obligations change.

The updated version will be published on our website with a revised date. Where required by applicable law, we will provide notice of material changes or obtain consent where necessary.

We encourage you to review this Policy periodically.

20. Contact

For privacy questions, access requests, export requests, deletion requests or other data protection matters, contact our Data Privacy Officer:

Email: kashishpatel@onetab.ai

Address: Data Privacy Office, 6th Floor, Crystal IT Park, Indore, Madhya Pradesh, India

Phone: +91 9619363677

Organization: Onetab AI Corporation

For Onetab People support, you may also contact hello@onetab.ai.