Privacy policy

OfficOne (“we”, “us”) is business software for sales, a shared inbox, marketing, social media, support, billing, accounting and automation. It is a product of Tecnior Technology Private Limited, which operates it, B 703, Tower-3, NX One, Plot No. 17, Techzone-4, Greater Noida, Uttar Pradesh 201306, India.

This policy covers the website at https://officone.com, the OfficOne web app on its subdomains and custom domains, the OfficOne mobile app, and the public pages workspaces publish through it (forms, booking pages, approval links, link-in-bio pages and customer portals).

There are two kinds of data. Account data is about you as a user of OfficOne; we decide how it is used and we are responsible for it. Workspace data is what a business puts into its workspace — its contacts, conversations, invoices and connected social accounts. For workspace data the business is in charge (the “data fiduciary” or “controller”) and we process it only on its instructions to run the service. If you are a customer of a business that uses OfficOne, contact that business first about your data.

• Account details: name, email address, phone number, password (stored only as a bcrypt hash), two-step sign-in secrets (encrypted), role and workspace.
• Business details: company name, address, GSTIN and billing contacts you give us when you subscribe.
• Workspace content: whatever your team adds or connects — contacts, deals, messages, emails, files, invoices, tickets, posts and reports.
• Connected accounts: when you connect a mailbox, WhatsApp, a payment gateway or a social network, the access tokens or credentials needed to act on your behalf (encrypted with AES-256-GCM) and the data those services return. See section 4.
• Usage and device data: sign-in times, IP address, browser and device type, paired mobile devices, and an audit log of important actions.
• Payment data: payments are processed by our payment providers (for example Razorpay or Stripe). We receive the payment status and reference, never your full card number.
• Messages to us: what you send through the contact form, email or support chat.

• To provide the service: sign you in, store and show your workspace, send and receive the messages and posts you ask us to, and run the automations you set up.
• To keep it secure: detect abuse, enforce sign-in rules, keep audit logs and investigate incidents.
• To bill you and send invoices, receipts and account notices.
• To provide support when you ask for it. Staff can open a workspace only with a stated reason, for one hour at a time, and it is written to that workspace's audit log.
• To improve the product using aggregated, non-identifying usage information.
• To meet legal obligations such as tax records.

We do not sell personal data, we do not use workspace data to advertise to you, and we do not use workspace data or data from connected accounts to train AI models.

The Social module lets a workspace connect accounts on Facebook, Instagram, Threads, LinkedIn, YouTube, Google Business Profile, TikTok, Pinterest, X, Meta Ads, Google Ads, TikTok Ads, Canva, Google Analytics, Google Search Console, Google Tag Manager and Google Merchant Center. A connection is made only when an authorised member of the workspace signs in to that network and grants access. With that access OfficOne:

• reads profile details (name, picture, handle), the list of pages, channels, locations, boards or ad accounts you choose to connect;
• publishes the posts, videos, stories and replies your team schedules or sends;
• reads post and account statistics (reach, views, followers, engagement) to show analytics and reports;
• reads comments, reviews and direct messages so your team can answer them from the inbox, and sends the replies they write;
• reads ad campaign results to show spend and results next to your leads and deals;
• imports designs you pick from Canva into your media library.

This data is used only to show it to the workspace that connected it and to carry out that workspace's instructions. It is not shared with other workspaces, not sold, and not used for advertising. Tokens are encrypted at rest. Statistics are refreshed periodically and kept while the account stays connected.

Disconnecting: removing an account in Social → Settings deletes its token and the history stored for it. You can also revoke access from the network itself, for example Facebook Business Integrations, Google account permissions, LinkedIn permitted services or the TikTok and Pinterest app settings. See also our data deletion page.

Google user data. OfficOne's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you see in OfficOne; we do not let humans read it except with your consent, for security, or to comply with law, and we do not use it for advertising.

YouTube. OfficOne uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke our access at any time from your Google security settings.

If your workspace uses the AI writer, the brief, the draft text and your brand voice instructions are sent to our AI provider (Anthropic) to generate a suggestion. Nothing is sent unless someone in your team asks for it. Our provider processes this data to return the result and does not use it to train its models under our commercial terms. Always review AI suggestions before publishing.

We share data only with service providers who help us run OfficOne, under contracts that limit their use of it:

• hosting and storage providers that run our servers and backups;
• email delivery providers for sign-in codes, notifications and the emails you send;
• payment providers (Razorpay, Stripe) for subscription payments;
• the networks and services you connect yourself (Meta, Google, LinkedIn, TikTok, Pinterest, X, Canva, WhatsApp, your mailbox provider) — data goes to them only when you ask us to post, reply or send;
• our AI provider, only when the AI features are used.

We may disclose data when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business, in which case this policy continues to apply.

• Workspace data is kept while the workspace is active. Admins choose how long activity history is kept (90 days to 10 years, or always).
• When an owner deletes a workspace there is a 30-day window to restore it; after that it is deleted with everything in it, and removed from backups as they roll over.
• Data from a disconnected social account is deleted when it is disconnected.
• Invoices and payment records are kept for as long as tax law requires (in India, generally 8 years).
• Security logs are kept for up to one year.

Each workspace is isolated, connections use HTTPS, passwords are hashed with bcrypt and secrets are encrypted with AES-256-GCM. Admins can require two-step sign-in, restrict sign-in to IP ranges and review an audit log. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the authorities as the law requires. More detail is on our security page.

Depending on where you live — including under India's Digital Personal Data Protection Act, 2023 and the EU/UK GDPR — you can ask to access your data, correct it, delete it, receive a copy, withdraw consent, object to some uses, or nominate someone to act for you. Workspace admins can export everything and erase a person themselves in Settings → Privacy.

To use your rights about your own account, write to [email protected]. We reply within 30 days. If you are not satisfied you may complain to the Data Protection Board of India or your local data protection authority.

OfficOne is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.

Our servers are located in India. Some service providers may process data in other countries; where they do, we rely on contracts with appropriate safeguards.

If we change this policy we will update the date above, and tell workspace owners by email before a significant change takes effect.

Grievance Officer: Tecnior Technology Private Limited, B 703, Tower-3, NX One, Plot No. 17, Techzone-4, Greater Noida, Uttar Pradesh 201306, India (registered office: Block WE, Mohan Garden, Razapur Khurd, New Delhi, Delhi 110059, India) — [email protected]. We acknowledge complaints within 24 hours and resolve them within 15 days.