Effective date: 29 September 2026
This policy explains what personal data Onekey ("Onekey") handles, why, and what rights you have. It covers the Onekey website, dashboard and API. It is written to meet the EU/UK GDPR, India's Digital Personal Data Protection Act 2023 (DPDP Act) and the basics of the California Consumer Privacy Act (CCPA).
Contact: hello@onekey.dev. Grievance Officer / Data Protection contact: [GRIEVANCE OFFICER]. Address: [REGISTERED ADDRESS].
1. Two kinds of data
- Customer data: information about you, the person or company using Onekey. For this, Onekey is the controller (GDPR) / data fiduciary (DPDP).
- Public data returned by the API: information from public platforms, which may include personal data about people who are not our customers. See section 5 and the Public Data Notice.
2. Customer data we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account email | Create and secure your account, send service and billing notices | Contract |
| Password (stored only as a salted hash) | Log you in | Contract |
| API keys (stored only as hashes; the full key is shown once) | Authenticate requests | Contract |
| Request logs: endpoint, time, status, credits used, key ID. We do not log request or response payloads that contain personal data. | Billing, abuse prevention, debugging, reliability stats | Contract, legitimate interests |
| IP address and basic device data | Security, rate limiting, fraud prevention | Legitimate interests |
| Billing records (order ID, amount, country, tax data). Card details are handled by the payment provider, not by us. | Payments, tax and legal duties | Contract, legal obligation |
| Messages you send us | Support | Contract, legitimate interests |
We do not sell personal data and do not use it for advertising.
3. Retention
- Account data: while your account is open, then deleted or anonymised within [30] days of closure, except where we must keep it by law.
- Request logs: [90] days, then deleted or aggregated.
- Security logs including IP: [30] days.
- Billing and tax records: [8] years or as required by Indian tax law.
- Backups roll off within [35] days.
4. Sub-processors
We use these providers. Names and locations will be confirmed before launch.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, storage | [AWS REGION] |
| Cloudflare (or other CDN) | CDN, DNS, DDoS protection | Global |
| Our payment provider | Payments, invoicing, tax (merchant of record where applicable) | [LOCATION] |
| [Third-party fetching services] | Fetching public pages on our behalf. They see the target URL, not your account data | [LOCATION] |
| [Amazon SES / Resend] | Transactional email | [LOCATION] |
| [Error monitoring vendor] | Crash and error reports (scrubbed of payloads) | [LOCATION] |
We will update this list before adding a new sub-processor. Customers who have signed our DPA get advance notice.
5. Personal data in API responses
Onekey returns data that platforms make public, such as profile names, handles, posts and counts. We collect this indirectly from those sources, not from the people concerned. We may cache it for a short period to serve repeated requests faster and cheaper. We do not build profiles of individuals for our own purposes.
- Basis: legitimate interests (GDPR); for India, the DPDP Act's carve-out for personal data that the individual has made publicly available, subject to counsel review.
- Individuals' rights: anyone can ask us to remove or stop returning data about them through the takedown form. We aim to act within [7] days.
- Cache retention: cached items are kept for at most [DURATION] and are purged on a valid takedown.
- For customers who receive such data, we act as a processor under the DPA for data they choose to store, and you are the controller of your own use.
6. International transfers
Onekey is run from India and hosted on AWS in [AWS REGION]. Data may be processed in other countries by our sub-processors. For transfers from the EEA, UK or Switzerland we rely on Standard Contractual Clauses (see the DPA) or another lawful mechanism. Under the DPDP Act, transfers abroad are allowed except to countries the Indian Government restricts.
7. Your rights
Depending on where you live you can ask us to:
- access your data and get a copy;
- correct it;
- delete it (erasure);
- restrict or object to processing;
- move it to another service (portability);
- withdraw consent where we rely on consent;
- for DPDP: nominate someone to act for you and use our grievance process;
- for California: know, delete, correct, and opt out of "sale" or "sharing". We do not sell or share personal data as those terms are defined.
Email hello@onekey.dev. We respond within one month (GDPR), or as the DPDP Rules require. We will not discriminate against you for using your rights. You can also complain to your data protection authority, or to the Data Protection Board of India after using our grievance process first.
8. Security
Passwords and API keys are hashed. Traffic uses TLS. Access to production is restricted and logged. No system is perfectly secure, so we also keep breach procedures: we notify affected customers and regulators as required by law (see the DPA for 72-hour terms).
9. Children
Onekey is not for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us data, contact hello@onekey.dev and we will delete it. Public data may include information about minors posted by platforms; use the takedown form for urgent removal.
10. Cookies
We use only essential and preference cookies. See the Cookie Policy.
11. Changes
We will post changes here and update the effective date. For material changes we will notify account holders.
12. Grievance Officer
[GRIEVANCE OFFICER], hello@onekey.dev, [REGISTERED ADDRESS]. We acknowledge complaints within [48 hours] and resolve them within [30] days.