OneSystem CRM

Privacy Policy

Last updated: October 10, 2026

Your trust matters to us. This policy explains what information OneSystem collects, why, who we share it with and the choices you have. It covers our website, the OneSystem app, the OneSystem WordPress plugin, our connectors for Claude and ChatGPT, and our free website health check. If anything here is unclear, email us at support@onesystemcrm.com.

1. Two kinds of information

Your account information. Information about you and your business as our customer: your name, email, business name, login details, billing details and how you use OneSystem. We decide how this is used, and this policy explains how.

Your customers’ information. The contacts, leads, messages, bookings, invoices and other records you keep in OneSystem about your own customers. You decide what goes in and how it’s used; we store and process it only to run the service for you, following your instructions. If you’re one of our customers’ customers and have a question about your data, please contact that business directly — we’ll help them answer you.

2. What we collect

  • Account details: name, email, password (stored only as a secure hash), business name and city, team members you add, and your settings.
  • Billing: your plan and payment status. Card details are entered on Stripe’s secure pages and handled by Stripe — we never see or store full card numbers.
  • Your website: when you connect WordPress, the plugin shares page content (text, images, links, SEO titles), design settings, your WordPress menus (when you ask for a menu change), the list of active plugins and basic site details, so OneSystem can show and change what you ask for. We keep the before/after of each change so it can be undone.
  • Content you add: contacts and leads (including form submissions from your website), messages, notes, files and images, calendars and bookings, invoices, campaigns and social posts.
  • Connected accounts: if you connect Google, Microsoft, Facebook/Instagram, LinkedIn, Stripe, Square, Twilio or an email service, we store the access details they give us (encrypted) and the data needed for the features you use. If a business turns on Facebook/Instagram messages, messages people send to its Page or Instagram account (and their public name) are stored in that business’s Conversations; with comments turned on, comments on its posts (and the commenter’s public name) are stored so the business can answer them.
  • Usage and device information: sign-in times, IP address, browser type and actions in the app, used for security, troubleshooting and improving OneSystem.
  • Support: what you send us when you ask for help, including the conversation context you choose to share with “Ask our team”.
  • Shield File check: if a site administrator allows it in WordPress, the plugin compares the website’s files with WordPress.org’s official copies and sends us the names of files that differ or look unusual (with the WordPress folder as the starting point), what was found, and the username and date of administrators added in the last 7 days — never what is inside a file.
  • Shield text alerts: if an admin asks OneSystem Shield to text them about their website, the mobile number they enter, when they agreed, and the alerts we sent (see Shield text alerts).
  • Free website health check: the website address, your email and name (if given), whether you’d like tips by email, and the results of the check.

3. How we use it

  • to provide OneSystem: run your account, make the website changes you approve, send the messages you send, take bookings and payments, and show reports;
  • to keep accounts and websites secure, prevent abuse and fix problems;
  • to send service emails, like sign-in codes, password resets, alerts, receipts and important notices;
  • to reply when you contact us, and — if you agreed — to send occasional tips and news you can unsubscribe from anytime;
  • to understand how OneSystem is used so we can improve it, using aggregated information where we can;
  • to meet legal obligations, such as keeping billing records.

We don’t sell your personal information, and we don’t use your customers’ information for our own marketing.

4. AI

When you use AI features, the relevant content (for example your request and the parts of your website or conversation needed to answer it — with SEO Autopilot also your website’s images that have no description yet, so the AI can describe them) is sent to our AI provider, Anthropic, to generate a response. Under the terms we use, Anthropic doesn’t use this content to train its models. If you connect your own AI key, that provider’s terms apply to those requests. Please don’t paste passwords, card numbers or health information into AI chats.

To make the website assistant better for everyone, people at OneSystem may look at requests that didn’t go as expected — for example when a change was cancelled, undone or passed to our team — together with what happened next and any reason you chose. What we keep as lessons is written without your business’s name, website or contact details, and without your customers’ information.

5. Who we share information with

We share information only with service providers that help us run OneSystem, and only what they need:

  • Hosting and infrastructure: the servers OneSystem runs on, and Cloudflare for customer domains when you use one;
  • Payments: Stripe, for OneSystem subscriptions;
  • AI: Anthropic;
  • Phone numbers and texts: Telnyx, for the numbers and text messages a business uses through OneSystem Phone and for OneSystem Shield’s alert texts (phone numbers and message content), and the US carriers’ registry (The Campaign Registry) for the business details a business submits to register for texting;
  • Email: our email providers — for account and notification emails, and Microsoft (Azure Communication Services) — or Amazon Web Services (Amazon SES) when we use it — for the emails a business sends to its contacts through OneSystem Email (the recipient’s address and the message);
  • Keyword data: DataForSEO receives the search phrases and competitor website addresses a business looks up in SEO → Research (no personal data);
  • Website checks: Google Web Risk (Google’s Safe Browsing lists) and Google PageSpeed Insights receive the addresses of websites being checked;
  • Services you connect: Google (including Gmail, for sending your emails when you connect it — OneSystem only asks to send, never to read your mailbox), Microsoft, Meta (Facebook, Instagram and WhatsApp — WhatsApp messages between a business and its customers are stored in that business’s Conversations), LinkedIn, Stripe, Square, Twilio, Mailgun, Postmark or your SMTP server — when you connect them and use the related features.

Text messaging: mobile phone numbers and text-message consent are never shared with or sold to third parties or affiliates for their marketing or promotional purposes. They are shared only with the providers that deliver the messages.

We may also share information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business (in which case this policy would continue to protect your information).

6. Google user data

If you connect a Google account (for “Continue with Google” sign-in, Google Calendar or Google Search Console), we use the data Google shares only to provide those features: your name, email and profile picture to sign you in, and your calendar availability and events to show busy times and add bookings to your calendar, and Search Console numbers (searches, clicks, impressions and positions for your website, and whether Google has indexed your pages) to show your SEO reports and, with SEO Autopilot, keyword tracking — and, when you allow it, submitting your website’s sitemap to Google after you approve a change (nothing else in your Search Console is changed); and, if you connect Google Business Profile, your business locations, reviews (to show them and post your replies), the posts you publish and your profile’s performance numbers. OneSystem’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google user data for advertising, we don’t sell it, we don’t use it to train AI models, and people at OneSystem don’t read it unless you ask us to for support, it’s needed for security, or the law requires it. You can disconnect Google at any time in OneSystem or in your Google account settings.

7. Cookies and similar technologies

We keep cookies to a minimum and don’t use advertising cookies in the OneSystem app.

  • Sign-in: a cookie that keeps you signed in (onesystem_session), and short-lived cookies used during “Continue with Google”.
  • Websites built with OneSystem: a first-party cookie (os_v) that counts visits and form submissions for the business’s own reports. If a business adds a Facebook Pixel or Google tag to its pages, those companies’ cookies apply too.
  • Chat widget: the visitor’s browser remembers their chat so they can continue the conversation.

8. How long we keep information

We keep your information while your account is open. If your account becomes read-only (for example when a trial ends), we keep your data so you can come back to it — we don’t delete it automatically. When you delete your account, we delete your account data and your customers’ data from our live systems; copies in backups are overwritten in the normal backup cycle. We keep billing records for as long as the law requires. Uptime check details are kept for 90 days, and health check results for as long as they’re useful to share the report.

9. Security

We protect information with encryption in transit (HTTPS), encrypted storage of keys and access tokens, signed requests between OneSystem and your WordPress site, rate limits, and access limited to people who need it. No system is perfectly secure, so please use a strong, unique password and tell us right away if you notice anything unusual.

10. Your choices and rights

  • See and update your details in Settings, and export your data.
  • Delete your account and data at any time in Settings.
  • Unsubscribe from tips and news with the link in any of those emails.
  • Disconnect any connected service whenever you like.
  • Ask us for a copy of your personal information, to correct it, or to delete it, by emailing support@onesystemcrm.com.

Depending on where you live, you may have extra rights under local privacy laws, and you can contact your local data protection authority. We’ll respond to requests within 30 days.

11. Children

OneSystem is a business tool and isn’t meant for anyone under 18. We don’t knowingly collect information from children.

12. Sensitive information

OneSystem isn’t designed for health records, payment card numbers, government ID numbers or similar sensitive information, and it isn’t certified for regulated data of that kind. Please don’t collect or store it in forms, chats or notes.

13. International transfers

Our servers and service providers may be located in different countries from you. When information moves between countries, we rely on our providers’ safeguards and standard contractual protections.

14. Changes to this policy

We’ll update this policy as OneSystem changes. If we make significant changes, we’ll let you know by email or in the app before they take effect. The date at the top shows when it was last updated. See also our Terms of Service.

15. Contact us

Questions, requests or concerns about privacy? Email support@onesystemcrm.com. We’re happy to help.