Introduction

Onesync, a service from Sev Nordic AB (company reg. no. 559595-6052), respects your privacy and protects your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable data protection law. In this policy "we", "us" and "our" mean Sev Nordic AB. It explains how we collect, use, store and protect information when you use our platform as a business.

By using Onesync you accept the terms of this privacy policy.

Data controller

Company: Sev Nordic AB

Company registration number: 559595-6052

Email: info@onesync.se

The personal data we collect

1. Information you give us directly

OneSync AI guide: We save your name, email, company, questions, replies and requests for human help in our protected admin inbox to follow up on your enquiry. Contact details are also sent to info@onesync.se. Authorized administrators can read the conversation and reply. Team replies are also sent to the email address you provide. Enquiries are deleted after 180 days without activity. Questions and recent messages are processed by the configured AI provider (Amazon Bedrock/AWS, Anthropic or OpenRouter). Contact-form fields are not included in model requests. Conversation text and contact details are not sent to analytics. Interest labels based on what you type help our team sort enquiries; they do not make automatic decisions about you. A necessary cookie grants access to your conversation for two hours.
Account details: Name, email address, password (encrypted via Supabase Auth)
Business information: Business name, address, phone number, opening hours, logo
Business data: Menu information, prices, offers, lunch menus, images
Social media: OAuth tokens when connecting Facebook, Instagram, TikTok or Google Business Profile (encrypted with AES-256-GCM)

2. Information we collect automatically

Device information: IP address, browser, operating system
Usage data: Pages you visit, features you use
Cookies: See our cookie policy

How we use your data

Providing our services:

Creating and managing your business account
Managing menus, offers and lunch menus
Publishing content on connected social media platforms
Managing your Google Business Profile
AI generation of content based on your menu data

Analysis and improvement:

Analysing usage patterns in order to improve the service
Troubleshooting and technical support

Communication:

Sending transactional messages (account confirmations and the like)
Answering questions and support cases

Legal basis for processing

Under GDPR Article 6 our processing rests on the following grounds:

Performance of a contract (Art. 6(1)(b))

Creating and managing your business account
Providing the platform features (menu management, AI chat, social media)
Publishing content on connected platforms

Consent (Art. 6(1)(a))

Visit statistics for OneSync marketing pages: our own cookieless measurement and Google Analytics 4 with cookies, when enabled. Both require analytics consent.
Marketing cookies (Meta, Google) — prepared, none active today

You can withdraw your consent at any time through the cookie settings in the footer.

Legal obligation (Art. 6(1)(c))

Retention of transaction data under the Swedish Accounting Act (at least 7 years)
Compliance with consumer protection law

Legitimate interest (Art. 6(1)(f))

Improving and developing the service through analysis
Security measures and fraud prevention
Troubleshooting and technical support

Cookies

We use cookies to improve your experience. You can manage your cookie settings by clicking "Cookie" in the footer.

Necessary cookies (always on)

Required for sign-in, security and basic functionality.

Analytics and statistics (requires consent)

Our own cookieless visit statistics and Google Analytics 4 when enabled. Both start only after analytics consent and provide aggregate reports of visits and successful enquiries. Google uses cookies and pseudonymous browser identifiers and receives technical device and network information. We do not send form fields, names, emails, phone numbers, messages, URL query strings or fragments to Google. Google Signals, advertising and ad personalisation are disabled. Withdrawing consent stops measurement.

Marketing cookies (requires consent)

Prepared for future use. No marketing cookies are active at present.

Read our full cookie policy →

Social media integrations

When you connect your social media accounts we store:

Encrypted OAuth tokens: Access tokens are encrypted with AES-256-GCM before storage. We never have access to your password.
Account information: Page name and account ID, so we can publish to the right page or account.
Google Business Profile: Location name and account ID, to manage opening hours, reviews and photos.

You can disconnect your accounts at any time. On disconnection all stored tokens are deleted.

Google API Services and limited use

Onesync's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Requested OAuth scope and purpose:

https://www.googleapis.com/auth/business.manage

We request this scope in order to manage your Google Business Profile on your behalf. It allows us to:

Read and update the business profile (name, address, opening hours, categories)
Fetch and reply to customer reviews
Upload and manage photos
Publish posts and offers
Fetch statistics (views, searches, clicks, direction requests)

Limited use. We use data from Google APIs solely to provide the features described above. We do not use Google data to serve advertising, and we do not sell, rent or share Google data with third parties for advertising, data brokerage or any purpose beyond delivering our service.

Human access. Onesync staff may be granted read access to your Google Business Profile data only where it is required to give you technical support and you have asked for it, or where it is required by law. We do not read, copy, store or share your Google data beyond what is necessary to provide the service.

Revoking access. You can revoke Onesync's access to your Google Business Profile at any time via myaccount.google.com/permissions. We then delete all stored tokens immediately.

AI features

Our platform uses AI to:

Generate and improve content using business information
Answer customer questions using business information and relevant conversation history
Generate images through OpenRouter

Customer conversations and configured content language models default to Amazon Bedrock inside the EU. Guest chat uses Frankfurt; configured EU profiles may process data in Frankfurt, Stockholm, Milan, Spain, Ireland and Paris. What a customer writes, including names or phone numbers, and relevant conversation history is sent to the model. This also applies to WhatsApp conversations when that support channel is enabled. Direct Anthropic, OpenAI or OpenRouter adapters may be used where configured; image generation and AI visibility analysis use OpenRouter. We do not use conversation content to train models. Provider processing and any abuse-review retention follow applicable terms; we do not promise universal zero retention.

Your rights under the GDPR

Right of access: You can request a copy of all personal data we hold about you.

Right to rectification: You can update or correct inaccurate data.

Right to erasure: You can ask us to delete your personal data (the "right to be forgotten").

Right to restriction: You can ask us to restrict the processing.

Right to data portability: You can receive your data in a machine-readable format.

Right to object: You can object to certain processing, for example direct marketing.

How to exercise your rights:

Contact us at info@onesync.se
Describe which right you want to exercise
We reply within 30 days

Have you written to a business through its website chat or an enabled WhatsApp channel and want the conversation deleted? This is explained under Delete your data.

The providers that process data on our behalf are listed under Sub-processors, which also states where the processing happens.

The terms on which we process data on a customer’s behalf are set out in our data processing agreement, published in full.

Right to lodge a complaint

If you believe we are processing your personal data incorrectly, you have the right to complain to:

The Swedish Authority for Privacy Protection (IMY)

Box 8114, 104 20 Stockholm, Sweden

Phone: +46 8 657 61 00

Email: imy@imy.se

Web: www.imy.se

Data security

HTTPS/TLS encryption for all data traffic
AES-256-GCM encryption for all stored OAuth tokens
Row Level Security (RLS) in the database
Supabase hosting inside the EU (Stockholm, Sweden)
Regular security reviews

Retention periods

Customer conversations and delivery evidence

Ordinary conversations become eligible for daily cleanup after 90 days without activity. Unresolved external delivery or transcript repair can delay deletion of related data. Minimal linkable operational evidence may remain until the business data is deleted.

Account details

Until you delete your account or request erasure.

Business data (menus, images, and so on)

Until you delete them or close your account.

Transaction data

At least 7 years, under the Swedish Accounting Act.

OAuth tokens (social media)

Until you disconnect the account. Deleted immediately on disconnection.

Our own visit statistics

Kept until further notice in anonymised form. The IP address is stored only as a hash with a salt that changes every day, so a visitor cannot be recognised the following day. No user agent is stored — only whether the visit came from a phone, a tablet or a computer.

Google Analytics 4

User- and event-data retention is currently set to 2 months in Google Analytics. Aggregate standard reports may remain available longer. Cookie lifetimes are described in the cookie policy.

Third-party providers

Supabase Inc.

Database and authentication. Stockholm, Sweden.

Vercel Inc.

Web hosting, configured for Frankfurt.

Amazon Web Services EMEA SARL

Text models through Amazon Bedrock inside the EU; Frankfurt and configured EU profiles.

Anthropic PBC · OpenAI, L.L.C.

Direct text models where configured. United States.

OpenRouter, Inc.

Image generation, AI visibility analysis and direct model alternatives where configured. United States.

Meta Platforms Ireland Limited

WhatsApp customer support where enabled and connected. Ireland and United States.

Resend

Email delivery.

Google Analytics 4 (Google)

Optional analysis of visits and successful enquiries on OneSync marketing pages, only after analytics consent. Data may be processed outside the EU/EEA, including in the United States. No customer data from business websites or signed-in workspaces is sent to this analytics property.

Transfers outside the EU/EEA

Some providers process data outside the EU/EEA. Their locations and purposes are listed on the subprocessor page. Contact us for the agreements and transfer arrangements applicable to your processing.

Contact us

Questions about privacy, or about how we handle your data?

Company: Sev Nordic AB (company reg. no. 559595-6052)