Privacy policy

OneHappening is operated by [Legal entity name, business ID and registered address] (“we”, “us”). We are the controller of the personal data described in this policy. You can reach us about anything on this page at privacy@in.onehappening.com.

Where you forward third parties' email into OneHappening, you act as the controller of that content and we process it on your behalf.

Account data

Your email address, and — if you sign in with Google — your name and profile picture as provided by Google. Sign-in codes sent by email are stored hashed and expire after ten minutes. If you sign in with Google we store the OAuth tokens Google issues so the sign-in works.

Event data

The event name, date and optional description you enter, and the unique inbound address we generate for it (for example your-event-a7k3@in.onehappening.com).

Email you send to an event address

For each message: sender name and address, recipients (To and Cc), subject, the plain text and HTML bodies, the Message-ID and In-Reply-To headers, and the time it was received. Attachments are stored as files, together with their file name, type and size. This content is whatever you chose to forward, so it may include contracts, invoices, names and contact details of third parties.

Data derived by AI

A short summary, a category, and where present the company, monetary amount, currency, deadline and people mentioned. From these we create action items and a contact list for the event.

Product usage

A small set of events recording how the product is used — for example that an event was created, that a first email arrived, or that the upgrade button was clicked. These are stored in our own database, not sent to a third-party analytics service. If you submit the upgrade interest form we store the email address, plan and note you provide, and email them to our support mailbox.

On our public pages we also use Google Analytics 4 to understand how visitors find us and whether they go on to create an event. Google receives the usual web measurement data — page address and title, referrer, approximate location derived from IP, device and browser. It is not loaded inside the signed-in application, so it never sees your event names, message contents, attachments or contacts.

Technical data

Server logs may contain IP addresses and request metadata, which we use to operate and secure the service. We use IP addresses in memory to rate-limit sign-in and public endpoints; those counters are not stored in the database.

We use your data to run the service you asked for: receiving email at your event address, extracting the useful parts of it, showing you your dashboard and inbox, and answering questions you ask about that event. We use account data to sign you in and contact you about the service, and usage data to understand whether the product works.

Under the GDPR, our legal bases are performance of a contract with you (running the service), our legitimate interests (keeping the service secure and understanding how it is used), and your consent where you have given it.

We do not:

• — sell or rent your data, or share it for advertising;
• — use your event content to train AI models, or allow our providers to;
• — read or sync your mailbox — we only receive what you forward or CC;
• — send email on your behalf.

We share data only with the providers we need to run the service. They act on our instructions under data processing agreements.

OpenAI processes the text we send through its API. Under OpenAI's API terms, data submitted through the API is not used to train its models. Attachment files are never sent for analysis — we do not read inside documents — although the file name is included so the summary can mention it.

We may also disclose data if the law requires it, or to protect our rights or the safety of others.

Data is stored in Google Cloud. Our providers operate globally, so your data may be transferred outside the EEA; where that happens, transfers rely on the European Commission's standard contractual clauses or an equivalent safeguard.

• — Every request is authorized on the server against the signed-in account, so you can only ever reach your own events.
• — Inbound email webhooks are cryptographically verified before anything is stored.
• — Attachment files are kept in a private bucket and served only through short-lived signed links, after an ownership check.
• — Email HTML is sanitized and rendered in an isolated frame with scripts disabled, and remote images are stripped — so viewing a message cannot run code or tell the sender you opened it.
• — Sign-in codes are stored hashed, expire after ten minutes, and sign-in endpoints are rate-limited.

No service can promise perfect security, but we would rather tell you exactly what we do than make a vague assurance.

We keep your event data for as long as your account exists, because the point of the product is that you can come back to it later.

Deleting an event permanently removes its messages, attachments, actions and contacts, and deletes the stored attachment files. Deleting your account does the same for every event you own, and removes your account and sign-in details. Product usage records are unlinked from you and kept only as anonymous counts. Deletion is immediate and cannot be undone; backups, if any are held by our infrastructure providers, age out on their own schedule.

Inside the signed-in application we set only the cookies needed to sign you in and keep your session secure.

On our public pages — the landing page, sign-in and these legal pages — Google Analytics sets its own cookies (names beginning _ga) to count visits and returning visitors. We have turned off Google's advertising features, so no advertising cookies are set, no advertising profile is built, and nothing is shared for remarketing. Google Analytics is not loaded anywhere inside the signed-in application.

If you are in the EEA or the UK you have the right to access, correct, delete, export or restrict the processing of your personal data, and to object to processing based on legitimate interests. You can delete your events and your entire account yourself from the Account page at any time. For anything else, email privacy@in.onehappening.com and we will respond within 30 days.

If you believe we have handled your data improperly, you may complain to your local data protection authority.

If you are the sender or subject of an email that someone else forwarded into OneHappening and you want it removed, contact us and we will pass the request to the account holder who controls that event, or act on it directly where we are required to.

OneHappening is a tool for people organizing events professionally. It is not directed at children, and we do not knowingly collect data from anyone under 16.

If we change how we handle your data we will update this page and change the date at the top. For significant changes we will tell you by email before they take effect.