1. Who is responsible
Bray Caswell trading as Caswell Labs, of 61 Bridge Street, Kington, HR5 3DJ, United Kingdom, is the controller for account administration, billing, service security, support and our own business operations. Contact [email protected].
For personal data contained in projects or supplied by a workspace customer about clients and reviewers, the workspace customer is normally the controller and OneNod acts as its processor. Requests about that data should usually be directed to the workspace that invited you; we will assist it as required.
2. Personal data we collect
- account and team data: name, email, password hash, email-verification status, workspace, role, settings, logo and invitation details;
- client and reviewer data: names, email addresses, invitation status and secure-link activity;
- project content: project names, files, links, versions, deadlines, comments, coordinates, change requests, approval statements and audit references;
- decision evidence: time, relevant version, browser or device information and a cryptographic hash derived from the network address;
- billing data: Stripe customer, subscription, price, status and billing-period identifiers; OneNod does not receive full card details;
- communications: support requests, transactional-email delivery records and messages sent to us;
- technical data: authentication sessions, hashed one-time verification and recovery tokens, hashed network identifiers used for abuse prevention, security events, server logs, error details, custom-domain status and basic device or browser information.
3. How data is obtained
We receive data directly from account holders and reviewers; from workspace owners who add team members, clients or reviewers; automatically when the service is used; and from providers such as Stripe, Cloudflare and Resend when they report subscription, domain or delivery status.
If a customer gives us another person’s data, it must provide any required privacy information and have a lawful basis for doing so.
4. Purposes and lawful bases
- performing our contract: creating and administering accounts, providing projects, uploads, reviews, approvals, teams, branding, subscriptions and support;
- legitimate interests: securing and monitoring the service, preventing misuse, maintaining an attributable audit trail, improving reliability, responding to business enquiries and defending legal claims; these interests are balanced against individual rights;
- legal obligation: tax, accounting, fraud prevention, regulatory responses, court orders and data-protection duties;
- consent: only where we specifically ask for it, such as any future optional non-essential cookies or electronic marketing. Consent can be withdrawn without affecting earlier lawful processing.
5. Workspace owners, reviewers and visibility
Workspace owners and authorised members can see the people, projects, comments and decisions within their workspace according to their roles. Reviewers can access only projects shared through their secure links, although anyone who receives a link from the intended reviewer may be able to use it.
Approval records are visible to authorised workspace members and the relevant reviewer. We do not sell personal data or use Customer Content for advertising.
6. Providers and other disclosures
- infrastructure and hosting providers that run the application and database;
- Cloudflare for object storage, delivery, DNS, security and customer custom domains;
- Stripe and its Link service for checkout, payments, tax-related checkout functions, subscriptions and the customer portal;
- Resend and underlying email-delivery infrastructure for invitations, reminders, notifications, support and monitoring alerts;
- professional advisers, insurers, auditors, regulators, courts, law enforcement, prospective purchasers or successors where lawfully required or reasonably necessary;
- a workspace customer where we act on its instructions or assist with an individual-rights request.
7. International transfers
Some providers may process personal data outside the UK. Where UK adequacy regulations do not apply, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another legally permitted mechanism, together with supplementary security measures where appropriate.
Contact us for further information about the safeguard relevant to your data.
8. Retention and deletion
- account and workspace data: for the account term. An owner can schedule deletion in Settings after confirming their password; deletion normally occurs after a seven-day cancellation window, subject to the exceptions below;
- Customer Content and project records: as instructed by the workspace owner and deleted with the workspace after the seven-day cancellation window;
- approval and security records: while the related workspace remains active and afterwards where reasonably needed to establish, exercise or defend legal claims;
- expired or used verification, recovery and rate-limit records: retained only for a short operational and security period before routine deletion;
- billing and transaction records: generally six years after the relevant financial year or longer where law requires;
- support and email-delivery records: for a proportionate period based on the enquiry, delivery troubleshooting and legal-claims risk;
- local database backups: up to seven days; encrypted off-site database backups: up to 30 days, after which they are overwritten or deleted in the ordinary rotation;
- data may be retained longer where required by law, a dispute, fraud prevention, security investigation, or a valid preservation request.
9. Cookies and device storage
OneNod uses a strictly necessary, secure, HTTP-only browser-session cookie to authenticate signed-in users. It expires when the browser session ends; the associated server session can remain valid for up to 30 days unless you sign out sooner.
We use local browser storage to remember the light or dark theme selected on that device. We currently do not use advertising, behavioural-tracking or non-essential analytics cookies. If that changes, we will update this notice and request consent before setting non-essential technologies where required.
10. Security
Measures include HTTPS in transit, salted password hashing, hashed and encrypted secure-link tokens, role-based access controls, signed file access, restricted infrastructure credentials, monitoring, checksummed backups and tested restoration procedures.
No method is risk-free. Account holders should use unique passwords, protect review links and promptly report suspected incidents to [email protected].
11. Your data-protection rights
- receive information about processing and obtain a copy of your personal data;
- correct inaccurate or incomplete data;
- request deletion or restriction;
- receive data you provided in a portable format where the right applies;
- object to processing based on legitimate interests and object absolutely to direct marketing;
- withdraw consent at any time where processing relies on consent;
- not be subject to a solely automated decision producing legal or similarly significant effects. OneNod does not currently make such decisions.
12. Exercising rights and complaints
Email [email protected]. We may need to verify your identity and determine whether OneNod or the relevant workspace customer is responsible. We normally respond within one month, subject to lawful extensions.
You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Please contact us first if you are comfortable doing so.
13. Children and sensitive information
OneNod is a business service for adults and is not directed to children. Do not create an account if you are under 18.
The service is not designed for special-category data, criminal-offence data, medical records or similarly sensitive regulated content. Customers must not upload such material without prior written agreement and all required safeguards.
14. Changes to this notice
We may update this notice as the service, providers or law changes. We will post the revised notice here and change the effective date. Material changes affecting account holders will be communicated through the service or by email where appropriate.
This notice describes the service as it operates on the effective date; it does not authorise unrelated future processing.
Contact us at [email protected]. We’ll respond as soon as reasonably possible.