Privacy on this website

• Calendar: one scope, and what it reads

  https://www.googleapis.com/auth/calendar.events, and nothing else. From it we read the events in the date range on screen, capped at 45 days per request: title, start and end time, location, description, and whether the event is all-day. We do not access your contacts, files, other calendars or calendar settings. Signing in with Google uses only openid, email and profile.

• Calendar: what it is used for

  To show your existing appointments beside your OneCounsel deadlines in one calendar view, to remind you before a meeting starts, and to write your OneCounsel deadlines and case dates back to your calendar. Those are the only uses. It is never sold, never transferred to data brokers or advertisers, and never used for advertising.

• Calendar: event content is never stored

  Events are fetched from Google when you open the calendar and rendered to your screen. No copy is written to our database. The only rows we hold describe events OneCounsel itself created on your calendar, plus the connected calendar's email address, kept once so the page can name the account it is showing.

• Gmail: two scopes, and what they do

  https://www.googleapis.com/auth/gmail.modify and https://www.googleapis.com/auth/gmail.send. We read two folders and only two, your Inbox and your Sent mail; we never read Spam or Trash. We list the messages in them and read each one's sender, subject and date so we can display them. We read a message's full body and attachments when you open it to read, and when it is filed to a case. We send a message only when you have composed one and clicked Send.

• Gmail: the changes we make

  We remove labels, and nothing else. When you open a message in OneCounsel we mark it as read in Gmail, so the two agree about what you have seen instead of OneCounsel keeping a private idea of it. When you press Archive we archive it, which in Gmail means the message leaves your inbox and stays in All Mail. Both happen only because you did something that means them. We never add labels, never move mail into Trash, and never delete anything.

• Gmail: what it is used for

  To show your inbox inside OneCounsel so a message can be filed against the legal matter it belongs to, and to send case correspondence from your own address instead of the firm's case address when you choose that option. Those are the only uses. It is never sold, never transferred to data brokers or advertisers, and never used for advertising.

• Gmail: unfiled mail is never stored

  Your inbox is read from Google each time you open the page and then discarded. Only a message filed to a case is retained, in that case file. Filing happens when you file a message yourself, or, if you leave automatic filing switched on, when the sender's address matches a contact on exactly one open case. You can turn automatic filing off in Profile then Email.

• Tokens are encrypted and held apart

  OAuth access and refresh tokens live in AWS Secrets Manager, encrypted with AWS KMS, one entry per user per provider. Our database stores only a reference to them and never the tokens themselves. They are read by the service that calls Google and by nothing else.

• Encrypted in transit and at rest

  All traffic to Google and to us runs over TLS 1.3. Data at rest is encrypted with AES-256. The systems that hold it run in a private network with no public database endpoint, inside AWS in the United States.

• Who can reach it

  Access is governed by role-based permissions and evaluated on every request, with multi-factor authentication available on every account. Each firm's data is isolated at the database level by row-level security, so one firm's calendar connection is unreachable from another's session. Administrative access to the systems holding it goes through named single-sign-on accounts and is logged.

• Retention, and how to remove it

  Because event content and unfiled mail are never stored, there is nothing of yours to retain beyond the connection itself. Disconnect in Profile then Calendar, or Profile then Email: the tokens for that connection are deleted from Secrets Manager and our access ends immediately. The two are independent, so disconnecting one leaves the other working. You can also revoke access at myaccount.google.com/permissions. Events already written to your calendar stay there, as they are yours to keep or delete. A message already filed to a case stays on that case, because it forms part of the legal record of the matter.

• It never trains an AI model

  Google user data is never used, raw or derived, to develop, train, improve or evaluate any AI or machine-learning model, and is never transferred to a third party that would do so. OneCounsel's AI features run on Amazon Bedrock inside our own AWS account, in United States regions, serving Anthropic Claude, Amazon Titan Text Embeddings and Cohere Rerank; AWS does not use what we send there to train any model and does not share it with those providers. Calendar data reaches none of it: the assistant has no calendar tool and no calendar credential. Gmail is different and we say so plainly: a message you file to a case becomes part of that case file and is then handled like any other case correspondence, which includes Bedrock extracting text from its attachments and generating case insights. Mail you do not file is never processed, because it is never stored.

Limited Use: OneCounsel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. The same disclosures appear in the platform privacy policy at app.onecounsel.legal/legal/privacy.

• Two cookies, before you decide anything

  Analytics and advertising tags do not load until you choose. Before that the site sets two of its own: oc_consent, recording only your choice and its date, which is what stops us asking again on every page; and oc_attr, which records the page you arrived on, when, and any campaign tags in the link that brought you. It holds a random id for the visit, not for you, and no name, address or anything you type. It is how we can tell which page led to an enquiry, and it is never shared with anyone.

• What you type into the demo form

  Your name, work email, firm name and firm size, plus a phone number and message if you add them. It reaches our own systems on AWS so that someone can reply to you, and it is the only place on this site where an email address is recorded.

• Anti-spam checks

  The form uses hCaptcha, which processes technical signals about the request to tell a person from a bot. It runs on the form only, not across the site.

• Searches that find nothing

  A search on this site runs in your browser and is not sent anywhere. The one exception is a search that returns no results: the words are sent to us, with no id and unconnected to your visit, so we can see which questions the site fails to answer and write the missing page. Anything resembling an email address, a phone number or a long run of digits is stripped before it is stored, and the rest is deleted after 90 days.

• Analytics, if you accept them

  Google Analytics, Microsoft Clarity and PostHog. Clarity and PostHog record how pages are used; both are configured to mask text and form inputs rather than capture what you type.

• Amazon Web Services

  Hosts this site, delivers it, and holds the logs behind it - including what you submit through the demo form. Our own account, in the United States.

• Microsoft Teams

  Receives a copy of what you send through the demo form, so a person sees it rather than a queue nobody is watching. It gets the whole submission: your name, email, phone number, firm name, firm size, your message, and which page you sent it from. It is our own Microsoft tenancy, and the message lands in a channel our team reads.

• Sanity

  The content management system this site's words are stored in and served from. It holds our copy rather than anything about you.

• Sentry

  Records errors when something on this site breaks, so we find out before you have to tell us. It receives the technical detail of the failure - the page, the browser, the stack trace - and we do not send it your name, your email or anything you typed into a form.

• hCaptcha (Intuition Machines)

  Checks that a form submission came from a person. It runs on the demo form only and sees technical signals about that one request.

• Google Analytics, Microsoft Clarity, PostHog

  Measure how the site is used, and only once you accept analytics. Each is loaded separately and each can be absent - a vendor we have not finished configuring does not load at all.

• LinkedIn

  Measures whether a visit followed one of our ads, and only once you accept advertising. Accepting analytics does not accept this.

• Zoho

  Runs the chat window, which is how you reach a person from any page. It loads whatever you decide about analytics, because a site where declining measurement also removes the ability to ask a question has made a privacy choice cost something it should not.

• Zoho, as our CRM

  What you send through a form on this site reaches our CRM, which is part of the same Zoho account as the chat window. The record is created after your enquiry is stored, so whoever replies can see what you asked about. It holds what you typed into the form and how you reached us, and it is how we answer you.

• Analytics and advertising - your consent

  Nothing loads until you accept, and you can withdraw at any time from the footer. Withdrawing is as easy as giving, which is why the link is on every page rather than buried here.

• The demo form - to answer you

  You asked us to get in touch, so we use what you typed to do that. In GDPR terms, steps taken at your request before entering a contract. Nothing about it is inferred from your behaviour.

• Anti-spam - our legitimate interest

  Checking a submission came from a person, so the form stays usable. The alternative is no check at all, and an unprotected form becomes a relay within days.

• Nothing is automated

  No decision about you is made by a machine, and we do not profile visitors. There is no scoring model behind the form.

• See it, correct it, delete it

  Ask for a copy of what we hold, have it corrected if it is wrong, or have it erased. We will not ask why.

• Restrict or object

  Ask us to stop a particular use while a question is resolved, or object outright where we rely on legitimate interest.

• Take it with you

  Where you gave it to us and we process it by consent or for a contract, you can have it in a portable format.

• Withdraw consent, at any time

  Use Cookie choices in the footer. Withdrawing does not undo what was collected while consent was in force - which is exactly why nothing is collected before you give it.

• Complain to a regulator

  If we get this wrong you can complain to your data protection authority: in the UK the ICO, in the EEA the authority where you live. You do not have to come to us first, though we would rather you did.

• Do not sell or share - California

  We do not sell personal information. Accepting advertising lets LinkedIn measure whether a visit followed one of our ads, which California treats as sharing for cross-context behavioural advertising. Declining advertising in the banner, or Cookie choices in the footer, IS the opt-out - there is no separate form to hunt for.

This site sells software to law firms and is not directed at children. We do not knowingly collect anything from anyone under 16. If you believe a child has sent us something, write to info@onecounsel.legal and we will delete it.