Privacy Policy

OneSend writes and publishes social media posts for small businesses and nonprofits. This page tells you what information we collect, why we collect it, where it goes, how long we keep it, and how you can see it, fix it or delete it.

Who we are

OneSend is a product of Delcaro Media in Kitchener, British Columbia, Canada. Our website is delcaromedia.com.

Our privacy officer answers every privacy question and request. Email [email protected]. You can also write to us at Delcaro Media, 5710 Atlin Ave, Kitchener, BC V0B 1W1.

What we collect

• Your name, your email address and your password, so you can sign in. We store the password only in a scrambled form.
• Your business details: name, description, voice, rules and time zone.
• The text, photos, videos and emails you send us.
• The posts we write for you, your edits, your approvals, and when each post goes out.
• The social accounts you connect, and the access keys each network gives us for them.
• Comments on your posts, and the numbers each network gives us about how your posts did.
• Your plan and the state of your payments. Helcim holds your card details. We do not see or store your card number.
• A record of when you agreed to our Terms of Service, this Privacy Policy and our Acceptable Use Policy, and which versions.
• Technical logs: when you sign in, what the service did, and errors.

Why we use it

We use your information to write, check, schedule and publish your posts, to show you how they did, to bill you, and to run, secure and fix the service. We do not sell your information. We do not use it to advertise to you or to anyone else.

Who handles your information for us

These companies process your information for us. Each one gets only what its job needs.

• Amazon Web Services (AWS), in Canada. AWS stores and runs OneSend in its Montreal region (ca-central-1). We copy backups to its Calgary region (ca-west-1). This covers our database (DynamoDB), files (S3), our programs (Lambda), the website hosting (Amplify) and email to and from OneSend (SES).
• Helcim, in Canada. Helcim is a Canadian payment processor. It takes your card and runs your subscription.
• Cloudflare. Cloudflare runs our domain names and a firewall in front of the website. Every visit to OneSend passes through it.
• OpenRouter and AI model providers. To write posts and describe your photos, we send your text and photos through OpenRouter to AI model providers. These providers can be outside Canada.
• TypeSafe (Jev). Jev does safety checks on drafts and uploads before anything goes out. Jev is outside Canada, in the United States.
• Microsoft Clarity and Google Analytics. We use these on our public front page only, to see how visitors use it. They use cookies. We do not send them your name, your email or your account. They are outside Canada.
• The social networks you connect. Meta (Facebook, Instagram and Threads), LinkedIn, X, YouTube, TikTok, Bluesky and Mastodon get the posts you publish there, and give us the results. Each network uses this under its own privacy policy.

Information that leaves Canada

We keep and run OneSend in Canada. Some information goes outside Canada:

• Text and photos we send through OpenRouter to AI model providers.
• Drafts and uploads that Jev checks, in the United States.
• Visit data from Microsoft Clarity and Google Analytics, from our front page.
• Posts you publish to the social networks you connect.

Information outside Canada follows the laws of that country. The courts and government of that country can get access to it under those laws.

Google and YouTube

OneSend's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube access only to publish videos you approve to your own channel and to show you how they did.

OneSend uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. You can remove OneSend's access at any time at myaccount.google.com/permissions.

Facebook, Instagram, Threads and TikTok

We use only the access you give us, only to post to and read results for your own accounts. You can remove that access at any time in each network's settings.

How long we keep it

• Your account information: while your account is open.
• Backups: 35 days. Deleted information stays in backups for up to 35 days, then it is gone.
• Technical logs: 90 days.
• The log of email we send and get for your account: 395 days.
• One-tap approval links in our emails: they stop working after 7 days.
• Material that our safety checks flag as possible child sexual abuse material: we hold it for 21 days so we can report it as the law requires. Then we delete it.

Delete your information

The owner of an account can delete it at any time. Go to Settings and use Delete account. This stops all posts, disconnects your social accounts, and deletes your workspace with your posts, photos and numbers. Your sign-in stays. To delete your sign-in too, email [email protected] from the email address of your account. You can also ask us by email to delete the whole account for you.

Read how to delete your data for each step and the times.

See or correct your information

You can ask to see the personal information we hold about you, or to correct it. Email [email protected].

Security and breaches

We protect your information with encryption, access controls and two-step sign-in for our staff. If a breach puts your information at real risk of significant harm, we tell you and the Privacy Commissioner of Canada as soon as we can, as PIPEDA requires. We keep a record of every breach for 24 months.

Complaints

If you have a concern, email [email protected] first. If we do not fix it, you can contact the Office of the Privacy Commissioner of Canada.

Changes

If this policy changes, we post the new version here with a new version number and date.