Privacy Policy.

01Who we are

OnlyUps GrowthAvenue LLP ("ONEWAY", "we") operates https://1way.dev, the ONEWAY dashboard and the ONEWAY API gateway. For account, billing, website and waitlist data we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and you are the Data Principal. Under the EU General Data Protection Regulation ("GDPR") and the UK GDPR, we are the controller of that data.

For personal data contained in the AI requests your products send through ONEWAY, your organisation decides what is sent and why, and we process it on your behalf (as a Data Processor under the DPDP Act, or a processor under the GDPR). Your organisation is responsible for its own end users' privacy.

02At a glance

We do not sell personal data, show ads, use third-party advertising trackers or use your data or content to train AI models.

03Information we collect

Account. Your name, email address, password (stored only as a secure hash), profile image if you sign in with Google or GitHub, and the organisations, projects and roles you belong to. If you sign in with Google or GitHub, we receive your basic profile from them.

Sign-in and security. Active sessions with the IP address and browser they came from, passkeys and two-factor authentication settings, and a log of security-relevant actions such as key creation and settings changes.

Billing. When you top up your balance, Dodo Payments, our merchant of record, collects your payment details and billing address and processes them under its own privacy policy. We receive the payment ID, amount, currency, tax, status and payment method type, along with the customer details Dodo Payments shares with us, such as your name, email, billing country and tax ID (if provided). We never receive your full card details.

API usage metadata. For each request through the gateway: time, project, API key, model, provider, token counts, cost, latency and status, plus any customer, feature or agent identifiers your code chooses to attach.

Request content. The prompts and responses your products send pass through ONEWAY to the Provider you choose. We do not store them unless an owner or admin of your organisation turns on request logging, in which case we keep them for the retention period they choose.

Provider keys. If you bring your own provider keys, we store them encrypted so only the gateway can use them to send your requests.

Early-access applications. Name, email, role, what you are building, optional profile link, projects, team size, providers and capabilities you use, workflow, spend band, priorities, beta-traffic preference, preferred currency and how you found us.

Communications. Emails you send us and our replies.

Website events and technical logs. Simple events such as "pricing viewed" with the page path, time and a random per-visit session ID, not linked to your name or email. Our hosting providers also process standard request data such as IP address and browser type to deliver and protect the service.

Information that stays on your device. The public demo, theme and currency preferences are saved in your browser's local storage and are not sent to us. See our Cookie & Storage Notice.

04How we use it

• To create and secure your account, sign you in and prevent fraud and abuse.
• To route your API requests to Providers, enforce budgets and rate limits, and show usage and spend in your dashboard.
• To process payments, issue invoices and keep accounting and tax records.
• To send service emails such as verification, sign-in links, security alerts, receipts and important changes.
• To review early-access applications and contact you about beta access and product updates.
• To provide support, understand aggregate usage and improve ONEWAY.
• To comply with legal obligations and respond to lawful requests.

We rely on your consent, given when you create an account, apply or contact us, and on the legitimate uses permitted by the DPDP Act, such as complying with law.

05Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR:

06Who we share it with

We share personal data only with service providers that help us run ONEWAY, under contracts that limit their use of it to providing services to us:

We may also disclose information to professional advisers, to authorities where required by law, or to a successor if ONEWAY is involved in a merger, acquisition or sale of assets, in which case this policy will continue to apply.

07International transfers

We are based in India, and some of our service providers and AI providers store or process data in other countries, including Singapore and the United States. We transfer data only as permitted by the DPDP Act and any restrictions notified by the Government of India.

If you are in the EEA or the UK, your personal data is transferred to India and to other countries that may not have an adequacy decision. Where required, we protect these transfers with the European Commission's Standard Contractual Clauses (and the UK Addendum to them) or another lawful transfer mechanism. You can ask us for a copy of the relevant safeguards.

08How long we keep it

• Account data: while your account is active, and deleted within 30 days of closing it, except records we must keep by law.
• Sign-in sessions: expire after 7 days of inactivity.
• Request content: only while request logging is on, for 1, 7 or 30 days as your organisation chooses.
• API usage metadata: while your organisation's account is active, as it forms your usage and billing history.
• Payment and invoice records: 8 years, as required by Indian tax and accounting law.
• Early-access applications: up to 24 months after our last contact with you, unless you become a customer or ask us to delete them sooner.
• Website events: up to 13 months, after which they are deleted or aggregated.

09How we protect it

We use encryption in transit, database-level isolation between organisations, encrypted storage of provider keys, passkeys and two-factor authentication, and strict limits on staff access. No system is perfectly secure; if a personal data breach occurs, we will notify affected people and the Data Protection Board of India as the law requires. Learn more on our Security page.

10Your rights

Under the DPDP Act you can:

• Ask for a summary of the personal data we hold about you and how it is processed.
• Ask us to correct, complete or update inaccurate data.
• Ask us to erase your data, unless we must keep it by law.
• Withdraw consent at any time. This will not affect processing already done, but we may no longer be able to provide the service.
• Nominate another person to exercise your rights if you die or become incapacitated.
• Raise a grievance with us and, if unresolved, complain to the Data Protection Board of India.

If you are in the EEA or the UK, you also have the right to access, correct or erase your data, to restrict or object to our processing (including processing based on legitimate interests), to data portability, and to withdraw consent at any time. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

If you are in the United States, some state laws, such as California's, give you rights to know, correct and delete your personal information. We honour those requests wherever you live. We do not sell or share personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

Email team@1way.dev with the subject "Privacy request" from the address you used with us. We will respond within 30 days, and we will not treat you differently for using your rights. You can unsubscribe from product updates using the link in any such email; service and security emails are part of running your account.

11Children

ONEWAY is meant for adults building products. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

12Changes to this policy

We will post changes here with a new effective date and notify account holders by email of material changes before they take effect.

13Contact and Grievance Officer

Grievance Officer: Sahaj Chawla, OnlyUps GrowthAvenue LLP, 1814, Ram Nagar Colony, Faizabad, Ayodhya, Uttar Pradesh 224001, India. Email: team@1way.dev. See the contact page for response timelines.