Privacy Policy

1. Who We Are

OneLast.Day is a service operated by Afterbuck Labs Inc., a corporation incorporated in Ontario, Canada (“we”, “us”, “our”). Our registered address is Office 703, 145½ Church Street, Unit 5, Toronto, Ontario M5B 1Y4, Canada.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights in relation to it. By using OneLast.Day you agree to the practices described in this policy. If you do not agree, please do not use the service.

2. Information We Collect

We collect the following categories of information:

a) Account Information

When you sign in with Google, we receive and store your name, email address, and Google account identifier. This information is stored in our database and used to identify your account.

b) Google Workspace Data

• Google Calendar: Event titles and attendee email addresses from the past 12 months (365 days), plus upcoming events for the next 90 days. We use this data to identify your key meeting stakeholders and recurring working relationships for inclusion in your handover document. We do not access event descriptions, meeting notes, or video call links.
• Google Contacts: For your saved contacts, we access name, job title, company name, and department. For “Other Contacts” (contacts automatically saved by Google from your Gmail interactions), we access name and email address. For Google Workspace accounts, we also access your organisation’s shared directory, which may include name, email address, job title, company, and department for members of your organisation. We use this data solely to identify your key professional relationships for inclusion in your handover document.
• Google Drive (export only): If you choose to export your handover document to Google Docs, we use the drive.file permission to create a new document in your Google Drive on your behalf. We do not read, browse, or access any of your existing Drive files or their contents.

Raw Google Workspace data (calendar events and contacts) is fetched from Google’s APIs and processed in memory. It is not written to our database. The AI-generated analysis derived from this data, and your final handover document, are stored in our database as described in Section 4.

c) Payment Information

Payment is processed by Stripe. We do not receive or store your credit card number or banking details. We retain a record of whether payment was completed, linked to your account.

d) Usage Data

Our hosting provider (Vercel) may collect standard server log data including IP addresses and request timestamps. We do not use this data for profiling.

3. How We Use Your Information

We use the information we collect for the following purposes only:

• To authenticate your account and maintain your session.
• To access your Google Workspace data (with your explicit consent) and generate your personalised handover document.
• To process your payment and maintain a record of your purchase.
• To respond to support requests you send to us.
• To comply with our legal obligations.

Google API Limited Use Disclosure: OneLast.Day’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not allow humans to read your Google data except with your explicit permission or as required by law, and do not use or transfer your Google data for any purpose other than generating your handover document. This applies to all Google data we access, including Calendar events, Contacts (saved contacts, other contacts, and organisation directory).

4. Data Storage and Retention

5. Third-Party Services

We share data with the following trusted third-party service providers as necessary to operate the service:

• Google LLC: Authentication and data access via OAuth 2.0. Governed by Google’s Privacy Policy.
• Anthropic, PBC: AI processing of your Google Workspace metadata to generate your handover document. Your data is sent to Anthropic’s API for this purpose and is subject to their Privacy Policy.
• Stripe, Inc.: Payment processing. We share only what Stripe requires to complete your transaction. Governed by Stripe’s Privacy Policy.
• Supabase, Inc.: Database hosting. Stores your account information (name, email, Google user ID), payment records, AI analysis results, and generated handover documents. Governed by Supabase’s Privacy Policy.
• Vercel, Inc.: Application hosting and infrastructure. Governed by Vercel’s Privacy Policy.

We do not sell your personal information to any third party. We do not share your data with any party not listed above except as required by law.

6. Cookies

We use only essential cookies required to operate the service: a session cookie issued by NextAuth to maintain your authenticated session, and cookies set by Stripe during the payment process. We do not use advertising cookies, tracking pixels, or analytics cookies.

7. Your Rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law, you have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate personal information.
• Deletion: Request deletion of your account and all associated personal information. This includes your account record (name, email, user ID), payment records, AI analysis results, and any generated handover documents stored in our database. Raw Google Workspace data is never persistently stored and requires no deletion action.
• Withdraw consent: You may revoke OneLast.Day’s access to your Google account at any time via Google Account Permissions. Note that withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
• Complaint: You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact us at support@afterbuck.com. We will respond within 30 days as required by PIPEDA.

8. Children’s Privacy

OneLast.Day is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected information from a minor, we will delete that information promptly. If you believe a minor has provided us with personal information, please contact us at support@afterbuck.com.

9. Data Security and Breach Notification

We implement reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), access controls, and use of reputable infrastructure providers.

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required under PIPEDA. We will notify affected users as soon as reasonably practicable.

10. International Data Transfers

Our service providers (including Anthropic, Stripe, Supabase, and Vercel) may process your data in the United States or other jurisdictions outside Canada. By using OneLast.Day, you acknowledge that your information may be transferred to and processed in countries with different privacy laws than your own. We take steps to ensure that transfers are made to reputable providers with appropriate safeguards.

11. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will make reasonable efforts to notify users. Your continued use of the service after any change constitutes your acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, requests, or concerns, please contact our privacy office: