Privacy Policy

1. Who We Are

OneLast.Day is a service operated by Afterbuck Labs Inc., a corporation incorporated in Ontario, Canada (“we”, “us”, “our”). Our registered address is Office 703, 145½ Church Street, Unit 5, Toronto, Ontario M5B 1Y4, Canada.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights in relation to it. By using OneLast.Day you agree to the practices described in this policy. If you do not agree, please do not use the service.

2. Information We Collect

We collect the following categories of information:

a) Account Information

When you sign in with Google, we receive and store your name, email address, and Google account identifier. This information is stored in our database and used to identify your account.

b) Google Workspace Data

• Gmail metadata: Email subject lines and the sender and recipient email addresses from the past 180 days. We do not access or read the body of your emails.
• Google Drive: File names, last-modified dates, and the email addresses of collaborators the file is shared with, for documents modified in the past 12 months. We do not access or read the contents of your files. If you choose to export your document to Google Docs, we use the drive.file permission to create a new file in your Drive on your behalf.
• Google Calendar: Event titles and attendee email addresses from the past 180 days. We do not access event descriptions, meeting notes, or video call links.

Raw Google Workspace data (emails, files, calendar events) is fetched from Google’s APIs and processed in memory. It is not written to our database. However, the AI-generated analysis derived from this data, and your final handover document, are stored in our database as described in Section 4.

c) Payment Information

Payment is processed by Stripe. We do not receive or store your credit card number or banking details. We retain a record of whether payment was completed, linked to your account.

d) Usage Data

Our hosting provider (Vercel) may collect standard server log data including IP addresses and request timestamps. We do not use this data for profiling.

3. How We Use Your Information

We use the information we collect for the following purposes only:

• To authenticate your account and maintain your session.
• To access your Google Workspace data (with your explicit consent) and generate your personalised handover document.
• To process your payment and maintain a record of your purchase.
• To respond to support requests you send to us.
• To comply with our legal obligations.

Google API Limited Use Disclosure: OneLast.Day’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not allow humans to read your Google data except with your explicit permission or as required by law, and do not use or transfer your Google data for any purpose other than generating your handover document.

4. Data Storage and Retention

5. Third-Party Services

We share data with the following trusted third-party service providers as necessary to operate the service:

• Google LLC — Authentication and data access via OAuth 2.0. Governed by Google’s Privacy Policy.
• Anthropic, PBC — AI processing of your Google Workspace metadata to generate your handover document. Your data is sent to Anthropic’s API for this purpose and is subject to their Privacy Policy.
• Stripe, Inc. — Payment processing. We share only what Stripe requires to complete your transaction. Governed by Stripe’s Privacy Policy.
• Supabase, Inc. — Database hosting. Stores your account information (name, email, Google user ID), payment records, AI analysis results, and generated handover documents. Governed by Supabase’s Privacy Policy.
• Vercel, Inc. — Application hosting and infrastructure. Governed by Vercel’s Privacy Policy.

We do not sell your personal information to any third party. We do not share your data with any party not listed above except as required by law.

6. Cookies

We use only essential cookies required to operate the service: a session cookie issued by NextAuth to maintain your authenticated session, and cookies set by Stripe during the payment process. We do not use advertising cookies, tracking pixels, or analytics cookies.

7. Your Rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law, you have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate personal information.
• Deletion: Request deletion of your account and all associated personal information. This includes your account record (name, email, user ID), payment records, AI analysis results, and any generated handover documents stored in our database. Raw Google Workspace data is never persistently stored and requires no deletion action.
• Withdraw consent: You may revoke OneLast.Day’s access to your Google account at any time via Google Account Permissions. Note that withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
• Complaint: You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact us at support@afterbuck.com. We will respond within 30 days as required by PIPEDA.

8. Children’s Privacy

OneLast.Day is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that we have inadvertently collected information from a minor, we will delete that information promptly. If you believe a minor has provided us with personal information, please contact us at support@afterbuck.com.

9. Data Security and Breach Notification

We implement reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), access controls, and use of reputable infrastructure providers.

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required under PIPEDA. We will notify affected users as soon as reasonably practicable.

10. International Data Transfers

Our service providers (including Anthropic, Stripe, Supabase, and Vercel) may process your data in the United States or other jurisdictions outside Canada. By using OneLast.Day, you acknowledge that your information may be transferred to and processed in countries with different privacy laws than your own. We take steps to ensure that transfers are made to reputable providers with appropriate safeguards.

11. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes, we will make reasonable efforts to notify users. Your continued use of the service after any change constitutes your acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, requests, or concerns, please contact our privacy office: