Your data, handled with care.

WoneSuite is an all-in-one business operating system. In one workspace, businesses run their customers, sales, commerce, finance, people, projects, support, website, and marketing — replacing the five-to-ten disconnected tools they would otherwise stitch together.

Because our platform can process a wide range of business, financial, employee, and customer information on behalf of the organizations that use it, privacy is not an administrative checkbox for us. It is a design constraint: it shapes how the platform is architected, operated, monitored, and governed.

This Privacy Policy explains how we collect, use, disclose, store, protect, and retain information when you visit our website, sign up, use the platform and its modules, connect integrations, or contact us. It is written with reference to major privacy frameworks — the EU/UK GDPR, Canada's PIPEDA, and the California CCPA/CPRA — and applied according to your jurisdiction.

"WoneSuite", "we", "us", and "our" refer to the entity that operates the WoneSuite platform and the wonesuite.com website. This policy applies to information handled through:

• The WoneSuite marketing website
• Account signup & authentication
• The WoneSuite workspace and its business modules
• Tenant websites built with our CMS & website builder
• Custom domains connected to a workspace
• First-party website analytics
• Public capability links (invoices, quotes, portals)
• Forms, demo requests & lead capture
• Email we send on your behalf
• APIs & integrations
• Support & sales communications

It applies to the people we interact with, including:

• Business customers (tenants)
• Workspace owners, admins & team members
• Website visitors & prospects
• A tenant's own end-customers who interact via public links or portals
• Job applicants who apply through a tenant's careers page
• Partners & authorized users

The same platform serves two very different data relationships, and our obligations depend on which one applies:

The categories below reflect the full breadth of the platform. Most tenants use only a subset of modules, so not all of this applies to every account.

Some modules can hold information that certain laws treat as sensitive — for example employee identifiers in HR/payroll, or financial account references in invoicing. Where this exists, it is almost always tenant-submitted business data for which the tenant is the controller.

Most platforms measure their websites with third-party trackers that follow visitors across the internet. WoneSuite does not. Our analytics engine is first-party and built for privacy:

• No third-party ad trackers
• No cross-site profiling
• No advertising cookies set by us
• Anonymized, daily-rotating visitor IDs
• Country derived on our own servers from public allocation data — not a third-party geo-IP vendor
• Bot filtering via a proof-of-work challenge, not fingerprinting

A tenant may separately choose to add their own third-party ad pixels (for example Meta or Google) to their website. When they do, those pixels are governed by that tenant's own privacy notice and the pixel provider's policies, and are gated behind the tenant's consent banner.

We collect information:

• Directly from you when you sign up, configure, or contact us
• From your workspace administrator
• Through your use of the platform
• Through content and files you upload
• Through first-party analytics on our website
• Through integrations you connect
• Through public links your customers open
• From public forms and lead-capture
• From publicly available business sources where needed for verification

Where the GDPR or similar law applies, we rely on one or more of these bases:

• Performance of a contract
• Consent
• Legal obligation
• Legitimate interests (security, service improvement, and running our business)
• Protection of vital interests where relevant

For tenant-submitted data we process as a processor, the tenant (as controller) is responsible for establishing the legal basis for that processing.

We disclose information only where necessary and appropriate:

WoneSuite runs on a deliberately sovereign, consolidated stack to minimize third-party data exposure. We self-host our database, application, website analytics, email delivery, and geo-lookup rather than outsourcing them.

Where we do rely on a sub-processor (for example cloud hosting or infrastructure), we engage them under contractual data-protection terms and use only what is needed to run the service. A current list is available on request and, where required, via our Sub-processors page.

We may process or store information in a country other than yours. Where personal data is transferred internationally, we apply appropriate safeguards, which may include standard contractual clauses, data-processing agreements, access controls, and encryption.

We apply administrative, technical, and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, loss, or destruction. These include:

• Database-level tenant isolation (row-level security, enforced & tested)
• Encryption in transit
• Argon2 password hashing
• Multi-factor authentication
• Role-based access control
• Least-privilege database roles
• Audit logging
• Bot & abuse defenses
• Continuous security monitoring (independent security oversight)
• Incident response procedures

No system can guarantee absolute security, but we continuously work to strengthen our controls and require security sign-off before changes go live.

We retain personal information only as long as necessary to provide the service, meet our contractual and legal obligations, resolve disputes, and enforce our agreements.

Retention varies by data type and your configuration. Raw website-analytics events are pruned on a rolling retention window you can configure; aggregated, non-identifying statistics may be kept longer. When you delete your workspace, we delete or anonymize your data within a commercially reasonable period, subject to legal holds and backup cycles.

We use a minimal set of strictly-necessary cookies and local storage to keep you signed in, remember preferences, and secure your session. We do not use advertising cookies on our own website.

Tenant websites may use cookies according to each tenant's own configuration and consent tooling.

Some modules offer optional AI-assisted help — for example summarizing a note or drafting a reply. By default these run with an in-product, on-platform assistant; your business data is not sent to an external AI provider unless you explicitly enable and configure one.

Depending on your jurisdiction, you may have rights to:

• Access your information
• Correct inaccuracies
• Delete your data
• Restrict or object to processing
• Withdraw consent
• Data portability
• Opt out of marketing
• Opt out of "sale" or "sharing" (we do neither)
• Lodge a complaint with a regulator

California residents have rights under the CCPA/CPRA; EU/UK residents under the GDPR; Canadians under PIPEDA. We honor verified requests as those laws require.

Contact us at privacy@wonesuite.com. We may need to verify your identity before acting on a request.

If your data is held in a workspace controlled by a business that uses WoneSuite, we will refer your request to that business, who is the controller, and support them in responding.

If you use WoneSuite to process other people's data, you are the controller for that data. You are responsible for having a lawful basis, providing your own privacy notice, honoring your customers' and employees' rights, and configuring access appropriately.

We provide the tools — isolation, access controls, audit logs, export, and deletion — to help you meet those obligations.

When a tenant's end-customer opens an invoice or quote link, replies on a support portal, or applies to a careers page, WoneSuite processes that interaction on the tenant's behalf.

Questions about that data should go to the business you interacted with. WoneSuite will assist that business in responding to you.

You may connect optional integrations — for example a search console, an advertising pixel, or a payment method. These are controlled by you and governed by the third party's own terms and privacy policy.

• Search-console connections
• Advertising pixels & conversion APIs
• Payment methods
• Custom-domain DNS providers

WoneSuite is built for businesses and professional users and is not directed to children. We do not knowingly collect personal information from children, except where a business submits limited employment-related information under a lawful basis.

If we become aware of a security incident affecting personal information, we will contain the risk, investigate, and notify affected parties and regulators where required by law or contract.

We maintain privacy and security governance appropriate to the sensitivity of the data we handle:

• Documented policies & procedures
• Data minimization
• Access reviews
• Vendor due diligence
• Immutable audit trails
• Independent security oversight & pre-release sign-off
• Incident-response planning

You can unsubscribe from marketing email at any time via the unsubscribe link or by contacting us.

Even after opting out of marketing, you may still receive transactional, security, billing, and service messages.

We may update this Privacy Policy to reflect changes in our services, technology, or legal obligations. When changes are material, we will notify you through the website, the platform, or email, and update the "Effective" date above.

For privacy questions, requests, or complaints, contact us at privacy@wonesuite.com. We take every concern seriously and aim to respond promptly.