Privacy policy

Information you give us

• Account details: your name, email address and, if you sign in with Apple or Google, the name and email those services share with us.
• Your work with your CTO: messages, files and attachments in your thread, entries in your decision log, call notes, and anything else you share so we can advise you.
• Talk to a CTO questionnaire and enquiries: your answers, company name and website, stage, team size, budget range, deadlines and the problem you describe.
• Calls: the times you book and the details you give our scheduling provider.
• Payments: your plan, orders and billing status. Card details go straight to Stripe, Apple or Google; we never see or store your full card number.

Information we collect automatically

• Usage and device data: pages and screens you view, the actions you take, your browser or device type, operating system, IP address and approximate location derived from it.
• Notification tokens: if you allow notifications in the mobile app, the token Apple or Google gives us to reach your device.
• Cookies and similar technologies: see Cookies.
• Logs and error reports: technical records our servers keep to run, secure and debug the service.

Information from other sources

We receive limited information from sign-in providers (Apple, Google), payment providers (Stripe, the App Store, Google Play) about the status of your subscription, our scheduling provider about your bookings, and advertising partners about which ad or campaign brought you to our site.

We use your information to:

• provide the service: run your thread, calls, decision log, deliverables and Learn content;
• sign you in, keep your account secure and prevent fraud and abuse;
• process payments, manage subscriptions and send receipts;
• send messages you expect, such as sign-in codes, replies from your CTO and call reminders;
• reply to enquiries and Talk to a CTO questionnaires;
• understand how the service is used and improve it;
• measure our advertising; and
• meet our legal, tax and accounting obligations.

Artificial intelligence

We do not sell your content, and we do not use your messages, files or decision log to train artificial intelligence models. Advice in myCTO comes from a person, not an automated system.

We do not sell or rent your personal information. We share it only:

• With service providers who process it on our behalf, under contract, to run the service (see Service providers);
• With people you choose: for example, when you share a decision with an investor or cofounder using a share link;
• For legal reasons: to comply with law or a valid legal request, enforce our terms, or protect the rights, safety and property of our clients, us or others;
• In a business transfer: if One Human Labs is involved in a merger, acquisition or sale of assets, subject to this policy; and
• With your consent or at your direction.

We rely on a small number of providers. Each sees only what it needs to do its job:

• Render: hosting, databases and file storage (United States).
• Resend: email delivery for sign-in codes and notifications.
• Stripe, Apple App Store and Google Play: payments and subscriptions.
• Apple and Google: sign-in and push notifications.
• Cal.com: call scheduling.
• Google Workspace: email and our records of enquiries.
• PostHog and Google Analytics: product and website analytics.
• Google Ads: measuring our advertising.
• Sentry: error monitoring.

We use a small set of cookies and similar technologies:

• Essential: keep you signed in and protect forms. The service does not work without them.
• Analytics: tell us which pages are used so we can improve them.
• Advertising: tell us whether a visit came from one of our ads and whether it led to an enquiry.

You can block or delete cookies in your browser settings. Blocking essential cookies will sign you out. You can opt out of Google Analytics with Google’s browser add-on and manage ad personalisation in your Google ad settings.

We honor the Global Privacy Control signal as a request to opt out of advertising measurement. Browsers do not apply “Do Not Track” consistently, so we do not respond to it separately.

We keep your account and your work with your CTO for as long as your account is open, so your thread and decision log stay available to you.

You can delete your account yourself at any time under Account in myCTO on the web, iOS or Android. When you do, we immediately delete your name, email address and profile; your thread with its messages, files and attachments; your decision log; your call records; your notifications; your Talk to a CTO questionnaire answers; and your sign-in methods, sessions and push notification registrations. Your CTO is told that you deleted your account. Copies in our backups expire on their normal schedule, within 90 days.

We keep records of what you paid (orders, amounts, dates and payment references) for up to seven years because tax and accounting law requires it, but we detach them from your name and email. Stripe, Apple and Google keep their own payment records under their own policies. If you close your account by email instead, we delete or anonymize your personal information the same way within 30 days.

Enquiries and Talk to a CTO questionnaire answers that do not become an account are kept for up to two years. Logs and error reports are kept for a short period, typically 30 to 90 days.

Wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong;
• delete your account and personal information; and
• stop sending marketing email (every marketing email also has an unsubscribe link).

To delete your account, use Delete account under Account in myCTO on the web, iOS or Android; it takes effect at once and cannot be undone (see Data retention for what is deleted and what is kept). Download any decisions you want to keep first. Deleting your account cancels a subscription you bought on our website straight away. A subscription you bought through the App Store or Google Play is billed by Apple or Google, so cancel it in your App Store or Google Play settings, or it will keep renewing.

For any of these requests, including deletion if you prefer, email hello@onehumanlabs.com from the address on your account. We will confirm the request comes from you and reply within 30 days. We will not treat you differently for using these rights.

California residents

Under the California Consumer Privacy Act, as amended, you have the rights to know, delete, correct, and opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. We collect the categories described in section 1 for the purposes in section 2. We do not sell personal information. Using advertising cookies to measure our ads may count as “sharing” under California law; you can opt out with the Global Privacy Control signal or by emailing us. You may use an authorized agent to make a request on your behalf.

Other US states

If your state gives you similar privacy rights, you can use them the same way. If we decline a request, you can appeal by replying to our answer; we will respond within the time your state’s law requires.

European Economic Area, United Kingdom and Switzerland

We process your information to perform our contract with you, for our legitimate interests in running and improving the service, to meet legal obligations, and with your consent where required (for example, for analytics and advertising cookies). You also have the rights to object to and restrict processing, to data portability, to withdraw consent at any time, and to complain to your local data protection authority.

We encrypt data in transit, restrict access to the people who need it, sign you in with one-time codes instead of passwords, and keep each client’s thread and decisions separate from every other client’s. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you as the law requires.

One Human Labs is based in the United States and stores your information there. If you use the service from elsewhere, your information is transferred to the United States, where we protect it as this policy describes and, where required, under standard contractual clauses or an equivalent safeguard.

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

Our site and Learn content link to sites we do not control. Their own privacy policies apply when you visit them.

We may update this policy as the service changes. We will change the date at the top and, for material changes, tell you by email or in the app before they take effect.

One Human Labs LLC, California, United States.
Email hello@onehumanlabs.com. We reply within one business day.