Your network is yours.

1. Who we are and who this policy covers

OneHop is a private relationship memory: it helps you remember, keep up with and get introduced through the people you already know. It is operated by [ENTITY NAME] (ABN [ABN]), of [REGISTERED ADDRESS], Sydney, New South Wales, Australia (“OneHop”, “we”, “us”).

This policy covers:

• Members — people with a OneHop account.
• Event guests — people invited to an event a host runs on OneHop, who may use an event pass without creating an account.
• Community members — members who join a community (a “Space”) run on OneHop by an operator.
• People in members’ networks — the colleagues, friends and contacts that appear in a member’s imports and connected accounts. Most of them have never used OneHop. We have written a short, dedicated notice for them at /privacy/your-data, and every right in this policy applies to them too.
• Visitors — anyone browsing our website, a member’s contact card or an event page.

We wrote this policy to meet the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), the Spam Act 2003, the EU and UK General Data Protection Regulation (GDPR), and US state privacy laws. Where those laws differ, we apply the stricter rule to everyone.

OneHop is the controller of the personal information described in this policy, including information about the people in members’ networks. We decide how OneHop stores, matches, completes, scores and deletes it, so we are responsible for it under these laws. If you use OneHop for work and sign our data processing addendum, we act on your behalf only for the business content that addendum covers (see the Terms).

Some features described here are in preview or not yet available to every member. This policy describes how each one handles information whenever it is available to you.

Questions go to our privacy officer at privacy@onehop.network. We reply to every privacy message within 30 days, and usually much sooner.

2. Our commitments

These are binding parts of this policy, not marketing copy. If we ever change one, we will tell members in advance (see Changes to this policy) and the change will apply only to data collected afterwards.

1. Your network is yours. We hold it to provide OneHop to you. We do not use it for anyone else’s benefit.
2. We never sell, rent, license or trade personal information, and we never “share” it for cross-context behavioural advertising (in the sense of the California Consumer Privacy Act). We run no ads and no advertising trackers.
3. No pooled people database. We do not merge members’ networks into a directory or search index that others can browse. Another member learns something about your network only through features you have switched on, and only the limited fields described under Who can see what.
4. We do not train AI models on your data. Not ours, not our vendors’. That covers your imports, your connected accounts, your notes, and information about the people in your network.
5. Email metadata by default. Unless you switch on email content for a specific mailbox, we read only the sender, recipients, date and subject of your messages. We never request the body.
6. We never contact the people in your network on your behalf without your explicit instruction, and never for our own marketing. (Event hosts can ask us to email their own guests their event pass; see Events.)
7. No face recognition or other biometric processing of photos.
8. Public-source look-ups only when you ask (or, if you switch it on, automatically for the people you message on LinkedIn through OneHop for desktop), only for people already in your network, and never for anyone on our opt-out list.
9. Leaving is easy. Download your data or close your account from Settings → Account, and we delete what you hold as set out under How long we keep information.

3. What we collect and where it comes from

From you, when you create and use an account

• Name and email address, and your Google or Microsoft sign-in identity if you use one; passkeys if you add one. We don’t use passwords. Accounts made before November 2026 may still hold an old password as a salted hash, which can no longer sign in and which we are deleting.
• Two-step verification settings (secrets encrypted), sign-in history, and device and browser details for security.
• Your profile, goals, roles, asks and offers, notes, tags, tasks, check-ins, contact card and settings.
• Your consent choices, with the date, the version of the wording you agreed to, a one-way hash of your IP address and your browser’s user-agent (see Consent and choices).
• Subscription and billing details. Stripe collects and stores your card, and we receive only a customer reference, your plan, its status and your billing history. We never see or store your full card number.
• Messages you send to us, and feedback you give on introductions, matches and suggestions.

From files you import

Official “download your data” archives that platforms give you for exactly this purpose, uploaded by you or handed over by your own AI assistant at your request:

• Your LinkedIn data export: your connections (name, headline, company, position, profile link and email where the connection allowed it), invitations, endorsements, your own profile, positions, education and skills, your own activity (such as reactions, comments, saved jobs and searches), and your messages, including their text. We may use a sample of messages you sent to describe your writing style, so drafts sound like you.
• Google Takeout: your contacts.
• Facebook and Instagram “Download your information” files: friends, followers and following, message conversations, and Facebook events you went to. Friends we only know by name go to a review list for you; they never become people records on their own.
• Your X archive: who you follow, who follows you, and your direct-message conversations.

We don’t keep the archive files themselves: they are read, and then discarded.

From accounts you connect

Connections are read-only unless a feature clearly says otherwise and you approve each action (for example, posting an ask you have drafted). You can disconnect any source at any time in Settings.

From your own devices

• Mac messages helper. If you pair your Mac, a script you run reads your Mac’s address book and your Messages history (iMessage and SMS): who you messaged, when, in which direction, and the message text. It uploads only to your account. Message text is kept for 24 months, then removed.
• Android app. If you allow it, it reads your phone’s contacts and uploads them to your account.
• OneHop for desktop. If you install it and switch a source on, it sends who you messaged, when and in which direction. If you also turn on relationship context, it sends each day’s messages to be read by an AI model; we keep only coded signals and never store the text. See OneHop for desktop.

From people you meet in person

When someone opens your OneHop contact card (by link, QR code or NFC tag) and chooses to share their details back, we receive only the fields they tick. They see exactly what is shared before sending.

From events and communities

Event hosts give us their guest lists, and community operators may connect Slack, Discord, Circle or Mighty. See Events and Communities for what that involves.

From public sources, only when you ask

For a person who is already in your network, you can ask OneHop to complete their profile from public professional sources. This means headline, current and past roles, company, education, skills, location and public photo. We show you what the run covers and ask for confirmation each time. One exception you choose yourself: if you connect LinkedIn in OneHop for desktop and switch on “Look up the people I message on LinkedIn”, we complete the profiles of the people you message there automatically, at our cost, up to 200 people. You can switch it off any time in Settings → Sources. Our providers are listed under Service providers. We never look up people you don’t already know, and we check our opt-out list before any look-up runs. Where no photo is available from a source you hold, we may ask Gravatar whether a public avatar exists for a contact’s email address, sending only a one-way hash of the address.

What we derive

From the information above we calculate signals that make OneHop useful to you. These include relationship strength and how it fades when you lose touch, the nature of a relationship (colleague, client, friend), seniority, industry and community groupings, shared interests, interests suggested by events you went to, roles and what you can help with, suggested people to reconnect with or meet, and search indexes (including numerical “embeddings”). This is profiling, and Profiling and automated decisions explains it and your right to object.

Automatically, when you use OneHop

Server logs (IP address, browser, pages requested, errors), a security log (see Security), a record of the AI and look-up usage (and its cost) behind your account, and simple counts of visits to contact cards. Card visits are counted on our servers without storing anything on the visitor’s device: no cookie, no local or session storage. These are kept in our own database to run, budget and improve the product. We use no third-party analytics, advertising or tracking scripts. Cookies are covered under Cookies and local storage.

4. OneHop for desktop

OneHop for desktop is an optional app you install on your own computer (Mac, Windows or Linux). It keeps your relationships up to date from the messaging accounts you choose to connect on that computer, such as iMessage on a Mac, WhatsApp, Google Messages, Instagram, Messenger, LinkedIn messages or X.

It runs on your computer, and you choose each source

• You link the app to your account by signing in to OneHop in your browser and choosing Allow. The app keeps its access key in your computer’s own secure storage (the macOS Keychain, Windows Credential Manager or your Linux keyring; on a Linux system without a keyring, a file only your user account can read). We store only a one-way hash of it.
• Nothing is connected until you switch a source on. You sign in to that service inside the app, on your computer, and its sign-in session stays on your computer: we never receive your password, cookies or session for any of those services.
• Before you switch on a source other than iMessage, the app shows what connecting involves and asks you to confirm. We record that confirmation (the source, the version of the wording, the date, a one-way hash of your IP address and the app’s user-agent) and refuse uploads for a source until it is on record. iMessage needs no separate confirmation because the app reads only your own Messages file on your Mac, with the access you grant in your Mac’s settings.

What it sends us: metadata only, unless you turn on relationship context

For each conversation and message on a source you switched on, the app sends:

• a conversation identifier, whether it is a one-to-one chat or a group, and a group’s name;
• for each participant: the identifier the service uses, and the display name, phone number or username it shows. Group chats are kept in full because they show the context of a relationship, but a participant who isn’t already someone you know is stored restricted: their phone number and username are kept only as a keyed one-way hash (no readable number), and their name only in groups of 25 people or fewer. A restricted participant becomes a normal entry only when that number is confirmed, by a text-message code to the number, by your own saved contact, or, inside your own data only, by your own synced account;
• for each message: an identifier, who sent it, when, whether you sent or received it, and its type (for example text, photo or voice note).

These uploads never contain the content: no message text, captions, link previews, photos, videos, voice notes, files or reactions’ content. The app drops content before anything leaves your computer, and our servers reject any of these uploads that contains it. The app sends message text only for relationship context, below, and only if you turn it on. We use what it sends the same way as your other sources: to recognise people you already know, add the people you talk to, and keep relationship strength current (see How we use information). It is visible only to you, like the rest of your network. A group name that reveals health, religion, politics or another sensitive category stays visible to you but is never turned into a label or interest.

Relationship context (optional)

Relationship context is off unless you turn it on in the app. It helps OneHop understand what kind of relationship you have with someone, not just how often you talk.

• What is sent. Once a day, the app sends us that day’s messages for each conversation on the sources you choose. Photos, videos, voice notes and files are never sent.
• Who reads it. An AI model running on Cloudflare Workers AI reads the messages and returns coded signals (see Service providers).
• What we keep. Only the coded signals: time together and plans to meet, whether the relationship is mostly work or personal, a tone band, help asked for and offered, interests, what someone is focused on, and whom they can introduce you to. Never the words.
• The text is deleted straight away. It is held only while the request is handled, then discarded. It is never stored or logged.
• Sensitive days stay on your computer. Days that touch on health, sexuality, religion or politics are screened out on your device and not sent.
• How we use the signals. They feed relationship strength, goal suggestions and introduction paths. Like the rest of your network, they are visible only to you.
• Your control. Turn it off in the app any time, and delete the signals for each source.

How to stop it and delete what it sent

• Pause syncing or switch a single source off in the app at any time. Switching a source off signs it out on your computer and deletes its local data there.
• “Sign out of this computer” in the app, or Remove next to the computer in Settings → Sources, stops all uploads at once.
• Delete imported data next to a source in Settings → Sources deletes everything that source sent us, along with what we derived from it, as set out under How long we keep information.

Connecting a third-party service through the app is your choice and is subject to that service’s own terms; see the Terms.

5. Events

Hosts can run professional events on OneHop. Guests can take part with an event pass and no account.

• The host is a source of your information. A host can upload or import their guest list (email, name, company, title and LinkedIn link), or share an invite link where you give your name and email yourself. The host must have the right to share their list and tell guests about OneHop; our Terms require it. OneHop then emails you your personal pass, sent in the host’s name “via OneHop”, plus reminders and a recap about that event.
• What you choose to share. When you open your pass you agree to the event’s privacy notice, then confirm your LinkedIn link or your title and company, and may add up to three goals, a short offer and answers to the host’s questions.
• Who sees you. The host sees the full guest list, including emails, check-in status and your answers, and can export it and add guests to their own OneHop network. Other guests see you only once you have joined, and never if you choose to hide yourself: your name, role, company, goals, offer and photo, never your email.
• Your photo is the public profile photo from your confirmed LinkedIn link or your own OneHop profile. It is shown only to you, to guests in the room and to your Rounds group.
• Profile completion. If the host has set a budget for it, we complete your public professional profile from the LinkedIn link you confirmed (never from a link that only the host supplied).
• “Who to meet”, Ask the room and Rounds. We suggest people to meet from what guests shared. Ask the room lets you ask a question and get people suggested by AI from the guests’ cards (never emails); your questions are visible only to you. Rounds are timed small-group conversations the host runs; AI may suggest a question for the group.
• Check-in. The host scans the entry code on your pass, which carries a random code, not your details.
• After the event. The recap shows who you met. If you have an account, you can add people you met to your own network (their name, company and role, and their LinkedIn link only if they confirmed it). They are not notified. A host may also invite guests to join their community. Pass links stop working 30 days after the event. “Leave event” deletes your answers, goals, offer, matches and questions; the host keeps their guest-list entry for you.

6. Communities

• Your visibility choice. When you join a community you choose who there can see you: Private (only the community team knows you joined, and sees just your name, role and company), Community team only, or Members. Separately, you decide whether to share your email and phone. Nothing is pre-selected, and we record your choice. Change it any time in Settings → Privacy.
• What operators see. The community team sees members as their choices allow, the chapters and tags members belong to, event attendance, intro and ask activity in the community, and community analytics. Analytics are counts and trends, plus lists that help the team look after members (for example, who has gone quiet). Operators never see your private network, your notes or your messages.
• Chapters and tags (such as a city, office, role or interest) are set by you or by the community team, and are visible according to your visibility choice.
• Slack, Discord, Circle and Mighty. If an operator connects their workspace, we read new public posts in the channels they choose (never private channels or direct messages) to spot asks and offers. A notice is posted in each channel. Raw posts are deleted after 30 days, and anyone can opt out with a command, which deletes their stored posts straight away.
• People in a connected Slack. For the community’s organisers we also keep a list of who is in the workspace (name, title, photo, timezone, and email where Slack shows it to apps), how active people are in the channels OneHop is in, and a few details from introduction posts in the channels the organiser marks as intro channels (role, company, what they’re working on, who they want to meet, what they can help with). We never keep the post itself. We use this to suggest who should meet. If you join the community on OneHop with the same email, we show you what we read and you choose whether any of it goes on your profile. Typing /explorer optout in that Slack wipes what we hold about you from it, whether or not you have a OneHop account.
• People in a community’s WhatsApp chats. An organiser who runs their community in WhatsApp can link groups they’re in, from their own OneHop Desktop, to their community. We then keep, for the community’s organisers, who is in those groups and how often they post (never what they say). We keep your number only as a one-way code, so we can recognise you if you join; organisers never see it. They see your name only for groups they admin. In a group the organiser marks as its introductions chat, we read each introduction once for a few details (role, company, what you’re working on, who you want to meet, what you can help with) and keep only those, never the message; we don’t do this for people in the EU, EEA or UK. The organiser posts a note in each group with a link to join and a link to opt out: opting out at /whatsapp-optout removes what we hold from those chats and keeps you out, whether or not you have a OneHop account. If you join, we show you what we read and you choose whether any of it goes on your profile.
• The operator’s responsibility. The community operator decides how the community is run and is responsible for how they use member information they see. Our Terms limit them to running the community.
• When a community closes, its community data is deleted 30 days after the closing date. Members keep their own accounts.

7. Sensitive information

We do not ask for sensitive information (health, religion, political opinions, sexual orientation, racial or ethnic origin, trade-union membership, criminal record, biometrics). Your imports may still contain some, for example a calendar event title, a message, or an event you went to. We use it only to show it back to you, and never share it with other members.

We do not infer or store sensitive characteristics about anyone, member or not: health, religion or beliefs, political opinions, sex life or sexual orientation, racial or ethnic origin, trade-union membership, genetic or biometric data, or criminal history. Every interest, grouping label, fact or other attribute OneHop derives, and every fact your AI assistant asks OneHop to remember, is checked before it is saved, and anything that would reveal one of these is dropped. Interests we suggest from events you went to are visible only to you, are never shared with other members, and you can delete them. If you ever see a label that reveals a sensitive characteristic, tell us at privacy@onehop.network and we will remove it and fix the cause.

8. How we use information, and our legal bases

Under the APPs we use personal information for the primary purpose it was collected for, or a related purpose you would reasonably expect. Under the GDPR each use needs a legal basis. Both are set out here:

9. Who can see what

By default, only you can see your network. Your people, notes, messages, strength scores and history are private to your account. Email addresses and phone numbers you add for someone are visible only to you, even if another member holds the same person. Public professional details on a person (name, headline, company, LinkedIn link, photo) may also be seen by other members who have that same person in their own network.

Features that involve other members (all opt-in)

• Intro paths and introductions. If you and another member have both switched on introductions, OneHop can tell them that you know someone they want to meet. They see only that person’s name, role, company, public profile link and a coarse strength band (for example “close”). They never see your notes, messages, other contacts, or exact scores. Nobody is introduced through OneHop unless the member who knows them agrees to make the introduction, and we ask connectors to check with the other person first (a double opt-in introduction).
• Introductions a member makes. When a member introduces two people, each of them sees the other’s name and role, the introducer’s reason, and any line the introducer wrote about either of them. Email addresses are shared only in the introduction email itself. A member can instead tell us they have already asked someone. We record that they said so, in the words they ticked, and the introduction tells that person how to stop these emails and how to tell us they didn’t agree. To find a time, the person giving their time can say which times of day suit them. If they have connected a calendar we read it only to hide the times they are busy, and we never write to anyone’s calendar: a booked time arrives as a calendar invitation by email. The page for picking a time shows names, the times on offer and where to meet, nothing else. To write a time clearly for both people we use the time zone each browser reports or, when someone hasn’t opened a page yet, the location on the profile the introducer has for them. We keep a record of each yes, no and stop: what was agreed, when and in which words, with one-way hashes of the email address and the IP address it came from, and the browser used.
• Goals, asks, offers, Envoy and goodwill. What you post is visible to the audience you choose. Envoy screens incoming requests for you and suggests a response. It declines on its own only where you told it to (for example, requests from people you blocked, or requests that match none of the topics you said you are open to); otherwise you decide. Goodwill scores are relative to the person viewing them, are never public and are never exported.
• Good karma (being tested with a small group of members). When someone confirms that you helped them (an introduction that proved useful, help with an ask, an offer you followed through on), OneHop records it as karma: thanks you can send with an introduction request, put behind an ask, or pass on to another member. Your karma and where it came from are visible only to you. Other members can see one thing: how many people have said you helped them in the last 12 months, shown to a member you send a request to. Karma you send with a request or an ask is shown to the people it is for. If you tell us an introduction was useful, the member who made it may be told that it helped; anything you write in the note stays with you.
• Communities and events. As described under Communities and Events.
• Contact card. Your public card shows only what you choose to put on it.
• “Is this also you?” If another member’s address book has a handle that may belong to you, we may ask you to confirm it. We never show that suggestion to anyone else.

Switch any of these off in Settings → Privacy and your information stops appearing in them straight away.

Our staff

A small, named team can access production systems, through single sign-on with multi-factor authentication. They do so only to support you (with your permission), to keep the service secure, or to comply with the law. Staff changes, and any “view as” session in which a staff member sees the product as a member sees it (read-only), are recorded in audit logs.

If you turn on Help improve OneHop’s answers in Settings → AI, the team can also read what your AI assistant asked OneHop and what OneHop sent back (the people’s names, roles, relationship words and reasons), to check how well the answers worked and improve search. It is off unless you turn it on. It never includes your notes, messages, chat topics or the facts your assistant saved about you, it is kept 90 days, and turning it off deletes it at once.

Outside OneHop

• Service providers who process data for us under contract (see Service providers).
• Your AI assistant, at your direction. If you connect Claude, ChatGPT or another assistant, it can search your network and read people’s names, roles, public profile links, strength bands and the reasons behind suggestions, and your goals and introductions. It never receives your notes, email or message text, contact details or raw scores. It can save notes, goals and facts about you, and (only if you allow it for that connection) prepare introduction requests and asks for you to approve in OneHop. You can see and revoke it in Settings → AI, and choose there whether our team may review its questions and OneHop’s answers (see Our staff). Your assistant’s provider (for example Anthropic or OpenAI) handles what it receives under its own terms and privacy policy, not ours, so check those before you connect.
• Other services you direct us to, such as a calendar you export to or a digital wallet pass you add.
• Law enforcement and courts, only when legally required. We will tell you first unless the law forbids it, and we challenge requests that are overly broad.
• A buyer or successor if OneHop is sold or merged. They must honour this policy, and we will notify you before your information becomes subject to a different one.

10. Service providers and overseas disclosure

Your OneHop database is stored in Sydney, Australia. Some providers process information elsewhere, as listed below, so it may be disclosed to recipients in those countries. Each one provides its service to us under contract. Australia does not have an EU or UK adequacy decision. So for information covered by the GDPR or UK GDPR, we use, or are putting in place, the EU Standard Contractual Clauses and the UK Addendum with each provider, or rely on an adequacy decision where one covers that provider. Ask privacy@onehop.network for details or a copy of the safeguards. Under APP 8 we take reasonable steps to make sure overseas recipients handle it in line with the APPs, and we remain accountable for how they do.

We give members at least 30 days’ notice before adding a provider that processes personal information. Email privacy@onehop.network to receive that notice. If you object and we cannot address it, you can close your account and receive a pro-rata refund of prepaid fees.

Services you or a community operator connect are sources you control, not our processors, and their own privacy policies apply: Google and Microsoft (United States), HubSpot (United States), Attio (United Kingdom and United States), Apollo (United States), Slack (United States), Discord (United States), Circle and Mighty Networks (United States), Just Say Hey, and your AI assistant’s provider. When you connect one, information flows between it and OneHop at your direction.

Voice typing. If you press the microphone in a text box, your browser turns your speech into text using its own speech service, which usually means sending the audio to the browser’s maker (Google for Chrome, Apple for Safari) under their privacy policies. OneHop never receives or stores the audio, only the words that land in the box, and only if you then save them. It never runs unless you press the microphone.

Places on the map. When you open Places on the Map tab, your browser loads the background map (streets, coastlines, place names) from OpenFreeMap, a free public map service. Like any website your browser visits, it sees your IP address and which part of the world you are looking at. It never receives your people, their locations or anything else from your account: OneHop draws those on top of the map itself.

11. Artificial intelligence

• AI powers Ask, search, summaries, draft messages, explanations of why someone is a good fit, matching for goals and events, Ask the room, classification of community posts, and Envoy. Text written by AI is labelled as such.
• When a feature needs a model, we send only the information needed for that request. Our AI providers process it under business terms that forbid training on it and limit how long they keep it (OpenAI keeps API data for up to 30 days for abuse monitoring, then deletes it).
• We do not train, fine-tune or improve any AI model, ours or anyone else’s, with your data or the data of people in your network.
• Email-content features and relationship context in OneHop for desktop are off until you turn them on. Meeting-note summaries start on for accounts created since November 2026 outside the EU, EEA, UK and Switzerland; everywhere else, and for older accounts, they are off until you turn them on. You can turn them off any time in Settings → Privacy, which deletes what they made.
• AI output can be wrong. Treat it as a suggestion, and use the sources OneHop shows you to check it before you rely on it.
• Notes, email text and message previews are treated as data, never as instructions to the model, so text inside them cannot make OneHop act on its own.

12. Profiling and automated decisions

OneHop uses automated processing to rank and suggest people, estimate relationship strength and how it fades, match goals, asks and offers, suggest who to meet at an event, match a contact to a public profile, and screen introduction requests (Envoy). The inputs are interaction metadata (how often and how recently you were in touch, and in which direction), the coded signals from relationship context if you turn it on, shared employers, schools, communities and events, roles and seniority, and what people have said about their goals and offers.

None of these produces a decision with legal or similarly significant effects on anyone. They are suggestions to you. A person always decides whether to make or accept an introduction. Envoy declines a request automatically only under rules the member set, and profile matches wait for your confirmation.

Good karma and members who are in demand. OneHop works out that a member is receiving a lot of introduction requests from the number of requests naming them in the last 30 days and a short list of job titles. A request to them then asks the sender for some karma and, for the busiest, that at least three people have said the sender helped them this year. This is a fixed rule, not a model. The sender is shown it before sending, with what would change it. It is never shown on anyone’s profile, and it limits one route to one person for a time, not what anyone can do on OneHop. A member’s Envoy applies the same rule to requests from people they don’t know unless they switch that off, and sends karma with their own requests only up to a limit they set.

You can correct any score or label, hide a suggestion, or switch off the feature. Anyone, member or not, can ask us to explain an automated outcome that involves them, object to it, or have a person review it by writing to privacy@onehop.network.

13. How long we keep information

Details completed from a paid or public-source look-up run on two clocks. After 12 months we mark them as possibly out of date; we refresh them only if you ask and approve the cost. 24 months after your last contact with that person (the latest message, email, meeting, note or introduction between you), we delete what the look-up supplied and keep the person, their name, their LinkedIn address and anything you added yourself. You can delete these details sooner, and anyone can ask us to remove theirs (see Your rights).

When you close your account, people that only you held are deleted. People that other members also hold stay in those members’ networks, but everything you added about them (notes, emails and phone numbers, scores, tags) is deleted, and so are the details you gave about yourself. Security records about your account are kept for their 12-month window.

14. Security

• Encryption in transit (TLS) everywhere; encryption at rest for the database and backups; OAuth tokens and two-step verification secrets separately encrypted.
• Two-step verification (authenticator app, passkeys and recovery codes) is optional and available to every member, and we recommend it.
• Sign-in sessions last up to 14 days, and you can sign out of every device at once in Settings.
• Every database query is scoped to its owner; features that cross between members are enforced in the database and covered by automated privacy tests.
• Rate limits on sign-in, sign-up, privacy requests, contact cards, event pages and other sensitive actions, with temporary lock-outs after repeated failures.
• A security log records sign-ins and failed attempts, two-step verification changes, exports, deletions, consent changes and admin actions. It holds IDs, a hashed IP address and the browser user-agent, never message content.
• Staff access is limited as described under Our staff.
• If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. Where the GDPR applies, we notify the relevant authority within 72 hours.
• Found a vulnerability? Please report it to security@onehop.network. We will not pursue good-faith research that respects our members’ privacy.

No system is perfectly secure, but we will always tell you honestly what happened and what we did about it.

15. Consent and choices

When you sign up you tick, yourself, that you agree to the Terms and this policy and that you are 18 or older. Those boxes are never pre-ticked. Outside the EU, EEA, UK and Switzerland, a new account also starts with AI meeting-note summaries and product news email on: the sign-up screen says so, and you can turn each one off at any time. Every consent or default, and every change you make (introductions, AI meeting-note summaries, email content for a mailbox, marketing email, community visibility and sharing) is recorded with its date, the version of the wording, a one-way hash of your IP address and your browser’s user-agent. Earlier records are never overwritten. You can see and change your choices in Settings → Privacy.

When we change the Terms or this policy materially, we update the version and ask you to accept the new version the next time you sign in. Your account and privacy settings, including export and deletion, stay available whether or not you accept.

16. Emails we send

• Service emails: sign-in links and verification, security alerts, receipts, deletion confirmations, replies to privacy requests, introduction and ask notifications, event passes, reminders and recaps, and community invitations a member or operator sent. You get these because you use OneHop or were invited to an event or community.
• Digests about your own communities and give-back activity carry a one-click unsubscribe link.
• Introduction emails, including to people who aren’t members. When a member introduces you to someone, OneHop emails you on their behalf: the ask and one reminder, the introduction, a calendar invitation when a time is picked, moved or cancelled, and at most two reminders to pick a time. Each one names the member who asked us to write and has a link to stop all introduction emails to that address. Members who turn on notifications on a device get the reminders there instead of by email. Notifications are optional, set per device, and switched off in the same place. They travel through the push service of your browser’s maker (Apple, Google or Mozilla, for example), encrypted so that service can’t read them.
• Emails about OneHop after an introduction. If you aren’t a member, the page where you answer an introduction has a box, left unticked, to get three emails about OneHop. We send them only if you tick it. Each has a one-click unsubscribe, and they stop if you join.
• Marketing email (product news and offers) is on for accounts created since November 2026 outside the EU, EEA, UK and Switzerland, and the sign-up screen says so. Everywhere else, and for older accounts, it is sent only if you opt in. Either way it is separate from the Terms, and you can turn it off in Settings → Privacy. Every marketing email identifies us as the sender, including our business name, ABN and postal address, and has a one-click unsubscribe that takes effect straight away.

17. Your rights

Whether or not you are a member, you can ask us to:

• Access the personal information we hold about you, and get a copy in a portable format.
• Correct anything inaccurate, out of date or incomplete.
• Delete it. Members can also remove individual sources.
• Object to profiling or to public-source look-ups.
• Restrict how we use your information, for example while you check its accuracy or while we consider an objection. We keep what is held but stop the processing we do on top of it: no public-source or paid look-ups, no inferences, no matching across members, and no appearing in introduction paths. Members switch this on in Settings → Privacy; anyone else asks at /privacy/your-data. We tell you before we lift a restriction.
• Withdraw consent for any opt-in feature, at any time, without affecting what came before.
• Opt out for good. We add you to our opt-out (suppression) list so our importers skip you and no member can trigger a look-up about you again.
• Remain anonymous or use a pseudonym when you contact us, where that is practical.

Members

• Download your data as JSON or as CSV files from Settings → Account. It contains everything your account holds, except contact details that other members added about people.
• Close your account from Settings → Account. We sign you out everywhere and hide you from other members straight away, and email you a link to undo it within 7 days. After that we delete your data as described under How long we keep information.

People who aren’t members

Use the form at /privacy/your-data. For a deletion, we email a confirmation link to the address you give and act once you click it. We then delete everything we hold about you as controller (details from public sources, contact details we looked up, inferences, and any match of you across members) and, if you ask, add one-way hashes of your identifiers to our suppression list, which our importers and look-ups check. A member’s own records of you, such as their address book or their inbox, belong to them, just like their phone’s contacts do. You can ask them directly, and we will pass your request on if you want us to.

If a member introduced you through OneHop, every email about it has a link to stop introduction emails to your address, and the same page lets you tell us you didn’t agree to the introduction. We tell the member, and after two such reports they can no longer say they have already asked someone.

We confirm it’s you before acting, separately for each thing we hold about you: a link to your email, a text-message code to a phone number we hold, or, if we hold anything we can’t confirm that way (such as a LinkedIn profile), a photo of ID through a secure upload page. Only our privacy team sees it, it is stored encrypted, and we delete it once we’ve decided, within 30 days at the latest. We never show or delete anything linked to something you haven’t confirmed. We respond within 30 days, at no cost; if a request is complex we may take up to two more months, and we’ll tell you why within the first month. If we refuse a request, we will tell you why and how to complain. We will never treat you worse for exercising a right.

Complaints

You can complain to us about how we handle your information, whether or not you are a member: choose “Make a complaint about how you handled my data” on the form at /privacy/your-data, or write to privacy@onehop.network. We acknowledge every complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to a regulator: in Australia, the Office of the Australian Information Commissioner (which usually expects you to have raised it with us first); in the UK, the Information Commissioner’s Office; in the EU, the data protection authority where you live or work, or where you think the problem happened; or in the United States, your state Attorney General.

EU and UK residents

You also have the right to data portability and to object at any time to processing based on legitimate interests. We rely on the legal bases set out under How we use information. Transfers out of the EU or UK are covered under Service providers.

United States residents

In the last 12 months we have collected the categories described under What we collect: identifiers, professional and employment information, commercial (billing) information, internet activity on our service, and inferences. We disclose them only to the service providers listed under Service providers, for the business purposes listed under How we use information. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics. We honour the Global Privacy Control signal from your browser as an opt-out of any sale or sharing (we do neither), and we don’t count your visits to public contact-card pages while it is on. You may use an authorised agent. If we deny your request you can appeal by replying to our decision. We will answer the appeal within 45 days.

18. Google user data

OneHop’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Gmail, Contacts, Calendar and Docs data only to provide and improve the features you see in OneHop: your network, relationship signals, reminders, meeting context and search.
• We do not use it for advertising, to build profiles for anyone else, or to determine creditworthiness, lending or insurance eligibility.
• We do not use it to develop, improve or train generalised AI or machine-learning models.
• We transfer it only to the service providers needed to run those features (see Service providers), to comply with law, or as part of a merger with your notice.
• Nobody at OneHop reads it unless you ask us to for a specific item, it is needed for security or to comply with law, or it has been aggregated and anonymised.
• Disconnecting Google in Settings deletes the email, contact and calendar data we obtained from it. You can also revoke access at myaccount.google.com/permissions.

19. Cookies and local storage

We use only what the service needs to work:

• a sign-in session cookie (up to 14 days), and a two-step verification cookie that remembers a completed check on that device (7 days by default);
• an event-pass cookie, so a guest stays signed in to their event without an account;
• preference cookies for choices you make (for example, trying a preview feature, or the community and chapter view you last used);
• your browser’s local storage, for conveniences such as saved map views and offline use of the app.

Public contact-card pages count visits without storing anything on your device, and skip counting entirely if your browser sends the Global Privacy Control signal. No advertising, cross-site tracking or third-party analytics cookies. Because they are all strictly necessary, we don’t show a cookie banner. If that ever changes, we will ask first.

20. Children

OneHop is for adults. You must be 18 or older to create an account, and we do not knowingly collect information from children. Event guests who join without an account confirm they are 18 or older. If you believe a child’s information is in OneHop, tell us and we will delete it.

21. Other platforms and links

OneHop imports only data that platforms provide to you for export, or that they offer through official connections you authorise. We are not affiliated with, endorsed by, or sponsored by LinkedIn, Google, Microsoft, Meta, X, TikTok, Apple, Slack, Discord or any other platform we mention. Links to other sites are governed by their own policies.

22. Changes to this policy

We will post every change here and update the date at the top. For material changes we will email members, show a notice in the app at least 30 days in advance, and ask you to accept the new version when you next sign in (see Consent and choices). We will not apply a less protective change to information we already hold without your consent. Previous versions are available on request.

23. Contact us

Privacy officer: privacy@onehop.network
General support: support@onehop.network
Security reports: security@onehop.network
[ENTITY NAME] (ABN [ABN]), [REGISTERED ADDRESS], Sydney, New South Wales, Australia