Privacy Policy

This policy explains what OneCey (Pvt) Ltd ("OneCey", "we") collects about you as a customer using the OneCey customer portal (onecey.app/portal) and Vehicle Connect, how we use it, and who we share it with. It doesn't cover a business's own internal use of OneCey to run their shop — see our Terms of Service for how that fits together.

Account information. Your name and mobile number (verified by a one-time SMS code — we never see or store a password, because there isn't one), and, if you choose to add them, an email address and profile photo.

Your history with each business. When a business adds you as their customer, they keep their own record of your bills, credit balance, cheques, and any notes they've added — this is data the business itself creates and controls; OneCey stores and displays it back to you on their behalf.

Messaging preferences. Whether you've opted in to SMS and WhatsApp messages, set per business.

Vehicle Connect. If you register a vehicle: its registration number and the QR code generated for it, your push-notification subscription (so your browser can receive alerts), and the alert history for that vehicle. The person who scans your sticker and sends an alert stays anonymous to us — we don't ask them for a name or phone number, and none is stored.

Location — only if you ask us to use it. Discover's "use my location" button reads your device's GPS position once, on tap, to sort nearby businesses. That coordinate is kept in your browser only (never sent to or stored on our servers) so it's remembered on your next visit; searching an area by name instead sends only the place you typed, the same way any map app would.

Link clicks. If a business's SMS or WhatsApp message includes a tracked link, we record that a click happened and roughly when, so the business can see whether their messages are being read. We use a salted, one-way hash of the visitor's IP address to filter out bots and duplicate clicks — we don't store the raw IP address itself.

Technical data. Standard things any web app collects to run reliably and securely — sign-in timestamps, device/browser type, and push-notification delivery status.

• To run your account: sign you in by OTP, show your bills and balance with each business, and keep your profile up to date.
• To deliver messages and alerts — OTP codes, business SMS/WhatsApp messages you've opted into, and Vehicle Connect push notifications.
• To power Discover's nearby search and the QR codes and printable stickers/posters we generate for you.
• To prevent fraud and abuse — rate-limiting, spotting fake Vehicle Connect reports, and similar safeguards.
• To fix bugs and improve OneCey.

We don't use your data to build advertising profiles, and we never sell it.

The businesses you're a customer of. Each one sees only your history with them — never your activity with other businesses on OneCey.

Service providers who help us run OneCey, bound to only use your data to provide their service to us:

• Our SMS gateway, to deliver OTP codes and business SMS messages.
• Meta's WhatsApp Business Platform, to deliver business WhatsApp messages you've opted into.
• Our database and hosting providers (Supabase and Cloudflare), who store the platform's data and run the app.
• Google Maps/Places, only when you use Discover's map or search-an-area feature.

Legal reasons. If required by law, to enforce our terms, or to protect the rights and safety of OneCey, our users, or the public.

We never sell your personal data to third parties or advertisers.

We keep your account and message data for as long as your account is active. If you close your account, we remove your ability to sign in; a business you've bought from may still need to retain records of past bills and payments for accounting and legal reasons, in the same way a paper receipt would survive you no longer shopping there.

• View and edit your name, email, and photo any time in Settings.
• Turn messages on or off per business, per channel, from that business's page in your account.
• Close your account by emailing contact@onecey.app — see section 12 of the Terms for what that does and doesn't remove.
• Ask what we hold about you, or ask us to correct it, by emailing contact@onecey.app.

Sign-in uses a one-time code sent to your mobile number rather than a password, so there's no password for us to lose or for someone else to guess. Push notifications for Vehicle Connect are end-to-end encrypted between our server and your browser. Access to customer data is scoped so a business can only ever see its own customers, enforced at the database level, not just in the app.

No system is completely immune to risk, and we can't guarantee perfect security — but this is how we minimise it.

OneCey isn't intended for anyone under 18 without a parent or guardian's involvement — see section 3 of the Terms.

We'll update the date at the top of this page whenever this policy changes, and let you know in the app for anything significant.

Questions, or a request about your data? Email contact@onecey.app or call 076 287 6236.