Privacy policy

Scope and responsibility

This is the privacy policy for 1Workspace, the work-management service available at 1workspace.in, app.1workspace.in, and workspace subdomains of 1workspace.in. 1Workspace (“we”, “us” or “our”) is responsible for the account, authentication and service-operation information described below. You can contact the 1Workspace privacy team at hello@1workspace.in.

A workspace owner or administrator controls the content placed in that workspace and decides who can access it. For that content, 1Workspace processes information on the workspace customer’s behalf. Requests about workspace content should normally be directed to that workspace’s owner or administrator; requests about your 1Workspace account can be sent directly to us.

Information we collect

Account and profile information

• Name, email address, display name, profile image, timezone and preferences.
• A password hash if you create a password; we do not store the password itself.
• Linked sign-in provider, provider account identifier, linked email address, and the date the account was linked or last used.
• Two-factor authentication credentials and recovery-code hashes if you enable that feature.

Workspace content

We collect the information you or other authorized users add to 1Workspace, including workspace and member details, tasks, comments, documents, chat messages, files, whiteboards, forms and responses, meeting details, dashboards, time records and configuration settings. The people in a workspace can see this content according to the roles and permissions set by that workspace.

Usage, device and security information

• IP address, browser, operating system, requested page or workspace hostname, timestamps and ordinary server logs.
• Sign-in attempts, active sessions, device or browser details, and security events used to prevent abuse and investigate incidents.
• An audit trail of actions within a workspace, visible to authorized workspace administrators.
• Email delivery status, error reports and performance information needed to operate and support the service.
• For calls, participants and timing. Audio, video or screen content is stored only when an authorized participant starts a recording.

Google user data

1Workspace offers two separate Google connections: Google sign-in and an optional, read-only Google Calendar connection. We use Google OAuth, so you authorize access on Google’s consent screen and never give 1Workspace your Google password. The consent screen shows the permissions requested before you choose whether to continue.

Google sign-in and account linking

When you sign in with Google or link a Google account, 1Workspace requests the openid, email and profile scopes. We access your Google account’s stable identifier, email address and email-verification status, name, and profile picture. We use this information only to create or authenticate your 1Workspace account, link the Google identity you selected, fill basic profile details, and protect accounts against unauthorized access. We retain the linked identity details while the Google account remains linked or the 1Workspace account remains active. The Google access token used during sign-in is not retained after the sign-in flow finishes.

Google Calendar

If you separately choose to connect Google Calendar, 1Workspace requests https://www.googleapis.com/auth/calendar.readonly, together with openid and email. This permits read-only access to your primary calendar. 1Workspace cannot create, edit or delete events in Google Calendar.

For the date range you open in 1Workspace, we retrieve up to 250 current events directly from Google and display their event identifier, title, start and end time, all-day status, location, Google Calendar link, your response status, free/busy status, and organizer email address. We use these fields only to overlay your Google events on your 1Workspace calendar and help you view availability alongside your work. Calendar event details are requested live and are not copied into the 1Workspace database.

To keep the optional Calendar connection working, we store the connected Google account email, granted scopes, token expiry, last successful read time, any connection error, and Google OAuth access and refresh tokens. The tokens are encrypted at rest with AES-256-GCM, are never returned to the browser, and are used only by 1Workspace servers to make the calendar requests you initiated.

Google data limitations

We do not access Gmail messages, Google Drive files, Google Contacts, or your Google password. We do not use Google user data for advertising, retargeting, credit decisions, sale to data brokers, or to develop, improve or train generalized artificial-intelligence or machine-learning models. We do not permit people to read Google user data except when necessary to provide or secure the feature, comply with law, or when you have given explicit consent.

1Workspace’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How we use information

• Provide the service: create accounts and workspaces, authenticate users, display and route workspace content, run requested features, and provide exports.
• Communicate: send invitations, mentions, security messages, password resets, service notices, and notifications you have enabled.
• Protect 1Workspace: prevent fraud and abuse, enforce access controls and rate limits, maintain audit records, and investigate security incidents.
• Maintain and improve the product: diagnose errors, monitor reliability and understand feature performance. Google user data is used only to provide or improve the user-facing features described in this policy.
• Comply with law: maintain records and respond to valid legal obligations.

We do not sell personal information. 1Workspace does not run an advertising network and does not use personal information or Google user data for personalized advertising.

How we share information

We disclose information only in the following limited circumstances:

• People you authorize: workspace content is shared with workspace members and guests according to the roles, Space permissions and sharing settings selected in 1Workspace. A personal Google Calendar overlay is not added to workspace content.
• Service providers: infrastructure hosting, database and file storage, transactional email, error monitoring, customer support, and audio/video call providers process only the information needed to perform services for us. They act under contractual confidentiality and data-protection obligations and may not use Google user data for their own purposes.
• At your direction: when you enable an integration, export information, publish a calendar feed, or otherwise ask 1Workspace to send information to another service.
• Legal and safety reasons: when reasonably necessary to comply with law or valid legal process, protect users, investigate abuse, or defend the rights and security of 1Workspace and others.
• Business transfer: as part of a merger, financing, acquisition or sale of assets, subject to this policy and appropriate confidentiality protections.

We do not transfer or disclose Google user data to third parties for advertising, sale, data-broker services, credit or lending decisions, or generalized AI or ML model training.

Retention and deletion

• Google sign-in data: the provider identifier, email, name, profile image and link history are kept while the identity remains linked to your active 1Workspace account. Unlinking Google deletes the linked-identity record, provided you have another way to sign in.
• Google Calendar data: event details are read live for the requested date range and are not stored in the 1Workspace database. OAuth tokens and connection metadata are kept only while the Calendar connection remains active. Disconnecting Google Calendar in 1Workspace immediately deletes the stored connection record and its encrypted tokens.
• Workspace content: retained while the workspace is active or as directed by its owner, then deleted or de-identified subject to backup cycles, security needs and legal requirements.
• Account and security records: retained while the account is active and, where necessary, for a limited period afterward to prevent fraud, resolve disputes, enforce agreements and comply with law.
• Backups: deleted information may remain in access-restricted backups until those backups are overwritten through the ordinary backup cycle; it is not restored to the live service except for disaster recovery.

You can also revoke 1Workspace’s access from your Google Account connections. Revoking access stops future Google API access; to remove the encrypted tokens and connection metadata from 1Workspace immediately, also disconnect the integration in 1Workspace settings or email us at hello@1workspace.in.

Your choices and rights

You may access or correct your profile in the product, change notification preferences, disconnect Google Calendar, unlink a Google identity after adding another sign-in method, and ask a workspace administrator for an export or deletion of workspace content. You may also ask us to provide a copy of account information, correct it, delete it, restrict or object to processing, or provide it in a portable format where applicable.

Send a request from the email address associated with your account to hello@1workspace.in. We may need to verify your identity before completing it. We will respond within the period required by applicable law. Some information may be retained where required for security, legal compliance or the rights of others. Depending on where you live, you may also complain to your local data-protection authority.

Cookies and local storage

The public marketing site at 1workspace.in does not set cookies or run advertising pixels. The 1Workspace application uses strictly necessary session cookies to keep you signed in and protect your account. These cookies are marked HttpOnly and Secure where applicable. The application may use browser storage for device preferences such as theme, last workspace and unsent drafts. Removing this information may sign you out or reset those preferences.

Security

We use administrative, technical and organizational measures designed to protect personal information. These include TLS for information in transit, AES-256-GCM encryption for stored integration credentials, one-way password hashing, least-privilege access controls, tenant and Space permissions, secure session cookies, optional two-factor authentication, rate limiting, and audit logging. Access to production systems and personal information is limited to people and providers who need it to operate, support or secure the service. No security measure can eliminate every risk; if a breach creates a legally reportable risk, we will notify affected users and authorities as required by law.

International transfers

1Workspace and its service providers may process information in countries other than yours. Where applicable law requires a transfer mechanism, we use recognized safeguards such as standard contractual clauses or another legally valid basis.

Children

1Workspace is intended for workplaces and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, contact us and we will investigate and delete it where required.

Changes to this policy

We will update the date at the top when this policy changes. If a change materially affects how we use Google user data or other personal information, we will provide additional notice in the product or by email before the change takes effect when required. We will request new consent before using Google user data for a materially different purpose.

Contact

For privacy questions, requests or complaints, contact the 1Workspace privacy team at hello@1workspace.in. Please include enough detail for us to identify the account or workspace involved, but do not send passwords, OAuth tokens or other authentication secrets by email.