1code Studio Privacy Policy

Who we are

1code Studio is one website, 1code.studio. It shows the country section for the country you give in your account. 1code.co.za is the South African door to the same website, and 1code.uk the UK door.

1CODE X LTD is a company registered in England and Wales, company number 12828341, at 2 Centurion Way, Credenhill, Hereford HR4 7FF, United Kingdom. It operates 1code ID and 1code Mail for everyone, runs 1code Studio, and publishes the 1code phone app on Google Play. It decides what personal information is collected and why. That makes it the controller of your information (the "responsible party" in South African law), wherever you live.

1code X (Pty) Ltd is a company registered in South Africa, registration number 2025/981275/07, at 2 The Circus St, Three Rivers, Vereeniging 1935, South Africa. People who live in South Africa contract with it for everything they use and buy on 1code, and it bills them in rand through Paystack. It uses 1CODE X LTD to run 1code, including 1code ID and 1code Mail, for them. It handles the information it needs for this on behalf of 1CODE X LTD and under its rules.

Everyone outside South Africa contracts with, and is billed by, 1CODE X LTD, through Stripe.

Our team works from South Africa.

In this policy, "1code", "we" and "us" mean 1CODE X LTD, and for contracts and billing in South Africa also 1code X (Pty) Ltd. "You" means the person using 1code.

This policy applies to all of 1code: Docs, Sheets, Slides, Pdf, Drive, Mail, Channels, Rooms, Calendar, Project, Store, Books, 1code ID and the 1code phone app. It also covers the 1code connector and the developer API.

When you are in charge of the information

Sometimes you, not we, decide what happens to other people's information. Then you are the controller (or responsible party) and we handle that information for you, only on your instructions. Our Terms of Service contain the data processing agreement for this, under Article 28 of the GDPR and the UK GDPR and section 21 of South Africa's POPIA.

This applies to:

• Company mailboxes. Addresses like name@company.1code.email belong to the company. The company can see and close them.
• Your audience in Rooms. The people who sign up for, join or pay for your presentations, meetings and rooms, and the people who watch what you share.
• Your shoppers in Store. The people who buy from your online store or fill in forms on your website.
• Your clients in Books. The people and businesses you send invoices to.
• Your workspace. The people you invite and the content they add, where you run the workspace for your organisation.

If you are in someone else's audience, mailbox, store or client list and have a question about your information, ask them first. If they do not answer, write to us and we will help.

What we collect

We collect only what each app needs to work. Here it is, app by app.

Your 1code account and 1code ID

You sign in to every 1code app with 1code ID. There is no password. In the 1code phone app, you sign in with your phone and your fingerprint or face. On the web, you may get a one-time code by email, or a request to approve the sign-in on your phone.

• Account: a username you choose. An email address only if you add one, kept only once you verify it. Your language, time zone and country, if you give them.
• Your phone: the public half of the key your phone creates, the certificate we issue for it (serial number and dates), the type of phone, what protects the key, and a device name you can set. The private key never leaves your phone.
• Sign-in approvals: which app or website asked, when, the identifier we released for you, and what you agreed to share.
• Recovery: the people you choose as key holders, the invitations you send, and any recovery requests with who confirmed them and when.
• Security and activity records: the time, device and action for sign-ins and important changes, such as adding a phone or starting a recovery.
• Identity checks for other businesses: if a business asks you to prove who you are, you can photograph an identity document. The images go to that business's verification service, which is named on screen first. 1code ID keeps no copy.

We never receive your fingerprint or face. See "The 1code phone app" below.

Docs, Sheets, Slides, Pdf, Drive and Project

• Your content: documents, sheets, decks, PDFs, videos, recordings, pictures, notes, boards and Kanbans, with their titles, folders, comments, checklists, due dates and earlier versions.
• Sharing: who you share with and what they may do.
• Storage use: how much room your files take.
• Workspaces: your workspaces, their members and their roles, and your settings.

Mail

• Account: your 1code ID identifier, your name and your addresses.
• Your mail: messages you send and receive, attachments, drafts, scheduled and snoozed mail, labels, filters, signatures and templates.
• Address suggestions taken from your own mail, and your settings (time zone, language, region).
• Sender checks: the results of SPF, DKIM and DMARC checks on incoming mail, spam reports and the senders you block.
• A sending record for each message: when it was sent, from which address, how many recipients were inside and outside 1code, and whether it was delivered. For mail sent outside 1code, also the sender's 1code ID identifier. We do not keep recipient addresses in this record. We use it to stop abuse and to apply the sending limits in our Acceptable Use Policy.
• Contacts: the name and address of people who write to an address in a workspace, when the sender checks show the mail really came from them, and addresses members add by hand. Addresses on 1code.email write only inside 1code. Addresses on your own domain can write outside 1code only to these Contacts, or reply to an email someone sent them.
• Vacation replies: which senders got your automatic reply, so each gets it only once in a while.
• Companies: the company's name and subdomain, its people and roles, invitations (including the personal email an invitation is sent to), aliases, groups, shared-mailbox access and a log of admin actions.
• Keys for mail apps and AI agents: stored only as one-way fingerprints that cannot be turned back into the key.
• Imports: if you bring old mail across, read-only access to your Google or Microsoft account, stored encrypted and deleted when the import ends, or a mail file you upload, also deleted when the import ends.
• DMARC reports that other mail providers send us about mail using our domains. They include the addresses of sending servers.

Channels

• Your messages, replies and reactions, the files you share, the channels you belong to and who else is in them, and which messages have been read.

Rooms

• Sessions: the rooms you open, the names people type to join, when they joined and left, the chat and questions in the session, and a recording when the host records.
• Your audience: sign-ups (name, email and the answers to questions you set), which session they signed up for, and unsubscribes.
• Paid rooms: who paid, for what and when, and whether the payment went through. Card details go straight to our payment provider. We never see full card numbers.
• Viewing numbers: when someone watches a video you share, we count the view without storing anything on their device. We record the page it was watched on, which parts were played, and the country their connection appears to come from. No name or account is attached.
• Camera, microphone and screen: used only while you are in a meeting with them on, or while you record after pressing record. Everyone in a session is shown when it is being recorded. Live sound and video pass through our provider's real-time network. When a session is not recorded, any short pieces of it that passed through our storage are deleted within a day. When a presenter shows a web page to the room, the page passes through our servers and we keep nothing of it.

Calendar

• Your calendars and events (titles, times, places, notes, repeats and reminders), your settings, and the dates other 1code apps put there for you, such as due dates and scheduled rooms.
• Calendars you add by web address. We fetch them every few hours and show them to you.
• If you turn on a calendar's subscribe link, anyone with that link can see that calendar's events. Replace the link to stop the old one.

Store and free sites

• Your business: your name, email, phone number and business details.
• Identity checks before you can sell: you must pass identity checks (KYC) and add a payout account before you can sell. In South Africa we ask for an identity document, a company registration (CIPC) certificate where you trade as a company, a bank letter and proof of address. These are kept in private storage. Only you, our compliance staff and our payment provider, where it must check them, can see them.
• How identity documents are checked: to save you typing, an AI service working only on our instructions reads the documents and fills in the form fields (your name, ID number, company and bank details). Fixed rules then check those fields against each other. A person on our team reviews and approves every application, so no decision about selling is made by a computer alone.
• Your shoppers' orders: name, email, delivery address and what they ordered. You are in charge of this information (see above).
• Free sites at <name>.1code.host: what you publish. Anyone can see a published site. We count visits from Cloudflare's own server records, without scripts or cookies in your visitors' browsers. If your site collects information from visitors, such as through a form, you are in charge of that information.

Books

• The invoices you create: your clients' names, contact details, billing addresses and tax numbers, what you sold, the amounts and whether they are paid. You are in charge of your clients' information (see above).

Domains

• If you buy a domain through us, we pass your name and contact details to the registrar (domains.co.za or Name.com) and the registry for that domain. Some of it may be published in public domain records where the registry's rules require it.

Billing

• Your plan, your invoices, your billing name and address, and whether each payment went through. Card and bank details go straight to Paystack (South Africa) or Stripe (everywhere else). We never see full card numbers.

When you contact us, give feedback or accept a policy

• Contact form: your name, email, company if you give one, your message, and the country your connection appears to come from.
• Feedback: what you post, the name shown with it, and your votes.
• Acceptance records: which version of each policy you accepted, the country you gave, and when. In 1code ID, also the network (IP) address and the browser or app you accepted from. In Store, also the network (IP) address.

Security records and connection data

• Records of sign-ins, failed attempts and changes to your account.
• The network address of a sign-in attempt, used to limit repeated attempts and forgotten within minutes.
• Our hosting provider sees connection details (IP address, browser, time) as it delivers and protects the service, and keeps them only briefly.
• Until you give your country, we use the country your connection appears to come from to choose which country section and prices to show. We do not store it, except where this policy says so.

Cookies and your browser

We set only what 1code needs to work:

• a sign-in cookie, for up to 30 days unless you sign out;
• a short cookie while you sign in, for up to 10 minutes;
• a cookie that holds the access a shared link gives you, for up to 12 hours;
• a marker that tells a page you are signed in;
• your theme, language and similar choices, kept in your browser.

These do not track you across other websites and are not shared with anyone. We have no advertising or analytics cookies and no tracking scripts from other companies. We count views of shared videos without storing anything on your device. The Cookie Policy (1code.studio/cookies) lists every cookie we use and everything our apps keep in your browser.

Where we get it from

Most of it comes from you. We also get information:

• from other people on 1code, when they share something with you, invite you, add you to a company or choose you as a key holder;
• from people who write to you, when their mail or messages reach your 1code address;
• from services and AI agents you connect, such as Google, Microsoft or Slack;
• from Paystack and Stripe: whether a payment or payout went through, and whether their checks on a seller are complete;
• from domain registrars and registries, about domains you buy through us;
• from other mail providers: sender checks, bounce notices and DMARC reports;
• from your phone and browser, as you use 1code (see "Security records and connection data" and "Cookies and your browser").

Do you have to give it to us?

You choose what you give us. Some things are needed for a service to work:

• An account needs a username and a phone with 1code ID. Without them we cannot give you an account.
• Paying for a plan or a domain needs billing details. Without them you cannot buy.
• Selling needs identity checks and a payout account. Without them you cannot sell.
• A domain needs true contact details, because the registry requires them.

Everything else, such as an email address, a display name or a connected service, is up to you. Leaving it out only means the feature that needs it will not work.

Why we use it

Some laws ask us to name a legal reason (a "lawful basis") for each use. These are ours.

Where we rely on legitimate interests, we weigh them against your rights, and you can object (see "Your right to object" below). Where we rely on your choice (consent), you can withdraw it at any time. That does not undo what we did before you withdrew it.

What we do not do

• We do not sell or rent personal information.
• We do not show ads or use your information for advertising.
• We do not use your content to train AI, and we do not let our providers train on it.
• We do not add tracking scripts from other companies.
• We do not make decisions about you by computer alone that have legal or similarly serious effects. Automated checks may block a single message, file or page that matches known malware, phishing or child sexual abuse material. A person reviews every pause or removal, and you can always ask a person to look again.
• We do not send marketing or bulk email, and we do not let anyone send it through 1code. Emails to a Rooms audience are limited to confirmations, links and reminders, and 1code Studio has no way to connect an email-marketing service.
• People at 1code do not read your content, unless you ask us to (for support), we must look into abuse or a security problem, or the law requires it. Automated systems check mail for spam, fake senders and malware.

AI agents you connect, and the activity log

You can connect your own AI agent, such as Claude, ChatGPT or Gemini, to 1code. You do this through the 1code connector (MCP) or our developer API, using your own subscription or your own keys.

• Your AI account stays yours. We never ask for, store or pass on the sign-in details of your AI account.
• You choose what it can do. Nothing is connected until you connect it. You choose its access, for example read, draft or send. You can disconnect it at any time.
• What your AI provider receives. Your AI provider receives what you let your agent read, and handles it under its own terms. It is your provider, not ours, so its privacy policy applies to what it receives.
• Sensitive actions wait for you. When an agent asks to send something outside 1code, pay, publish something publicly, or delete something for good, we ask you to approve it on your phone first. This is on by default. Sending inside 1code and moving something to Trash do not ask by default. You can change each of these settings.
• The activity log. We keep a log of what each connected agent did, when, and what you approved or refused. You can read it at any time. We keep it for one year.
• Keys. The keys we issue for a connection are stored only as one-way fingerprints.

The same rules apply to apps that developers build on our API. An app gets only the access you approve, and you can remove it at any time.

Our own AI features

Where 1code itself offers an AI feature, it runs on our own API keys with our AI providers. It never uses your personal AI subscription. Our AI providers act only on our instructions and may not train on your information. We name them on request.

The 1code phone app

The 1code phone app is published on Google Play and operated by 1CODE X LTD, which is the controller of the information in it.

• Fingerprint and face. Your phone checks your fingerprint or face itself. The app asks only "is this the right person?" and receives yes or no. Your fingerprint and face never leave your phone. We never see or store them.
• Your key. The private key that approves your sign-ins is made on your phone, kept in its protected storage behind your fingerprint or face, and never leaves it.
• Notifications. If you allow notifications, we send them through Google Firebase Cloud Messaging. Google receives a token for your phone and the notification itself. A notification carries only what is needed to show it, such as a sender's name and the subject of new mail.
• Camera. Used only to scan codes (to pair a phone, approve a sign-in or confirm a recovery) and, if you choose, to photograph a document. Never in the background.
• Microphone and camera in meetings. Used only while you are in a meeting with them on.
• What the app does not touch. We do not read your address book, messages or photos. We see only the files you choose to share.
• Google Play. Google collects its own information when you download the app, under its own policies. An iPhone app is planned.

Services you connect

You can connect other services to 1code. Each one is your choice, and you can disconnect it at any time. Each handles your information under its own terms.

• Google Calendar (in Calendar). We read the list of your calendars and the events of the calendars you choose, and show them to you. If you ask, we keep your 1code events in one calendar named "1code Calendar" that we create in your Google account. We touch nothing else. Unlinking removes that calendar, ends our access and deletes what we hold.
• Google or Microsoft mail (to import old mail into Mail). Read-only, and only while the import runs.
• Slack (in Project). We keep your Slack workspace's name, the key Slack gives us (encrypted) and which Slack person is which 1code account. We read a Slack message only when you choose to make a card from it.
• Your AI agent. See above.

We keep the keys these services give us encrypted. We never sell what we receive from them, use it for advertising or train AI on it.

1CODE X LTD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Who processes it for us

These providers handle personal information for us, only on our instructions, under written data processing agreements.

Paystack, Stripe, the domain registrars and registries also use some information for their own legal duties, such as fraud checks, anti-money-laundering checks and registry rules. For that use they decide what happens to it themselves, under their own privacy policies.

We also share information:

• with the people you share content with, and the services you connect;
• with the business you are dealing with, when you buy from a store or join a room;
• with authorities, only where the law requires it. We push back on requests that are not lawful, and we tell you unless the law forbids it.

We will tell business customers at least 30 days before we add or replace a provider that handles the information they put in our care.

Transfers between countries

Your information is stored in Western Europe. 1CODE X LTD is in the United Kingdom. Our team works from South Africa. Some providers are in the United States. So your information crosses borders. This is how we protect it:

You can ask us for a copy of these safeguards at privacy@1code.email. We may hide business details in it that are not about your information.

Transfers between 1CODE X LTD and 1code X (Pty) Ltd are covered by a data transfer agreement between the two companies: the EU Standard Contractual Clauses with the UK Addendum. to be confirmed — owner signs the intra-group transfer agreement

How long we keep it

We keep information only as long as we need it. When your account closes, we delete your data within 30 days, unless the law requires us to keep something longer.

We delete data on these schedules automatically.

Security

• Everything is encrypted on its way to and from us, and our storage provider encrypts it at rest.
• There are no passwords to steal. You sign in with your phone or a one-time code, and your phone's private key never leaves it.
• Keys that other services give us are kept encrypted. Keys we issue to apps and AI agents are kept only as one-way fingerprints.
• Private videos are served only through short-lived links.
• KYC documents are kept in private storage that is never public.
• Only people who need it for their work can reach systems holding your information.
• If a breach puts your information at risk, we tell you and the authorities your law requires, in the time it requires. If it affects information you put in our care, we tell you so you can tell the people concerned.

If you find a security problem, please tell us at privacy@1code.email.

Scanning and pausing

To keep people safe, we scan published free sites for phishing, malware, impersonation and other harm. We may pause an account, site or app that causes harm. When we do, we tell its owner why, unless the law or a safety risk stops us, and we tell people who use an app we pause that it is paused. A person reviews every pause or removal. If we pause something at once to stop harm in progress, a person reviews it straight after. Nothing with serious effects is decided by a computer alone.

Children

1code is for people aged 18 or over and is not designed for children. You must be 18 or over to have a 1code account. We do not knowingly collect children's information for an account. If we learn a child has an account, we delete it.

Rooms audiences who join without an account are not targeted at children. If you invite anyone under 18 to a room, you are responsible for having their parents' or school's consent. If you sell to children in your store, you are responsible for any consent their law requires.

If you think a child's information is in 1code without that consent, write to privacy@1code.email.

Your rights and how to use them

Wherever you live, you can ask us to:

• tell you whether we hold information about you, and give you a copy;
• correct it;
• delete it;
• give it to you, or to another service, in a common format;
• stop or limit using it, where the law allows;
• stop using it where we rely on legitimate interests;
• withdraw a choice you made, at any time;
• have a person look again at a decision made by computer, hear your view and let you challenge it.

Your right to object. Where we rely on legitimate interests, you can object at any time, for reasons about your own situation. We then stop, unless we have strong legitimate grounds that outweigh your interests, rights and freedoms, or we need the information to make or defend a legal claim.

You can also do much of this yourself: download your files, remove an optional email, remove a phone, disconnect a service or AI agent, and close your account.

How to ask. Write to privacy@1code.email. It is free. We may ask you to confirm it is you by approving on your phone with 1code ID. We answer within one month, or sooner where your law requires. If a request is complex, we may need longer, and we will tell you why within that month.

If your information is in a company mailbox, an audience, a store or an invoice, we may pass your request to the business in charge of it, and help them answer.

If we cannot do what you ask, we tell you why.

Complaints

Please tell us first at privacy@1code.email. We acknowledge a complaint within 30 days and tell you what we did about it.

You can also complain to a regulator at any time:

• United Kingdom: the Information Commissioner's Office.
• South Africa: the Information Regulator.
• European Union: the data protection authority where you live, work or where the problem happened.
• Elsewhere: your national data protection authority, where there is one.

Contact details are in the country sections below.

Changes to this policy

When we change this policy, we change the date and version at the top. We tell you by email or in 1code at least 30 days before a significant change applies. We keep a record of which version and which country section you accepted. Accepting this policy means you have been shown it. It is not consent, and we do not rely on it as consent. Where we need your consent, we ask for it separately.

This policy lives at 1code.studio/privacy.

Contact

1CODE X LTD, 2 Centurion Way, Credenhill, Hereford HR4 7FF, United Kingdom.

• Privacy, security, reports of abuse or illegal content, appeals and authorities: privacy@1code.email
• Help, billing and complaints: support@1code.studio

We have not appointed a data protection officer, because the law does not require one for what we do today.