Privacy policy

Who we are

One Studio is operated by Sansa Vision at onestudio.im. Sansa Vision is the controller for account, commercial, and website data. A customer is normally the controller for personal data placed in a workspace, and Sansa Vision acts as its processor.

Data we process

• Account data: name, email, authentication events, workspace membership, and security metadata.
• Product data: prompts, blueprints, source, artifacts, evidence, feedback, releases, and audit records.
• Commercial data: plan, transaction identifiers, entitlements, and usage receipts. Payment credentials are handled by Stripe and Link.
• Support data: contact details, message contents, attachments, and ticket history.
• Technical data: IP address, device and request metadata, coarse location, logs, and security signals.

Why and how long

We use account and product data to perform the contract, protect the service, provide support, meet legal duties, and improve the product where consent or legitimate interests permit. Core account records are retained while the account is active. Workspace content is deleted within 30 days after a verified deletion request, except backups that age out within 90 days and records required for security, disputes, tax, or law.

• Authentication records: active session plus up to 30 days.
• Security and audit logs: normally 12 months.
• Support tickets: 24 months after closure.
• Billing and transaction records: up to 7 years where required.
• Consent receipts: while relevant plus 5 years for compliance evidence.

Sharing and transfers

We disclose data only to service providers needed to operate One Studio, including Cloudflare for hosting, data, email, and security; Stripe and Link for Managed Payments; and OneClient for scoped production infrastructure. Providers receive only the data required for their role. International transfers use adequacy decisions or approved contractual safeguards where required. We do not sell personal information. We do not share it for cross-context behavioral advertising.

Your choices

You may request access, correction, export, deletion, restriction, or objection, and withdraw consent without affecting earlier processing. You may complain to your local supervisory authority. We verify requests proportionately and normally respond within one month. Global Privacy Control signals disable optional analytics and marketing on this site.

Security and children

We use tenant authorization checks, least-privilege bindings, encrypted transport, isolated build environments, signed webhooks, immutable evidence, logging, and recoverable release snapshots. No system is completely secure. One Studio is a business service and is not directed to children under 16.