Privacy Policy

The One Academy GmbH
Seestrasse 15, 6052 Hergiswil, Switzerland
Email: support@jointheoneacademy.com

We may collect and process the following categories of personal data:

• Contact form data: name, email address, and any message content you submit to us.
• Newsletter data: email address (and name, if provided) when you subscribe to our newsletter.
• Purchase/account data: name, email address, billing address, and transaction details when you buy a Course. Payment card details themselves are collected and processed directly by our payment processor, Stripe, and are not stored on our own servers.
• Technical and usage data: IP address, browser type, device information, pages visited, referral source, and similar data collected automatically via cookies and analytics/tracking tools (see Section 4).
• Communications: any correspondence you have with our support team.

We use personal data for the following purposes and legal bases:

Under Swiss law (revDSG), we process personal data on the basis of your consent, the performance of our contractual relationship with you, or our legitimate business interests, in each case in compliance with the principles of proportionality and data minimization.

4.1. We use cookies and similar technologies to operate the Website, remember your preferences, and understand how visitors use our site.

4.2. We use analytics and advertising/tracking tools, which may include tools such as Google Analytics and the Meta (Facebook) Pixel, to measure Website traffic and the performance of our marketing campaigns. These tools may set cookies and collect data such as your IP address, device identifiers, and browsing behavior, and may transmit this data to servers operated by Google and Meta, including outside Switzerland/the EEA.

4.3. Where required by applicable law (e.g., for EU/EEA/UK visitors), we will request your consent via a cookie banner before activating non-essential cookies and tracking tools. You can withdraw your consent at any time via the cookie settings on our Website or by adjusting your browser settings.

4.4. You can control or delete cookies through your browser settings at any time; note that disabling cookies may affect the functionality of the Website.

All payments on the Website are processed by Stripe, Inc. and its applicable affiliates. When you make a purchase, your payment information is transmitted directly to Stripe and is subject to Stripe's own privacy policy and security practices. We receive confirmation of payment and limited transaction data (such as amount, date, and order reference) but do not store your full card details.

If you subscribe to our newsletter, we will use your email address to send you updates, offers, and information about our Courses. You may unsubscribe at any time using the link included in every newsletter email or by contacting us directly.

When you sign up on our blog, we store your email address, the page you signed up on, your approximate country (derived from your IP address by our hosting provider), and the times you signed up, confirmed and unsubscribed. We use double opt-in: you only receive the newsletter after clicking the link in our confirmation email. The legal basis is your consent (Art. 6(1)(a) GDPR; Swiss Federal Act on Data Protection). You can withdraw it at any time with the unsubscribe link in every email; we then keep only a record of the unsubscription to prove your consent and its withdrawal. Emails are sent via Resend (USA); the data is stored with Supabase. Sign-ups that were never confirmed are not used for mailing.

We may share personal data with:

• Service providers who support our operations, such as payment processing (Stripe), email/ newsletter delivery platforms, website hosting providers, and analytics providers;
• For the Profit Phones software: the providers listed in the Annex below, including the AI provider that reads phone screens (Anthropic);
• Legal and regulatory authorities, where required by law;
• Professional advisors (e.g., accountants, lawyers), where necessary for our legitimate business purposes.

We do not sell your personal data to third parties.

As we operate internationally and use service providers based outside Switzerland (including in the EU/EEA and the United States, such as Stripe, Google, Meta, Anthropic, Vercel, Cloudflare and Resend), your personal data may be transferred to and processed in countries outside Switzerland. Where such transfers occur, we rely on appropriate safeguards, such as standard contractual clauses or the provider's own compliance with applicable data protection frameworks, to protect your personal data in accordance with revDSG and, where applicable, GDPR requirements.

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, including any applicable legal, accounting, or reporting requirements (for example, Swiss accounting law generally requires retention of transaction-related records for 10 years).

Profit Phones software and device rental: when your access ends, we keep the data of your account — among other things your connected social accounts and their stored credentials, your media library, posts, automations, proxies and notes — for six months, so that you can continue where you left off if you return. About 14 days before that period ends, we remind you by email. After it, we delete this data. Invoices, orders, payment and credit records are kept for the statutory period mentioned above. Data belonging to a course you bought is not affected.

Depending on your location, you may have the following rights regarding your personal data:

• Right to access the personal data we hold about you;
• Right to request correction of inaccurate data;
• Right to request deletion of your data, subject to legal retention obligations;
• Right to object to or restrict certain processing (e.g., marketing);
• Right to data portability (where applicable under GDPR);
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Right to lodge a complaint with a competent data protection authority (in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU/EEA, your local supervisory authority).

To exercise any of these rights, contact us at support@jointheoneacademy.com.

Our Website and Courses are not directed at individuals under the age of 18, and we do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this Policy indicates the most recent revision. Continued use of the Website after changes take effect constitutes acceptance of the revised Policy.

For any questions or requests regarding this Privacy Policy or your personal data, please contact:

The One Academy GmbH
Seestrasse 15, 6052 Hergiswil, Switzerland
Email: support@jointheoneacademy.com

This Annex adds what happens to data when you use the Profit Phones software (the portal at profitphones.com, the connector program on your computer and our connection service) or rent phones from us. Sections 1 to 14 apply as well.

A1. Roles. For your account, billing and support data we are the controller. The phones and social media accounts you connect may show data about other people — profiles, comments, messages, followers. For that data you are the controller: we process it only on your instructions and only to run the Software for you.

A2. What we process.

• Account and billing: name, email, company, billing address, VAT number, plan, invoices, payment status and credit bookings.
• Team: the email addresses and roles of the people you invite.
• Phones: device identifiers (serial number, model, system version), online status, battery and connection data.
• Screen content: images of your phone screens — the live view while you watch, and screenshots taken while an automation runs.
• Social media accounts: usernames, platforms and the login details you store with us (passwords, phone passcodes), plus the numbers read from the apps (followers, views, likes and similar).
• Content: videos, images, captions and schedules you upload, and comments the automation writes.
• Usage and security logs: who controlled which phone and when, AI usage and its cost, and IP addresses for abuse protection.
• Support: your messages in the help chat and in support requests. The first answers in the help chat come from an AI assistant.

A3. AI processing. To read a phone screen and decide what to tap, and to write captions or comments, the automation sends screenshots and the text it needs (for example captions, comments and your niche instructions) to Anthropic, PBC (United States), which processes them with its Claude models on our behalf. We send only what the step at hand requires. Under its commercial terms, Anthropic does not use this data to train its models; it may keep it for a limited time for safety and abuse monitoring. We do not keep these screenshots on our servers after the AI has answered.

A4. Where the data is. Database: Supabase (Ireland). Live view and remote control run through our connection server at Hetzner (Germany); live images pass through it and are not stored. Media library: Cloudflare R2. Website and server functions: Vercel (run in Ireland; Vercel is a US company). AI: Anthropic (United States). Payments: Stripe. Emails: Resend (United States). Transfers outside Switzerland follow Section 8.

A5. Security. All connections are encrypted. Stored passwords and phone passcodes are kept encrypted and are only decrypted to perform the action you asked for. Each customer sees only their own phones, accounts and files; team members see only the phones assigned to them.

A6. Retention and deletion. You can delete accounts, stored login details and files in the portal at any time. When your access ends, we keep your data for six months and then delete it, as described in Section 9; invoices and payment records are kept for the statutory period.