ONEBOX Privacy Notice

Effective 15 September 2026.

ONEBOX processes customer contact details, service addresses and booking/support history; provider business details, service areas and verification evidence; authentication/security data; and payment references. Stripe handles full card details.

We use information to arrange and perform bookings, process payments/refunds, verify providers, prevent fraud, provide support, secure and improve ONEBOX, comply with accounting/tax/platform-reporting duties and establish or defend legal claims. Lawful bases include contract, steps before contract, legal obligation, legitimate interests and consent where specifically required.

Data may be shared with the customer/provider involved in a booking and with service providers including Stripe, Supabase, Netlify, PostHog and email-delivery providers, plus advisers or authorities where necessary. Customer phone/address details are not released merely because a provider receives an offer; they are made available for an accepted booking and access can be removed after completion.

ONEBOX uses limited first-party product analytics and technical observability to understand platform usage, diagnose failures and improve reliability. Optional page-view and performance analytics, including Google Analytics and consent-gated PostHog analytics, are only used after you choose Accept analytics. These analytics may include the page path, device/browser performance information, referral/source information and aggregated Web Vitals. ONEBOX does not use PostHog session replay in this implementation and does not intentionally send form contents, email addresses, full URLs containing query parameters, or browser console logs to PostHog.

ONEBOX may send narrowly scoped technical error and reliability events needed to secure, operate and troubleshoot the service, including sanitised JavaScript error type/message, code location, slow backend endpoint path and timing. These operational events use an ephemeral page identifier, are configured not to create a person profile, and are sanitised to remove common email addresses, UUIDs and token-like values before transmission. PostHog is configured in the EU region and IP anonymisation is enabled for the project. We use this limited operational telemetry on the basis of our legitimate interests in maintaining a secure and reliable service.

Optional Google Analytics is only loaded after you choose Accept analytics. Google Analytics may then use first-party analytics cookies and collect information such as page viewed, approximate location, device/browser information and referral/source data. ONEBOX has disabled Google signals and advertising-personalisation signals in its Google Analytics configuration. We use this optional analytics on the basis of consent.

Your optional analytics choice is stored in your browser so ONEBOX can remember it. You can change or withdraw that choice at any time using the Privacy choices control shown on the website. If you withdraw analytics consent, ONEBOX stops further optional analytics collection in that browser and attempts to remove ONEBOX Google Analytics cookies accessible from the site. Essential authentication, security, fraud-prevention and narrowly scoped reliability logging are separate and are not disabled by rejecting optional analytics.

Core transaction and contractual records may be retained for up to 6 years where needed. Unsuccessful provider evidence will normally be reviewed for deletion after 12 months. Suppression records may be retained to respect marketing objections. Technical telemetry is retained only for the period reasonably needed to investigate reliability and security trends, subject to the retention controls of the relevant service provider.

ONEBOX uses rule-based matching using factors such as category, area, verification, availability, previous successful provider, rating and completed jobs. Providers remain free to accept or decline and administrators can intervene.

You may have rights to access, correct, erase, restrict, object and data portability, plus an absolute right to object to direct marketing. Contact oneboxservicesuk@gmail.com. You may also complain to the ICO at ico.org.uk.