Legal
Privacy Policy
1. Who we are
OneBadge is a product of ElevareHQ. We provide a badge management dashboard that allows web agencies, freelancers, and studios to manage attribution badges across client websites from a single dashboard. Our registered address and contact details are available at elevarehq.com.
When this policy refers to "OneBadge", "we", "us", or "our", it means ElevareHQ and the OneBadge service at onebadge.io.
2. Data we collect
Account data
When you create an account, we collect your name, email address, and a hashed password. If you sign up via a third-party OAuth provider (Google, GitHub), we receive only the data that provider shares — typically name and email.
Badge and site data
We store the badge configurations you create — text, styles, linked URLs, UTM parameters, and the domain whitelist you set. We also store the domain names of client sites where your badge script is installed.
Analytics data
Our badge script collects anonymous interaction data from your client sites, including:
- Page impressions where the badge was visible
- Click events on the badge
- Approximate geolocation at country level (not city or IP level)
- Browser and device type
- Referrer URL
No personally identifiable information is collected from visitors to your client sites. We do not set cookies on client sites.
Health monitoring data
Our health monitoring system makes periodic HTTP requests to the domains in your whitelist to check whether the badge is rendering correctly. We store the response time, HTTP status code, and badge render status. No content from your client sites is stored or transmitted.
Technical and usage data
We automatically collect standard server logs including IP addresses, browser user agent, pages visited within the OneBadge dashboard, and timestamps. We use this data for security, debugging, and service improvement only.
3. How we use your data
- To provide and operate the OneBadge service
- To display your badge analytics in your dashboard
- To run health monitoring checks on your registered domains
- To send transactional emails (account verification, password reset, billing receipts)
- To notify you of significant changes to the service or your account
- To investigate and prevent fraud, abuse, and security incidents
- To improve the service through aggregate, anonymised usage analysis
We do not use your data for advertising. We do not sell your data to third parties. We do not build advertising profiles from your data or that of your clients' site visitors.
4. Legal basis for processing (GDPR)
For users in the European Economic Area and United Kingdom, our legal bases for processing personal data are:
- Contractual necessity — to deliver the OneBadge service you have subscribed to
- Legitimate interests — for security monitoring, fraud prevention, and product improvement
- Legal obligation — where we are required by law to retain or disclose data
5. Data sharing and third parties
We share data only with the following categories of third-party service providers, who are contractually bound to handle it securely and only as instructed:
- Cloud infrastructure — servers and databases used to host the service
- Payment processor — Stripe processes card payments; we do not store card numbers
- Email delivery — for transactional emails only
- Error monitoring — anonymised crash and error reports
We do not share your data with marketing platforms, data brokers, or advertisers.
6. Data retention
We retain account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are legally required to retain it for longer (such as billing records, which we retain for 7 years for tax purposes).
Anonymised, aggregated analytics data may be retained indefinitely as it cannot be linked to any individual.
7. Your rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data ("right to be forgotten")
- Restrict or object to certain processing
- Request a portable copy of your data
- Withdraw consent where processing is based on consent
To exercise any of these rights, email us at privacy@onebadge.io. We will respond within 30 days.
If you are in the EEA or UK and believe we have not handled your data lawfully, you also have the right to lodge a complaint with your local data protection supervisory authority.
8. Cookies
The OneBadge dashboard uses a single session cookie to keep you logged in. We do not use tracking or advertising cookies. Our badge script does not set any cookies on your clients' sites.
9. Security
We implement industry-standard security measures including encryption in transit (TLS), encrypted storage of sensitive credentials, regular security reviews, and access controls. No system is completely secure. If you discover a security vulnerability, please report it responsibly to security@onebadge.io.
10. Changes to this policy
We may update this policy from time to time. When we make material changes we will notify you by email and update the "Last updated" date at the top of this page. Continued use of the service after notification constitutes acceptance of the updated policy.
11. International data transfers
We are based in India and our service providers may process data in other countries, including the United States. Where personal data of users in the EEA or UK is transferred outside those areas, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and we require our providers to be contractually bound to equivalent protections.
12. Children's privacy
OneBadge is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Contact
For any questions about this policy or your data, contact us at privacy@onebadge.io. For general support, email support@onebadge.io.