Onlyfo
Log in Get Started

Privacy Policy

Last updated: August 2026

1. Introduction

At Onlyfo Infrastructure ("Onlyfo", "we", "us", or "our"), respecting your privacy and safeguarding your personal and business data is fundamental to our platform design. This Privacy Policy outlines how we collect, process, store, and protect your information when you use our SaaS digital asset processing platform and services.

2. Information We Collect

We collect information to provide streamlined agency processing, task management, and automated payout tracking services:

  • Account Information: Name, work email address, company details, password hash, and billing configuration.
  • Customer & Client Data (CRM): Business names, email addresses, billing locations, and custom currency settings entered into the workspace CRM for invoice generation.
  • Digital Assets & Production Files: Source files, vector artwork, embroidery design files, instructions, and completed deliverables uploaded to our system.
  • Inbound Email Order Assets: Image attachments, artwork specifications, and order notes extracted via Google Cloud Pub/Sub solely from administrator-whitelisted sender filters.
  • API & Automation Data: Incoming JSON payloads, endpoint request logs, and data securely transmitted via our REST API endpoints.
  • Branding Assets: Custom logos and brand hex colors uploaded for White Labeling.
  • Usage & Performance Metrics: Turnaround times, task logs, deadline compliance metrics, and system interaction data.

3. How We Use Your Information

We strictly utilize collected data for core platform operational purposes, including:

  • Facilitating digital asset processing workflows and deadline tracking.
  • Calculating automated earnings, task allocations, and payout reports.
  • Authenticating machine-to-machine REST API requests via secure Bearer tokens.
  • Ensuring secure multi-tenant account isolation and fraud prevention.
  • Sending essential service notifications, task updates, and security alerts.

4. Google API Services & Gmail User Data Disclosure

Onlyfo provides optional integration with Google Workspace and personal Gmail accounts to streamline inbound order ingestion for agency workflows. Our use and handling of Google user data is governed by strict technical constraints and legal commitments:

Specific Scopes & Purpose

When connecting an email inbox, Onlyfo requests the following Google OAuth scopes:

  • https://www.googleapis.com/auth/gmail.readonly
  • https://www.googleapis.com/auth/userinfo.email

Sole Purpose: To automate inbound job order creation by reading order specifications (Order ID, Job Notes, File Attachments) from pre-authorized client sender emails configured by the workspace administrator.

Google Limited Use Compliance

"Onlyfo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

Explicit Prohibitions & Data Protection

  • No Selling or Advertising: We do NOT sell, rent, or transfer email contents or user data to third parties, data brokers, or advertising platforms.
  • No AI Model Training: Google user data is NEVER used to train, develop, or fine-tune generalized, non-personalized artificial intelligence (AI) or machine learning (ML) models.
  • Human Access Restrictions: No human employees or contractors read client emails unless required for security investigations, technical debugging explicitly requested by the account owner, or legal compliance.
  • Multi-Asset Isolation: Customer attachments and artwork files processed through Gmail integration are stored exclusively within encrypted multi-tenant storage volumes and accessed only by assigned workspace workers.

Data Retention & Account Disconnection

Users can disconnect any connected Gmail or Google Workspace inbox at any time via Workspace Settings (tenant/gmail_settings.php). Disconnecting immediately deletes all OAuth refresh/access tokens and revokes the Google Pub/Sub watch subscription.

5. Data Security & Storage

We employ enterprise-grade encryption standard protocols (TLS 1.3 in transit and AES-256 at rest) for all file uploads and storage pipelines. Access to your production files is restricted strictly to authorized workspace members and assigned digital processors.

6. Third-Party Services

We do not sell, rent, or trade your personal or business data. Data is shared only with verified infrastructure and payout partners (e.g., secure cloud hosting providers, wire/Wise payment gateways) strictly to fulfill operational service delivery.

7. Contact Us

If you have any questions or privacy requests regarding this Privacy Policy, please reach out to our privacy compliance team at designerv9@gmail.com.