Privacy Policy

Last updated: 20 October 2026

This policy explains how 1Dashboard ("1Dashboard", "we", "us") collects, uses, stores, discloses and protects personal information. It covers our website at 1dashboard.io (including the waitlist form) and the 1Dashboard application at app.1dashboard.io (the "Service").

1Dashboard is operated by Scalabl LLC, a Wyoming limited liability company (scalabl.io).

For our customers and for people in New Zealand and Australia, we handle personal information in line with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs), and the Australian Privacy Act 1988 and its Australian Privacy Principles (APPs).

1. Two roles: our data and your data

Account and website data. For information about the people who use 1Dashboard (account holders, team members, waitlist sign-ups, website visitors), we decide how it is used, and we are responsible for it.
Customer data. The leads, contacts, deals, form submissions and ad account data that a customer connects or uploads belong to that customer. We process it only on the customer's instructions to provide the Service. The customer is responsible for having a lawful basis and giving notice to the people in that data. If you are a lead or contact in a customer's workspace and want to access or correct your information, please contact that business first. We will help them respond.

2. Information we collect

Account information. Name, email address, profile photo (optional), workspace and organisation names, logo (optional), role, time zone and preferences.

Sign-in and security information. Sign-in link requests, sign-in times, IP address, approximate country derived from the IP address, browser and device type (user agent), active sessions, two-factor authentication settings, passkeys and trusted-device records.

Integration credentials. OAuth tokens, API keys and connection settings you provide when you connect a third-party service. These are encrypted before they are stored.

Customer data. Records synced from the services you connect or sent to our API, for example names, email addresses, phone numbers, company, lead status, value, notes, form fields, UTM and click identifiers (such as GCLID), and any custom fields in the source system. It also includes advertising performance data such as campaigns, ad groups, keywords, search terms, spend, clicks, impressions and conversions.

Waitlist information. When you join the waitlist on 1dashboard.io: name, email, company (optional), the tools you use, approximate monthly lead volume, and how you found us (UTM parameters, referring page and landing page).

Support and communications. Emails and messages you send us, and records of emails we send you (recipient, subject, delivery status).

Technical and operational data. Server logs, error logs and job records needed to run, secure and debug the Service. We do not use advertising trackers or third-party analytics cookies in the app.

3. How we use information

To provide the Service: sign you in, run your workspace, sync your connected sources, show dashboards and reports, and send data back to connected tools when you ask us to.
To secure the Service: authenticate users, detect suspicious sign-ins, prevent abuse, rate-limit requests and investigate incidents.
To communicate with you: sign-in links, team invitations, alerts about failing connections, service notices and replies to support requests.
To manage the waitlist: contact you about early access and ask about your needs.
To maintain and improve reliability, for example by monitoring sync jobs and errors.
To meet legal obligations and enforce our terms of service.

We do not sell personal information. We do not use customer data for advertising, and we do not use customer data to train artificial intelligence or machine learning models.

4. Google user data

When you connect a Google account, we request only the scopes needed for the feature you choose:

Scope	Why we request it
`openid`, `userinfo.email`, `userinfo.profile`	Identify which Google account is connected and show it in the app.
`spreadsheets.readonly`, `drive.readonly`	Import: list spreadsheets you can access so you can pick one, then read rows from the sheet and tab you select.
`spreadsheets`, `drive.file`	Export: create a spreadsheet for you and keep it updated with your leads. We write only to spreadsheets created by 1Dashboard.
`adwords`	Google Ads: read accounts, campaigns, ad groups, ads, keywords, search terms, click data and performance metrics so you can see ad spend and results next to your leads. We do not create, change or delete ads.

Limited Use. 1Dashboard's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We use Google user data only to provide and improve the user-facing features described above, which are visible in the app.
We do not transfer Google user data to others except as needed to provide or improve those features, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets with notice to you.
We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
We do not sell Google user data, and we do not use it to determine credit-worthiness or for lending purposes.
No person at 1Dashboard reads Google user data unless you give us permission for specific records (for example in a support request), it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised for internal operations.
We do not use Google Workspace API data (including Google Sheets and Drive data) to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.

You can revoke our access at any time from your Google Account permissions or by disconnecting Google in the app.

5. Other connected services

When you connect a service, we receive data from it and, where you turn it on, send data to it. You choose which services to connect. Each service handles data under its own privacy policy. Services currently available or in development include Zoho CRM, ActiveCampaign, Google Ads, Google Sheets, Meta (Facebook and Instagram) Ads, TikTok Ads, Microsoft Advertising, GoHighLevel, HubSpot, Pipedrive, monday.com and Cloudflare D1 databases that you own.

These providers are not our subprocessors: they act for you, under your own account with them.

We use a small number of service providers (subprocessors) to run 1Dashboard. They may only use personal information to provide their service to us.

Provider	Purpose	Location
Hostinger International Ltd	Virtual private server hosting our main database (PostgreSQL), background sync jobs and database backups	Singapore
Cloudflare, Inc.	Application hosting (Workers and Pages), database connection pooling, file storage for profile photos and logos (R2), DNS, network security and email routing	United States (company); data passes through Cloudflare's global network
Resend (Plus Five Five, Inc.)	Sending transactional email such as sign-in links and invitations	United States

Database backups are kept on our server in Singapore (Hostinger) and as an encrypted offline copy controlled by our team. Backups older than 30 days are deleted. Email to [email protected] is received through Cloudflare Email Routing.

The current list is published at 1dashboard.io/subprocessors.

We may also disclose information:

to professional advisers (such as lawyers and accountants) under confidentiality;
if required by law, court order or a government authority, or to protect the rights, safety or property of our users, the public or us;
to a buyer or successor if our business is sold or restructured, subject to this policy.

7. Overseas disclosure

Our main database is in Singapore, and our hosting and email providers are based in the United States. This means personal information is disclosed to, stored in, or accessed from Singapore, the United States, and other countries where Cloudflare operates its network.

New Zealand (IPP 12). We disclose personal information overseas only to providers that we reasonably believe are required to protect it in a way that, overall, provides comparable safeguards to the Privacy Act 2020, including through contractual terms such as data processing agreements and standard contractual clauses.
Australia (APP 8). Before disclosing personal information overseas we take reasonable steps to ensure the recipient does not breach the APPs in relation to it, including through contractual commitments on use, security and confidentiality.

Customers can ask us for more detail on the safeguards for each provider.

8. Security

All traffic is encrypted in transit with TLS.
Integration tokens and API credentials are encrypted at rest with AES-256-GCM using a key held separately from the database.
Every database query is scoped to a single workspace, so one customer cannot read another customer's data.
Sign-in uses one-time email links; platform administrators must use two-factor authentication. Sessions can be reviewed and revoked.
Access to production systems is limited to authorised personnel and recorded in an audit log.
We monitor sync jobs, errors and uptime, and alert on failures.

No system is completely secure. If you believe you have found a security issue, email [email protected].

9. Data breaches

If we become aware of a privacy breach, we will act quickly to contain it, assess the risk of harm and take steps to reduce it.

New Zealand. If a breach has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by Part 6 of the Privacy Act 2020.
Australia. Where the Notifiable Data Breaches scheme applies, we will complete our assessment within 30 days and, for an eligible data breach, notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable.
Customers. For breaches affecting customer data, we will notify the affected customer without undue delay (and in any case within 72 hours of confirming the breach) so they can meet their own obligations.

10. How long we keep information

Data	Retention
Customer data and workspace content	While the workspace is active. Deleted within 30 days after the workspace is closed or the customer asks us to delete it.
Backups	Expire and are deleted within 30 days of being created, so deleted data leaves backups within 30 days.
Disconnected integrations	Stored credentials are deleted on disconnect. Records already imported stay in the workspace until you delete them or close the workspace.
Sign-in and security events	180 days.
Ended sessions	30 days after they end.
Email delivery records	90 days.
Job and monitoring records	30 to 90 days.
Waitlist sign-ups	Until you ask us to remove you, or 12 months after the public launch, whichever is sooner.
Account information	While your account is active, then deleted within 30 days of account closure unless we must keep it longer by law (for example tax and billing records).

11. Your rights: access and correction

You can ask us for access to the personal information we hold about you and ask us to correct it. Most account details can be changed in the app under Settings. Email [email protected] and we will respond within 20 working days (NZ) or 30 days (AU). We may need to confirm your identity first. We do not charge for access requests. If we refuse a request, we will tell you why and how to complain.

You can also ask us to delete your account or close your workspace. Customers can export their leads at any time as CSV.

How to delete your data

Disconnect a service. In 1Dashboard, open Integrations and click Disconnect on the service (for example Meta, Google or TikTok). We delete its stored access tokens straight away, and we stop reading from it.
Remove our access on the provider's side. For Facebook and Instagram, go to Facebook Settings, then Apps and websites (or Business Integrations), and remove 1Dashboard. For Google, go to your Google Account, then Security, then Third-party apps with account access.
Delete everything. Email [email protected] from your account email and ask us to delete your account or workspace. We delete the data within 30 days, and it leaves our backups within a further 30 days. We confirm by email when it is done.

12. Cookies and similar technologies

We use only what is strictly necessary to run the website and the app. We do not use advertising or tracking cookies, so we do not show a cookie banner. Details are in our cookie list.

App (app.1dashboard.io): browser storage, no cookies set by us.

Name	Type	Purpose	Duration
`ot_token`	Local storage	Keeps you signed in (session token)	Until you sign out or the session expires
`ot_mfa_device`	Local storage	Remembers a trusted device for two-factor sign-in	Until removed or expired
`ot-me-cache`	Local storage	Caches your profile to load the app faster	Until sign-out
`ot-theme`, `ot-drawer-hide-empty`, `ot-leads-cols-last`, `ot-leads-date-range-last`, `overview-range-last`, `ot-announcement-dismissed`, and per-workspace view settings	Local storage	Remembers your display preferences	Until you clear them
`ot_imp_token`	Session storage	Support sessions opened by a platform administrator (one browser tab only)	Until the tab is closed
`ot-after-login`, `ot:flash`, `settings:flash`	Session storage	Short-lived navigation and confirmation messages	Until the tab is closed

Website (1dashboard.io)

Name	Type	Purpose	Duration
`1d-attribution`	Session storage	Remembers how you arrived (UTM parameters, referrer) so the waitlist form can include it	Until the tab is closed
`__cf_bm`, `cf_clearance` (only if set)	Cookie, set by Cloudflare	Bot and abuse protection	Up to 30 minutes (`__cf_bm`); `cf_clearance` up to 1 year

The website loads fonts from Google Fonts, which means your browser sends your IP address to Google when the page loads. We may use Cloudflare Web Analytics to count visits. It does not use cookies or local storage and does not track you across sites.

If we ever add non-essential cookies, we will update this policy and ask for consent where required.

13. Children

1Dashboard is a business service and is not intended for anyone under 16. We do not knowingly collect personal information from children.

14. Changes to this policy

We will update the "Last updated" date when we change this policy. For material changes, we will notify account owners by email or in the app before the change takes effect.

15. Contact and complaints

Privacy questions, access and correction requests: [email protected]