Privacy Policy

ONE Hub is an internal tool used by licensed agents at One Luxury International to manage property showings, appointments, contacts, deals, documents and marketing work. It is not a consumer product and is not intended for use by the general public.

Signing in with a Google Workspace account gives ONE Hub your name, email address and profile photo. We also store per-agent settings such as calendar color preferences and your MLS member ID.

With your explicit consent at sign-in, ONE Hub requests access to your Google Calendar (to create and update showing appointments) and, separately and optionally, to Gmail (to send weekly updates and open-house lead emails from your own address rather than a generic one). These tokens are stored so the features keep working and are used for nothing else. You can revoke either at any time from your Google account.

This is the most important section. Agents record information about third parties in the course of their work: client and prospect names, email addresses and phone numbers; the property addresses they viewed; the dates and times of showings; and free-text notes an agent writes about an appointment. Open-house sign-in sheets capture the same categories from members of the public who attend.

Those people are not ONE Hub users and did not create an account. Their information is entered by an agent and is visible to that agent and, for shared listings, to the brokerage team. It is not sold, rented, or used for advertising.

Authorized Inside Sales staff can call and text from the brokerage’s shared business number and send email from a separately connected mailbox. Twilio processes phone numbers, call audio, text and picture messages, delivery status, and voicemail. ONE Hub stores message content, attachments, call times and outcomes, staff activity, and opt-out information in shared business records.

Live calls are not recorded by ONE Hub. An unanswered call can invite the caller to leave a recorded voicemail, which may be transcribed by Twilio under the business line’s voicemail configuration. On iPhone, microphone access is used for calls, and Apple’s push service delivers incoming-call notifications.

The Inside Sales Gmail connection reads and stores only email threads started through Inside Sales or linked to a record by a mailbox owner. Connecting a mailbox requires Google authorization and can be revoked in the Google account.

An Inside Sales email may include a small transparent image from ONE Hub that records the first time it is loaded, which ONE Hub shows to staff only as a possible open. Privacy features, image proxies and previews can load it without anyone reading the email, and blocking images prevents it. The image is never added when an email is copied to others, and it stops recording 90 days after the email is sent. ONE Hub stores only the time of the first load, not the reader’s IP address, device, browser or location.

With your permission, ONE Hub checks proximity to scheduled properties on your phone to offer arrival and feedback reminders during the appointment window. Your device location is not sent to ONE Hub’s servers or stored as a travel history. Apple’s location and geocoding services are used to locate property addresses.

Widgets, Live Activities, and Siri use a limited local copy of your own showing addresses and times. This copy expires after 24 hours and is cleared when you sign out. You control location permissions and Lock Screen access in iPhone Settings.

Items shared from other apps are staged locally for review and uploaded when you choose Save in Share Inbox. These may include photos, PDFs, links and text, and are associated with the receiving account. Uploads through the media library and assistant also store the files or images you choose with your account.

After you connect Siri and allow AI sharing, native note and to-do actions send the dictated text to our server and OpenAI for interpretation, then save the resulting note or to-do to your account. Apple handles speech recognition; these actions send text, not an audio recording. An uncertain request may retain its text in the protected device Keychain for retry. Disconnect shortcuts in Agent Notebook or turn AI sharing off in Settings to stop future AI capture requests.

When you start a live Ollie conversation, microphone audio is streamed to OpenAI so Ollie can understand and answer you. ONE Hub does not save an audio recording. Text delegated to Ollie, its replies, and completed actions are stored in assistant history in the same way as a typed conversation. Where Ollie uses Claude (see AI sharing choices), the text transcript of what you and Ollie said during the call is stored in that conversation too, so it can be continued by typing. End voice to stop microphone access.

The website keyboard reads a local list of your listing links. It does not request Full Access, read the message you are typing, or send keystrokes to our servers.

When you use these features, we store uploaded photos and documents, saved notes, message and email content, and deal details such as sale prices, commissions, deductions and expenses. These records are linked to the signed-in account and relevant property or transaction, and used to provide the requested brokerage tools.

ONE Hub’s built-in AI features are off until you explicitly allow sharing with OpenAI. Ollie’s use of Claude by Anthropic, described below, has its own permission. External AI app connections use the separate consent described below. Before your choice, the app explains that requests may include conversations, microphone audio, attachments, dictated text, property details, and relevant client, contact or deal information. OpenAI processes that information to provide the requested response. You can decline and continue using non-AI features, or change your choice in Settings → Account → AI privacy. Revoking permission stops future AI requests; it does not delete records already saved.

On accounts where it is enabled, Ollie, the built-in assistant, uses Claude by Anthropic to answer typed and spoken requests. This needs its own permission, asked for separately and before anything is sent to Anthropic; allowing OpenAI does not allow Anthropic. When you allow it, your messages, the files you attach, the text of requests you make by voice, and the ONE Hub records Ollie looks up to answer you (which can include client, contact, lead, appointment and deal information) are sent to Anthropic to generate the response, along with the earlier messages in that conversation, including the text transcript of any voice exchange in it. Ollie voice still uses OpenAI for the live audio, so voice needs both permissions, and starting voice in an existing conversation sends a limited number of its recent messages to OpenAI so the call can continue where the typing left off. You can turn Claude off at any time in Settings → Account → AI privacy, and choosing Use without AI there turns off both OpenAI and Anthropic sharing. Turning it off stops future requests; it does not delete conversations already saved in ONE Hub.

Linked Ollie. If you link ONE Hub to your own Ollie app and allow linked Ollie, what you ask Ollie in ONE Hub is processed by Ollie, not by ONE Hub’s own assistant, and is kept in your Ollie memory and history. Ollie sends that work to Meta’s models as Meta Contributor work, and uses OpenAI for web searches. Meta may keep Contributor work and use it to improve its models (training use). That work can’t read your Gmail, Google Calendar or Google Drive directly, but it can use your Ollie memory, to-dos, follow-ups, deal notes, files Ollie made and your Library files, which can include details from your email, calendar or Drive; the ONE Hub records Ollie reads or changes for you go to Ollie to do the work. From ONE Hub, Ollie takes requests and tasks only: no reminders, follow-ups, notifications or email watching. Linked Ollie has its own permission, asked before anything is sent; you can turn it off in Settings → Account → AI privacy, and choosing Use without AI there turns it off too.

Only submit information you are authorized to use. AI responses may contain mistakes and should be checked before you rely on them. OpenAI and Anthropic each process and retain submitted data under their own terms and policies; see OpenAI’s privacy policy and Anthropic’s privacy policy.

When you connect ChatGPT, Codex, Claude, or another supported AI client to ONE Hub, you separately authorize the access shown on the consent screen. Depending on the permissions you select and the tools requested, ONE Hub may return contact and lead information, appointment addresses and dates, transaction information, notes, documents, or other records your account can access. Write permissions allow supported changes; additional agent-workflow permissions can enable actions such as communications, cancellations, and publishing. Review the information and the proposed action before approving it.

The connected AI provider receives your prompts and the tool results returned to it, and handles them under its own terms, privacy policy, and account settings. This connection is separate from the AI privacy switch for ONE Hub's built-in assistant. Turning off that switch does not disconnect an external AI app. To stop an external app's access, use Settings → Connections → AI connections → Disconnect.

ONE Hub stores the client registration, the granted permissions, and access and refresh credential hashes. Access credentials expire after one hour; refresh credentials rotate and expire after 30 days unless refreshed, revoked, or otherwise invalidated. Additional agent-workflow access uses an encrypted delegated session so approved workflows can run with the connected account's permissions. Disconnecting revokes the grant and clears that delegated session. It does not undo completed changes or remove data already received by the AI provider.

For security and troubleshooting, ONE Hub records the account and connection identifiers, tool or action name, time, and outcome of MCP calls. These audit records are linked to the account; they are separate from anonymous page analytics. The MCP audit does not intentionally store tool arguments, CRM text, or credential values. Audit and connection records have no fixed automatic deletion period in the current service and are retained for operational and security needs, subject to applicable requirements and deletion requests.

We collect anonymous usage analytics — which screens are opened, device type, approximate region — to understand which features are used. This is not linked to your identity and is not used to build a profile of you.

ONE Hub runs on third-party infrastructure and shares data with those providers only as needed to operate:

• Supabase — database and authentication
• Vercel — application hosting and anonymous analytics
• Google — sign-in, Calendar, Gmail
• Twilio — business calls, texts, picture messages, voicemail and delivery status
• Apple — iPhone push notifications and system calling features
• Resend — sending email
• Stellar MLS / Bridge — property listing data (this flows in, not out)
• Connected AI providers — receive the information returned by tools you authorize; see Connected AI apps above and the chosen provider’s privacy policy.
• OpenAI — assistant conversations, live microphone audio and attachments, dictated showing details, acquisition-search requests, market summaries, and property comparisons are processed to provide AI features
• Anthropic — where Ollie uses Claude and you have allowed it, assistant messages, attachments, the text of voice requests and the records Ollie looks up are processed to answer you
• Ollie and Meta — where you have linked ONE Hub to your Ollie app and allowed linked Ollie, your Ollie requests in ONE Hub and the records Ollie uses are processed by Ollie as Meta Contributor work, which Meta may keep and use to improve its models

We do not sell personal information, and we do not use it for advertising.

Showing and appointment records are retained as business records for as long as the brokerage needs them, and for at least as long as Florida requires brokerages to keep transaction records. Agent accounts are removed when someone leaves the firm, and an agent can delete their own account at any time (see below). If you are a client or open-house guest and want your information removed, contact us using the details below and we will delete it.

Agents can delete their own account at any time from Settings, without contacting anyone. Deleting your account permanently removes your sign-in, your profile, your connected Google Calendar and Gmail access, your notification devices and any API tokens you created. You will not be able to sign in again.

Showings, appointments and open-house records you logged are kept afterwards as One Luxury International business records — Florida requires brokerages to retain transaction records — but they are unlinked from your name and email address.

You can request access to, correction of, or deletion of personal information we hold about you. Agents can revoke Google Calendar or Gmail access at any time without losing access to the rest of the app.

ONE Hub is a workplace tool and is not directed at anyone under 18.

One Luxury International
nick@oneluxuryint.com