What data we store
OneClickClaw collects only the data necessary to provide the hosting service. Here is a clear breakdown:
- Account information: Your name, email address and profile photo from your Google sign-in. Used for login, billing communication, and support.
- Server metadata: Server name, tier, status, and deployment timestamps. Used to manage your VPS and display dashboard information.
- Billing information: Subscription status, plan type, and payment history. Payment card details are handled entirely by Stripe and never touch our servers.
- Event logs: Deployment events, configuration changes, reboots, and support interactions. Used for troubleshooting and support.
What we don't store
Equally important is what OneClickClaw does not store on our platform:
- AI conversations: Messages between people and your agent flow between your server and your AI provider. We do not copy conversation content to our platform. We only count messages, as described in Monitoring explained.
- API keys you connect inside your agent: These stay in your agent's configuration on your server. The one exception, an encrypted copy kept when a key passes through OneClickClaw itself, is described in API Key Security.
- Message content: We do not intercept, log, or analyze any messages passing through your agent.
On Our Platform
On Your VPS Only
Note
Your AI conversations flow directly between your server and your AI provider. We do not read their content.
Website analytics and cookies
The OneClickClaw marketing site (oneclickclaw.io) uses a small, clearly listed set of cookies. Strictly necessary cookies keep you signed in and protect the site from bots (Cloudflare Turnstile). Every optional category in the cookie banner starts switched off. Analytics is the one that turns something on: Google Analytics 4 for aggregate visit statistics, and our own first-party cookies that remember which site or ad brought you to us.
Google Analytics 4 is loaded only after you opt in, either in the cookie banner or with the optional analytics box on the sign-in page. If you choose "Essential Only" or ignore the banner, no GA4 script is injected and no GA cookies are set. When enabled, GA4 runs with IP anonymisation. If you reached us through one of our ads on ChatGPT and opted in to analytics, our server reports a trial, a connected AI model or a payment to OpenAI with the ad's click reference, and never with your name, email address or IP address. We load no advertising script or pixel on the site, and we do not sell analytics data to third parties.
You can change your choice at any time by clearing site data for oneclickclaw.io (Browser Settings > Site data > Clear) and re-answering the cookie banner. We bump the banner version whenever the categories change so you are re-prompted automatically. The signed-in dashboard (/dashboard, /deploy) does not run GA4 at all.
Data location
Your dedicated VPS (where your OpenClaw or Hermes Agent, your AI key, and your customer conversations live) runs in a datacenter in Denmark (DK-DC1), operated by our infrastructure partner Webdock. What is stored on your server stays there, in the EU. What your agent sends to your AI provider, and to the messaging platforms you connect, goes wherever those services run.
Our central platform database (account records, billing metadata, deployment state) runs on that same Webdock infrastructure, in the same Danish data centre, so it never leaves EU jurisdiction and no transfer mechanism is needed for it. See the Subprocessors table on the GDPR page for the full list and locations.
Data retention
We retain your data according to the following schedule:
| Data Type | While Active | After Cancellation |
|---|---|---|
| Account info (name, email) | Retained | Deleted after 30 days |
| Server metadata | Retained | Deleted within 30 days after the server is destroyed |
| Billing records | Retained | Kept 7 years after the transaction (Greek tax law), then deleted |
| Event logs | Retained | Deleted within 30 days after the server is destroyed |
| AI conversations | On your VPS only | Deleted with VPS |
| API keys | On your VPS | Deleted with the server. Most of any encrypted copy we hold is cleared at the same time; ask support to remove anything left over |
Tip
If you want to keep any files from your server, copy them off before you cancel. On a paid plan you can do this over SSH, see How to enable SSH access.
Encryption and sign-in
- In transit: All connections use TLS encryption. Communication between your browser and the dashboard, between our platform and your VPS, and between your VPS and your AI provider are all encrypted.
- At rest: Credentials OneClickClaw keeps to operate your server (such as the gateway password, and any AI key copy described in API Key Security) are encrypted using Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256). Our platform database is encrypted at rest and protected by access controls.
- Sign-in: Google is the only way to sign in, so there is no OneClickClaw password to steal. A Google sign-in can only be finished in the browser that started it.
For details about your rights over this data, see GDPR Compliance.