Privacy policy for the O2Lock app

Last updated 22 October 2026

This policy explains what personal data the O2Lock app and the One2Lock cloud service process, why, and what rights you have. It covers the app on iPhone and Android and the cloud service the app connects to.

Who is responsible

The data controller is ONE2LOCK AS, organisation number 931 853 783, Drammensveien 130, Inngang C19, 0277 Oslo, Norway. Contact us at info@one2lock.com about anything in this policy.

If the lock you use is managed by a company (for example a storage facility, an employer or a housing association), that company decides who may open it and is responsible for the access it gives you.

What we process

• Your account: your email address, your name if you give it, and how you sign in. With a password, we keep only a one-way hash of it. With Apple or Google, we keep the identifier they give us, and the email address they share, which may be a private relay address.
• Details an administrator adds: if a company manages your access, its administrators may record a phone number, address and notes about you.
• Your access: which locks you may open, and in what role (for example owner or manager).
• Use of the locks: when the app opens or locks a lock, it reports the time, which lock, and whether it worked. The lock also keeps its own log of openings.
• Feedback you send: if you use “Leave feedback” in the app, your message, together with the app version, your phone's model and its system version, linked to your account.
• Security records: sign-in times, failed sign-in attempts, and what administrators changed and when.
• Server logs: our servers record the network (IP) address and time of requests, to keep the service secure and working.

The app has no advertising and does not track you. It uses your phone's NFC to talk to the lock, and the camera only to scan a sharing QR code; the images stay on the phone. The QR scanner is Google's ML Kit, which sends Google anonymous diagnostics (the phone's make, model and system version, the app version, performance and error information, and an identifier for the installation that does not identify you), and does not pass them on. The app itself reads your phone model only to show where the phone's NFC antenna is; that stays on the phone.

Why, and on what basis

• To give you access to the locks you have been given, and to let you share them where you are allowed to: this is needed to provide the service you use (GDPR Article 6(1)(b)).
• To keep the locks and the service secure, find faults, and show the owner or administrator of a lock who opened it and when: our and the lock owner's legitimate interest in security (Article 6(1)(f)).
• To read and act on feedback you send us: our legitimate interest in fixing faults and improving the app (Article 6(1)(f)).
• To meet legal obligations, such as reporting security incidents (Article 6(1)(c)).

Who else handles the data

We do not sell your data or share it for marketing. We use these service providers, under data processing agreements:

• Cloud hosting in the EU/EEA: Amazon Web Services (Stockholm, Sweden), and, from the launch of the production service, Scaleway (Amsterdam, the Netherlands).
• Securosys (Switzerland), whose hardware security module protects our encryption keys. It does not hold your personal data.
• Apple and Google, if you choose to sign in with them.

The administrator or owner of a lock can see who has access to it and the reported openings.

How long we keep it

• Your account and access: until you delete your account, or an administrator removes it.
• Feedback: until your account is deleted, when it is deleted with it.
• Reports of lock use: kept as the lock's history. When your account is deleted, they are no longer linked to you.
• Server logs: 30 days.

Your rights

You can ask to see the data we hold about you, have it corrected or deleted, receive it in a portable format, object to processing based on legitimate interest, or have processing restricted. Write to info@one2lock.com. We answer within one month.

You can delete your account yourself in the app, under Management, or without the app as described on Delete your account.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no.

Children

The app is not intended for children under 13. A lock owner or administrator who gives a child access is responsible for doing so.

Changes

If we change this policy, we update the date at the top. Significant changes are announced in the app.