Skip to main content

OneSignal AI Data Practices

Effective September 2026

This page is provided for informational purposes only and does not create any binding legal obligations on either party. It is not intended to be incorporated into any agreement. In the event of any inconsistency between this page and your Agreement or Data Processing Addendum with OneSignal, those documents control. Subject to change without notice.

Overview

OneSignal AI is OneSignal’s native AI assistant. It uses Claude, a large language model provided by Anthropic and accessed via Google’s Gemini Enterprise Agent Platform (GEAP), to help you draft messages, analyze audiences, and take actions within your OneSignal account.

This page covers data practices for OneSignal AI. For information about connecting your own AI or LLM tool to the Services via MCP (Customer AI Agent connections), see the Additional Product Terms, Section 2.

AI Output Accuracy Notice: OneSignal AI may produce inaccurate, incomplete, or outdated information. OneSignal does not guarantee the accuracy of AI-generated content. You are responsible for reviewing AI outputs before acting on them or sending them to your subscribers.

Data Used by OneSignal AI

What you provide (Customer Content)

OneSignal AI processes data you provide, which may include:

  • Prompts and messages you type in the OneSignal AI interface
  • Your campaign content, audience segments, and notification templates accessed via your OneSignal account
  • Skills Files and Brand Center assets you upload to guide AI responses

This data is Customer Content under the OneSignal Data Processing Agreement (DPA) and is protected accordingly.

What OneSignal’s systems generate (Usage Data)

OneSignal’s systems also generate operational telemetry that does not contain your content, including:

  • Infrastructure and API performance metrics
  • AI feature usage statistics (non-identifying)
  • Engagement predictions derived from aggregated, de-identified platform data

This data is Usage Data, owned and controlled by OneSignal, and is never shared externally in identifiable form. Learn more at Data Taxonomy.

Data Retention

AI Conversation Data (Retained indefinitely - customer-directed)

Retained indefinitely in OneSignal’s own systems in europe-west4 at Customer’s direction. Deleted upon account closure or on customer request to privacy@onesignal.com.

Skills Files (Until deleted)

Deleted immediately when you remove them. Not retained by the AI model.

Brand Center assets (Until deleted)

Deleted immediately when you remove them. Not retained by the AI model.

GEAP request/response logs (Not retained)

Google’s GEAP request-response logging is disabled for OneSignal. Prompts and outputs are not stored at the Google infrastructure layer.

Your Controls

Disable AI for your organization

Organization Owners can disable all AI features for your entire organization. This setting:

  • Applies to all users in your organization immediately
  • Persists across OneSignal product updates; OneSignal will not re-enable AI features without your action
  • Can be managed in your Account Settings

Delete conversation history

You can delete your AI Conversation Data history. This deletion:

  • Can be requested at any time by contacting privacy@onesignal.com
  • Happens automatically after 30 days, even without a request
  • Does not apply to AI evaluation and annotation logs. These logs follow a separate 90-day retention period and are not individually deletable. See the Data Retention section above.

Customer AI Agent connections (MCP)

If you connect a Customer AI Agent (your external AI or LLM tool) to the Services via MCP, you control the connection. You can:

  • Control which data and actions within your OneSignal account the Customer AI Agent can access
  • Revoke access at any time from your Account Settings

See Additional Product Terms, Section 2 for full terms governing Customer AI Agent connections.

What OneSignal Does and Does Not Do

OneSignal will NOT:

  • Use your Customer Content (prompts, outputs, campaign data, subscriber data) to train or fine-tune any AI or machine learning model.
  • Share your prompts or AI outputs with Google or any third party for training purposes; prompts stay within Google’s GCP infrastructure.
  • Disclose your data externally in identifiable form.
  • Re-enable AI features you have disabled.

OneSignal may:

  • Use aggregated, de-identified platform operational data (“OneSignal Analytics Data”), derived from platform operational telemetry only, never from your Customer Content or Subscriber Data, to improve AI features and platform performance.
  • Retain AI Conversation Data in OneSignal’s own systems for up to 30 days to support conversation history features.
  • Retain AI evaluation and annotation logs for up to 90 days for service quality purposes. These logs may be reviewed by authorized OneSignal personnel to evaluate and improve AI features. These logs are not used to train any AI or machine learning model.

Learn more at Data Taxonomy.

How OneSignal AI Works

OneSignal AI uses a retrieval-augmented generation (RAG) architecture:

  • Skills Files and Brand Center assets are retrieved per session to provide context; they are not fed into the model permanently or used to fine-tune it
  • Conversation history is maintained in OneSignal’s own systems, not by the AI model provider
  • AI inference (the actual language model processing) is performed by Anthropic’s Claude, accessed via Google’s Gemini Enterprise Agent Platform

Subprocessors

The subprocessors used for OneSignal AI are listed at List of Subprocessors.

Data Processing Agreement

Use of OneSignal AI and other AI features is governed by the OneSignal Data Processing Agreement (DPA). AI conversation data is Customer Personal Data under the DPA. Customer is the data controller of AI Conversation Data and is responsible for determining the lawful basis for processing under applicable data protection laws. Google’s GEAP and BigQuery are listed as subprocessors.

For questions about data processing, contact privacy@onesignal.com.