Skip to main content

OneSignal AI Data Practices

Effective July 2026

This page is provided for informational purposes only and does not create any binding legal obligations on either party. It is not intended to be incorporated into any agreement. In the event of any inconsistency between this page and your Agreement or Data Processing Addendum with OneSignal, those documents control. Subject to change without notice.

Overview

OneSignal AI is OneSignal’s native AI assistant. It uses Claude, a large language model provided by Anthropic and accessed via Google’s Gemini Enterprise Agent Platform (GEAP), to help you draft messages, analyze audiences, and take actions within your OneSignal account.

This page covers data practices for OneSignal AI. For information about connecting your own AI or LLM tool to the Services via MCP (Customer AI Agent connections), see the Additional Product Terms, Section 2.

AI Output Accuracy Notice: OneSignal AI may produce inaccurate, incomplete, or outdated information. OneSignal does not guarantee the accuracy of AI-generated content. You are responsible for reviewing AI outputs before acting on them or sending them to your subscribers.

Data Used by OneSignal AI

What you provide (Customer Content)

OneSignal AI processes data you provide, which may include:

  • Prompts and messages you type in the OneSignal AI interface
  • Your campaign content, audience segments, and notification templates accessed via your OneSignal account
  • Skills Files and Brand Center assets you upload to guide AI responses

This data is Customer Content under the OneSignal Data Processing Agreement (DPA) and is protected accordingly.

What OneSignal’s systems generate (Usage Data)

OneSignal’s systems also generate operational telemetry that does not contain your content, including:

  • Infrastructure and API performance metrics
  • AI feature usage statistics (non-identifying)
  • Engagement predictions derived from aggregated, de-identified platform data

This data is Usage Data, owned and controlled by OneSignal, and is never shared externally in identifiable form. Learn more at Data Taxonomy.

Data Retention

AI Conversation Data (30 days)

Auto-deleted after 30 days. Deleted immediately on account closure or on customer request to privacy@onesignal.com.

AI evaluation and annotation logs (Up to 90 days)

Retained in OneSignal’s Google BigQuery environment (europe-west4). May be reviewed by authorized OneSignal personnel for service quality purposes. Auto-deleted at or before 90 days. Not subject to individual deletion requests; see your DPA for details.

Skills Files (Until deleted)

Deleted immediately when you remove them. Not retained by the AI model.

Brand Center assets (Until deleted)

Deleted immediately when you remove them. Not retained by the AI model.

GEAP request/response logs (Not retained)

Google’s GEAP request-response logging is disabled for OneSignal. Prompts and outputs are not stored at the Google infrastructure layer.

Your Controls

Disable AI for your organization

Organization Owners can disable all AI features for your entire organization. This setting:

  • Applies to all users in your organization immediately
  • Persists across OneSignal product updates; OneSignal will not re-enable AI features without your action
  • Can be managed in your Account Settings

Delete conversation history

You can request deletion of your AI Conversation Data history at any time by contacting privacy@onesignal.com. Conversations are also automatically deleted after 30 days. Note: AI evaluation and annotation logs are subject to a separate 90-day retention period and are not individually deletable. See above Data Retention section.

Customer AI Agent connections (MCP)

If you connect a Customer AI Agent (your external AI or LLM tool) to the Services via MCP, you control which data and actions within your OneSignal account it can access. You can revoke access at any time from your Account Settings. See Additional Product Terms, Section 2 for full terms governing Customer AI Agent connections.

What OneSignal Does and Does Not Do

OneSignal will NOT:

  • Use your Customer Content (prompts, outputs, campaign data, subscriber data) to train or fine-tune any AI or machine learning model
  • Share your prompts or AI outputs with Google or any third party for training purposes; prompts stay within Google’s GCP infrastructure
  • Disclose your data externally in identifiable form
  • Re-enable AI features you have disabled

OneSignal may:

  • Use aggregated, de-identified platform operational data (“OneSignal Analytics Data”), derived from platform operational telemetry only, never from your Customer Content or Subscriber Data, to improve AI features and platform performance
  • Retain AI Conversation Data in OneSignal’s own systems for up to 30 days to support conversation history features
  • Retain AI evaluation and annotation logs for up to 90 days for service quality purposes. These logs may be reviewed by authorized OneSignal personnel to evaluate and improve AI features. These logs are not used to train any AI or machine learning model.

Learn more at Data Taxonomy.

How OneSignal AI Works

OneSignal AI uses a retrieval-augmented generation (RAG) architecture:

  • Skills Files and Brand Center assets are retrieved per session to provide context; they are not fed into the model permanently or used to fine-tune it
  • Conversation history is maintained in OneSignal’s own systems, not by the AI model provider
  • AI inference (the actual language model processing) is performed by Anthropic’s Claude, accessed via Google’s Gemini Enterprise Agent Platform

Subprocessors

The subprocessors used for OneSignal AI are listed at List of Subprocessors.

Data Processing Agreement

Use of OneSignal AI and other AI features is governed by the OneSignal Data Processing Agreement (DPA). AI conversation data is Customer Personal Data under the DPA. Google’s GEAP and BigQuery are listed as subprocessors.

For questions about data processing, contact privacy@onesignal.com.