One Identity keeps your personal data for as long as it decides is necessary for its business and legal purposes, using a general risk-based approach rather than publishing specific retention periods for each data category.
This analysis describes what OneLogin's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational framework governing data lifecycle management, linking retention duration to business necessity and regulatory mandate rather than indefinite storage. The multi-factor assessment approach (amount, nature, sensitivity, risk, legal requirements) creates a structured basis for retention decisions.
The updated policy discloses that OneLogin may record calls with consent and use AI to analyze call transcripts, chat conversations, and sales emails for multiple purposes including follow-up task identification, call summarization, sales analytics, communication effectiveness analysis, and forecast modeling. Under the revised terms, recorded call audio and video may be reviewed for employee training, monitoring, and coaching purposes. The policy also states that OneLogin will save chat and call conversation data to inform future interactions. These practices apply when you communicate with OneLogin via phone calls, chat, email, text, or other teleconference solutions. You should review the updated disclosure to understand how your communication data will be processed and retained.
View change record →The updated policy removes explicit language describing how OneLogin uses AI to analyze customer communications. Previously, the policy stated that call audio and video would be recorded with consent and analyzed using AI to identify follow-up tasks, summarize calls, and conduct sales analytics; that chatbot conversations would be analyzed and saved; and that sales emails would be analyzed to determine communication efficacy and forecast next steps. These specific AI analysis practices are no longer described in the updated policy. The revised language also narrows one stated data use purpose, changing 'answers or services you have asked or licensed' to 'services you have purchased.' No consumer opt-out mechanisms or alternative disclosures are provided in the change text.
View change record →The provision removed the detailed criteria for determining retention periods (amount, nature, sensitivity, risk of harm) and simplified the language while keeping the core principle.
View full change record →One Identity does not publish specific retention timeframes for individual data categories, making it difficult to verify when your personal data will be deleted — you can request deletion at any time, but the company may retain data it deems necessary for legal or business reasons.
How other platforms handle this
We retain personal data for as long as necessary to provide our services, fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period for each category of personal data depends on the purpose fo...
We retain your personal information for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law. We may also retain and use your information to comply with our legal obligations, resolve disputes, and enforce our ...
Please note there are situations where Spotify is unable to delete your data, for example when: it's still necessary to process the data for the purpose we collected it for; we have an overriding interest in continuing to process the data, for example where we need the data to protect our services f...
Monitoring
OneLogin has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.— Excerpt from OneLogin's OneLogin Privacy Policy
REGULATORY FRAMEWORK: GDPR Art. 5(1)(e) (storage limitation principle) requires that personal data not be kept longer than necessary. GDPR Art. 13(2)(a) requires disclosure of retention periods or criteria at point of collection. UK GDPR imposes equivalent obligations. CCPA/CPRA does not mandate specific retention periods but prohibits retention beyond what is disclosed as necessary. FTC Act Section 5 applies to deceptive retention practices.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the operational framework governing data lifecycle management, linking retention duration to business necessity and regulatory mandate rather than indefinite storage. The multi-factor assessment approach (amount, nature, sensitivity, risk, legal requirements) creates a structured basis for retention decisions.
One Identity does not publish specific retention timeframes for individual data categories, making it difficult to verify when your personal data will be deleted — you can request deletion at any time, but the company may retain data it deems necessary for legal or business reasons.
ConductAtlas has identified this type of provision across 136 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OneLogin.