The policy establishes a 10-day processing deadline for marketing opt-out requests and a 30-day deadline for Personal Data access requests. Data retention extends for the duration of account activity plus legal obligation periods. Opting out of marketing does not stop transactional or account-related communications.
This analysis describes what OneLogin's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes marketing opt-out rights and data retention terms. The 10-day opt-out processing deadline and the carve-out for transactional communications are operationally specific provisions relevant to both GDPR legitimate interests objection processing and CAN-SPAM compliance.
The updated policy discloses that OneLogin may record calls with consent and use AI to analyze call transcripts, chat conversations, and sales emails for multiple purposes including follow-up task identification, call summarization, sales analytics, communication effectiveness analysis, and forecast modeling. Under the revised terms, recorded call audio and video may be reviewed for employee training, monitoring, and coaching purposes. The policy also states that OneLogin will save chat and call conversation data to inform future interactions. These practices apply when you communicate with OneLogin via phone calls, chat, email, text, or other teleconference solutions. You should review the updated disclosure to understand how your communication data will be processed and retained.
View change record →The updated policy removes explicit language describing how OneLogin uses AI to analyze customer communications. Previously, the policy stated that call audio and video would be recorded with consent and analyzed using AI to identify follow-up tasks, summarize calls, and conduct sales analytics; that chatbot conversations would be analyzed and saved; and that sales emails would be analyzed to determine communication efficacy and forecast next steps. These specific AI analysis practices are no longer described in the updated policy. The revised language also narrows one stated data use purpose, changing 'answers or services you have asked or licensed' to 'services you have purchased.' No consumer opt-out mechanisms or alternative disclosures are provided in the change text.
View change record →Under these terms, marketing opt-out requests will be processed within 10 days of receipt, and Personal Data access requests will be responded to within 30 days. Personal Data is retained for the life of the account and as required by law; opting out of marketing does not terminate account-related communications.
Cross-platform context
See how other platforms handle Marketing Communications Opt-Out and Data Retention and similar clauses.
Compare across platforms →"You may choose to receive or not receive marketing communications from us by indicating your preferences on this Website. If you would prefer not to receive future marketing communications or wish to change or modify information previously provided or delete inaccuracies, please contact us at listmaster@oneidentity.com. Upon receipt of your request, your information will be updated as soon as possible, but no later than ten (10) days after our receipt of your request. We will respond to all requests for access to your Personal Data within 30 days. We will retain your Personal Data for as long as your account is active or as needed to provide you services and as necessary to comply with our legal, regulatory or compliance obligations. Even if you opt out of receiving marketing communications, we may still communicate with you in connection with servicing any existing account you may have, fulfilling a request from you, or administering any promotion or any program in which you may have elected to participate.Excerpt from OneLogin's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision operationalizes marketing opt-out rights and data retention terms. The 10-day opt-out processing deadline and the carve-out for transactional communications are operationally specific provisions relevant to both GDPR legitimate interests objection processing and CAN-SPAM compliance.
Under these terms, marketing opt-out requests will be processed within 10 days of receipt, and Personal Data access requests will be responded to within 30 days. Personal Data is retained for the life of the account and as required by law; opting out of marketing does not terminate account-related communications.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OneLogin.