Back to Tools
OneLence logo

OneLence

Partially Compliant

German marketing decision platform from Crelora GmbH in Lützen, helping small teams decide what to scale, hold, stop or review across paid, organic, creator and affiliate sources, from $49 a month with a 7-day free trial.

🇩🇪Germany

Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.

Paidfrom $49/month
OneLence website screenshot

GDPR Compliance Data

Not independently verified
GDPR Status
Partially Compliant
HQ CountryGermany
OwnershipEuropean-owned
Foreign Disclosure ExposureUS CLOUD Act / FISA 702
Data Hosting Location
Unknown
EU Servers Available
Data Processing AgreementNot verified
Sub-processor ListNot verified
Schrems II Risk
Medium Risk
SCCs in Place
Last Verified7 October 2026

How we reached this

German legal entity: Crelora GmbH, Ernst-Thälmann-Straße 41, 06686 Lützen, Germany, Handelsregister HRB 35614 at Amtsgericht Stendal, VAT ID DE453924952, named as controller in the Privacy Policy, as provider in the Terms of Service and in the Legal Disclosure (Impressum), all read raw (curl, not WebFetch summary) 2026-10-07. North Data lists Crelora GmbH, Lützen, under the same court and register number. Terms governed by the law of the Federal Republic of Germany, exclusive venue Lützen, Saxony-Anhalt. Ultimate ownership was not stated in any document read; the Impressum names Yichen Chen and Fabio Parlascino as responsible persons. PARTIAL, not COMPLIANT, because three things are not published. (1) No DPA: the Privacy Policy says OneLence processes customer data as a processor 'as set out in your agreement with us', but no DPA is linked anywhere; /dpa, /subprocessors, /security, /trust and /gdpr all return 404 and the site footer links only to About, Contact, Cookies, Legal Disclosure, Privacy Policy and Terms. This is NOT_LOCATED, not NONE: failing to find a document does not show none exists. (2) No hosting region: Privacy Policy section 8 says infrastructure providers 'may include (without limitation)' Supabase (database, authentication), Cloudflare (network delivery), Google Cloud (hosting, storage) and Stripe (billing), with no region stated for any of them, so dataHostingLocation is UNKNOWN. (3) No named transfer mechanism: section 9 says 'We are based in the EU. If we transfer personal data outside the European Economic Area, we will ensure appropriate safeguards under GDPR (e.g. adequacy decisions, Standard Contractual Clauses, or other approved mechanisms)', which is generic rather than tied to a recipient, hence sccInPlace false and schremsIIRisk MEDIUM. extraterritorialExposure is US_CLOUD_ACT on the same reasoning as Rankscale: the named database and hosting providers are US companies that would hold the data whichever region is chosen. The privacy policy also names Google tools for the vendor's own product and marketing measurement. The vendor offered by email to answer GDPR and EU data hosting questions; questions for the vendor: DPA link, hosting region for Supabase and Google Cloud, a sub-processor list, and the transfer mechanism per recipient. Re-rate when answered.

About OneLence

Marketing Decisions When the Attribution Is Incomplete

OneLence is built for small marketing teams that have plenty of data and still cannot agree on the next move. Rather than another reporting dashboard, each source gets its own decision card showing the recommendation (scale, hold, stop or review), how strong the evidence is, what still needs checking and what to do before the next review. A signal that is too early or too weak to judge fairly is labelled as such instead of being forced into a verdict.

What It Covers

  • Source-level decisions: every affiliate, partner, creator, paid or organic source reviewed as its own decision unit, with evidence strength and timing
  • Affiliate and referral tracking: affiliate and creator-partner performance reviewed alongside other sources
  • AI visibility and SEO: AI visibility sits in the product navigation, with SEO Pro, AEO/GEO Pro and Affiliate Discovery Pro add-ons announced for the Scale plan
  • Operational diagnosis: on Premium, detection of where campaigns, funnels and sources fall out of sync, with guided repair paths
  • Connected AI apps: an MCP server and API let Claude, ChatGPT, Cursor, Codex or a command line read workspace data under permissions the user approves, with tokens that expire after an hour

Pricing

Public on the site. Prices default to US dollars with a euro toggle, and all prices exclude VAT. Starter is $49 a month ($40 a month billed annually) for 50,000 tracking events, 1,000 conversion events, one website and one seat, aimed at affiliate and partner-source review. Pro is $119 a month ($99 annually) for 200,000 events, 2,500 conversions and three seats, covering paid, organic, creator, affiliate and referral sources together. Premium is $169 a month ($139 annually) for 400,000 events and adds operational diagnosis. Scale has larger capacity (2 million events, five websites, ten seats) and is priced on request. Every plan has a 7-day free trial. History windows run to 45 days on Starter and 90 days on the higher plans. Usage beyond the included limits can be enabled and is billed at the end of the month, at $0.00028 per extra event, $0.07 per extra conversion and $0.01 per extra AI credit.

The German Entity and What Is Not Yet Published

OneLence is operated by Crelora GmbH, Ernst-Thälmann-Straße 41, 06686 Lützen, Germany, entered in the commercial register at Amtsgericht Stendal under HRB 35614, VAT ID DE453924952. The terms are governed by German law with Lützen as the exclusive venue.

On data handling, the picture is incomplete rather than negative. The privacy policy says OneLence acts as a processor for customer data and lists infrastructure providers that may include Supabase, Cloudflare, Google Cloud and Stripe, but it does not state a hosting region for any of them, and the list is introduced with "without limitation". For transfers outside the EEA it promises appropriate safeguards in general terms, without naming a mechanism for a specific recipient. We searched for a Data Processing Agreement, sub-processor list, security page and trust centre and found none, and none is linked from the site footer. That does not show that a DPA does not exist, only that we have not seen one. Because the named hosts are US companies, this listing carries US CLOUD Act exposure on the same reasoning as other EU-headquartered tools hosted on US cloud providers.

The vendor has offered to answer GDPR and hosting questions, so this listing is expected to improve as those documents appear.

Where It Fits

For readers comparing analytics and measurement tools, see also Plausible Analytics, Rybbit and the wider Web Analytics and AI Marketing categories.

Key Features

Scale, hold, stop or review decision for each marketing source
Evidence strength and timing labels, including a clear 'too early to judge' state
Paid, organic, creator, affiliate and referral sources reviewed together
Affiliate and creator-partner performance review
Operational diagnosis with guided repair paths on Premium
MCP server and API for Claude, ChatGPT, Cursor and Codex, with permission-scoped tokens
7-day free trial on every plan

Pros & Cons

German GmbH with a verifiable commercial register entry (HRB 35614, Amtsgericht Stendal) and German governing law
Public pricing from $49 a month with a 7-day free trial, easy for a small team to buy
Source-level decisions with explicit evidence strength, rather than another reporting dashboard
Connected-app access is permission-scoped, with one-hour access tokens revocable at any time
The vendor offered to answer GDPR and hosting questions when asking to be listed
No DPA located, no sub-processor page and no stated hosting region at the time of review
Named infrastructure (Supabase, Google Cloud, Cloudflare) is US-owned, so US CLOUD Act exposure applies
The sub-processor list is introduced with 'without limitation', so it is not a complete list
Prices default to US dollars and exclude VAT; the euro figure is only shown on a toggle
History windows of 45 to 90 days, and usage beyond plan limits is billed per event
Several announced add-ons (SEO Pro, AEO/GEO Pro, Affiliate Discovery Pro) are not yet released

OneLence GDPR & data protection: common questions

Is OneLence GDPR compliant?

Partly. OneLence meets some of the requirements, with caveats worth reading before you commit. OneLence is a European company headquartered in Germany.

Where does OneLence store data?

We could not locate a clear statement of where OneLence hosts data. Ask the vendor directly, or check their privacy policy and sub-processor list before signing.

Does OneLence offer a Data Processing Agreement (DPA)?

We could not locate a published DPA for OneLence. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.

What a DPA has to cover →

Is OneLence a European company?

Yes. OneLence is headquartered in Germany and, as far as we can establish, European-owned.

Is OneLence subject to the US CLOUD Act?

Indirectly. OneLence itself is European-owned and headquartered in Germany, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is.

Schrems II compliance checklist →

Spotted something wrong?

Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.

If you work at OneLence and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.