This policy explains what personal data we collect when you use Unifyed, why we collect it, who we share it with, and your rights. We're committed to GDPR compliance and treating your data with care.
1. Data we collect
Account data: email, name, hashed password (bcrypt). Subscription data: plan, billing status, Stripe customer ID. Usage data: conversation history, daily message counts, models used. Technical data: IP address, browser type, language preference (cookie).
We do not collect: payment card details (Stripe handles those), unnecessary identifiers, biometric or sensitive data.
2. How we use your data
To operate the Service: authentication, displaying conversations, processing payments. To improve the Service: aggregated analytics on usage patterns. To communicate: transactional emails (welcome, password reset, payment failures), occasional product updates if you opt in.
We do not use your conversations to train AI models, ours or anyone else's.
When you file a refund request, we also collect the identity details that form asks for — name, date of birth, postal address, phone number, the last four digits of the card, and the answers you select — together with the date, time and IP address of the request. We use them to handle your request and, where necessary, to establish and defend our rights in a payment dispute. They are kept for as long as a payment can still be disputed by a card scheme, and are never used for marketing.
3. Third-party processors
Each processor is bound by data processing agreements compliant with GDPR. AI providers are configured to not retain or train on prompts sent through OpenRouter.
- Stripe (Ireland) — payment processing, customer billing
- MongoDB Atlas — database hosting (EU region)
- OpenRouter — AI model routing; prompts are forwarded to AI providers (OpenAI, Anthropic, Google, xAI) for inference only
- Resend — transactional email delivery
4. Data retention
Conversations: stored as long as your account is active, plus the history limit of your plan (30 days for Standard, unlimited for Pro). Account data: retained until you delete your account, then erased within 30 days, apart from the limited record described below. Stripe data: retained per Stripe's policy (up to 7 years for accounting/tax compliance).
When you delete your account, we keep a minimal record: a one-way fingerprint of your email address, the dates your subscription began and ended, and your billing history. The fingerprint cannot be turned back into an address, emailed, or exported — it only lets us tell whether an address has been registered before. We keep this to prevent repeated abuse of our free trials and to meet our accounting and tax obligations. It holds no conversations, no name and no readable email address, and it never prevents you from signing up again.
5. Cookies
We use a minimal set of cookies: an authentication cookie (httpOnly, SameSite=Lax, expires after 30 days) for session management, and an i18n cookie storing your language preference (1 year). We don't use third-party analytics or advertising cookies.
6. Your rights (GDPR)
You have the right to: access your data, rectify inaccuracies, request erasure ("right to be forgotten"), restrict processing, data portability (export your conversations), object to processing, and withdraw consent at any time. To exercise these rights, email us at the address below; we respond within 30 days.
7. Security
All connections use HTTPS. Passwords are hashed with bcrypt (12 rounds). Database is encrypted at rest. Access to production data is restricted to authorized personnel. We have processes for breach notification within 72 hours as required by GDPR.
8. International transfers
Some processors (notably Stripe and OpenAI) are based outside the EU. Transfers are protected by Standard Contractual Clauses approved by the European Commission. By using Unifyed, you acknowledge these transfers are necessary for the Service to function.
9. Children
Unifyed is not intended for users under 18. We do not knowingly collect data from minors. If you believe we have, contact us and we'll delete it.
10. Contact
Data controller: Notmax, LLC. For privacy questions or to exercise your rights, email contact@unifyed.ai.
Last updated: May 7, 2026