At a glance
- Protected cloud hostingApp data and encrypted backups are held in managed cloud infrastructure.
- Only what is neededName, phone or chat ID, delivery address, orders and chats. No card details, ID documents or contacts.
- Never sold, never used for trainingWe do not sell personal data, and chats are not used to train AI models.
- Deleted on scheduleEach business chooses how long chats are kept. Older chats are deleted automatically.
- Each business isolatedRow-level security in the database keeps every business’s data separate.
- Your rightsAccess, correction, export and erasure, in line with India’s DPDP Act 2023.
Who is responsible
- Businesses and their staff (our customers). For account, billing, support and security data, UnitOne AI is the Data Fiduciary (controller).
- A business’s own customers. When you chat with a business that uses Beyond Replying, that business is the Data Fiduciary and decides how your data is used. UnitOne AI is its Data Processor and handles the data only on the business’s instructions, under our Data Processing Addendum. The first reply you receive tells you that you are talking to the business’s assistant and links to its own privacy notice.
If you are a business’s customer, please send requests about your data to that business first. If you write to us, we will pass your request to the business and help it respond.
What we collect and why
| Data | Why |
|---|---|
| Customer name or profile name, phone number or chat-app ID (a random visitor ID on website chat) | To reply to the right person and keep the conversation together |
| Messages with the business and its assistant | To answer questions, take orders and bookings, and let staff review or take over |
| Delivery address and notes (encrypted), orders and bookings | To fulfil the order or appointment, and for the business’s records |
| Voice notes and website voice typing (turned into text; the audio is not kept) | So the assistant can answer what you said |
| Contact details given in a lead form or when asking for a call back, and a short lead note the AI writes for the team (what you need, how urgent it looks) | So the business can get back to you, most urgent first |
| Beyond Replying sales form: your name, email address, company, area of interest and message | For UnitOne AI to answer your enquiry about this product |
| Opt-out status (replied STOP) | So you are not messaged again |
| Business staff accounts: name, email, role, hashed password, two-step login secret (encrypted) | To give the right people safe access to the dashboard |
| Business setup: catalogue, prices, stock, offers, opening hours, channel connections (tokens encrypted) | To run the assistant for the business |
| Billing and security records: plan, invoices, GST details, sign-in events, IP address, audit log (without message text) | Billing, tax law, preventing abuse and keeping accounts secure |
Not collected: payment card or bank details, government ID numbers, location tracking or phone contacts. Photos and documents are not downloaded or stored; the assistant is only told that one was sent. Voice notes are turned into text by our AI provider and only the text is kept, never the audio. Please do not share sensitive information over chat.
What we never do
- We do not collect data secretly. The assistant says who it is in its first reply and links the business’s privacy notice.
- We do not sell personal data or use a business’s customer data for our own marketing.
- We do not build profiles of people across different businesses.
- We do not use chats to train AI models, and our AI providers do not train on data sent through their business APIs under their API terms.
- We do not send customer phone numbers to AI providers.
- We do not message people for marketing unless the business turns it on. Campaign messages go only to people who chatted with the business and always include a STOP option.
AI processing and accuracy
Replies are drafted by large language models from OpenAI and Anthropic (United States), used through their business APIs. We send only what is needed to reply: the conversation text, the business’s catalogue and settings, and order details. Voice notes are turned into text by OpenAI; if a business turns voice replies on, a reply to a WhatsApp voice note can also be sent as a voice note made from the text reply. The AI also writes short lead notes for the business’s team; phone numbers typed in the chat are hidden from it.
AI is not 100% accurate. The assistant can sometimes misunderstand a message or give a wrong answer. Prices, stock and order totals are re-checked by our system, not taken from the AI. Businesses stay in control: they can approve every reply (Copilot), set approval limits for large orders, get alerts, and take over any conversation. The AI does not make decisions with legal or similarly significant effects on anyone. If you see a mistake, tell the business or write to us, and we will work to fix it on a best-effort basis.
Storage and security
- Location: our application infrastructure is currently hosted in India. Some service providers, including AI model providers and messaging platforms, may process data in other countries. We will update this notice if our hosting location changes.
- Encryption: HTTPS (TLS) in transit; off-site backups encrypted at rest; customer addresses and notes, call-back contacts, enquiry answers, lead notes, channel access tokens and two-step login secrets additionally encrypted field by field (AES-256-GCM) with a key kept outside the database.
- Isolation: PostgreSQL row-level security on every business table, so the database itself refuses to return one business’s data to another.
- Access: owner, admin and member roles checked on the server for every action; two-step login required for owners and admins; passwords stored only as argon2id hashes; sessions expire after 12 hours idle; sign-in attempt limits.
- UnitOne staff: our team sees usage numbers only. A small number of named super-admins can view a business’s chats only for support the business asked for, for security, or where the law requires, and every such view is logged.
- Platform: verified webhook signatures, validated inputs and security headers.
No system is perfectly secure, but we work to protect data and review our measures regularly. If a breach affects personal data, we will notify affected businesses without undue delay and within 72 hours of becoming aware, and inform authorities as the law requires.
How long data is kept
| Data | Kept for |
|---|---|
| Customer chats, enquiry answers and lead notes | Chosen by each business, from 7 days to 5 years (default 180 days). Deleted automatically once older. |
| Voice audio | Not kept: only the text |
| Customer profile (name, number, address) | Until erased on request, or deleted with the business’s account |
| Orders | As long as the business needs them for its records and tax law; personal details can be erased on request |
| Invoices and billing records | 8 years, as Indian tax and company law requires |
| Backups | 14 days on the server and 90 days in encrypted off-site storage, then deleted |
| Beyond Replying sales enquiries | While needed to respond and maintain ordinary business correspondence; you may request deletion |
Full retention details, including backups and closed accounts, are in the Privacy Policy.
Your rights
Under India’s Digital Personal Data Protection Act, 2023 you can:
- get a summary of the personal data processed about you and who it was shared with (access);
- have it corrected, completed or updated;
- have it erased;
- withdraw consent at any time;
- have a grievance addressed; and
- nominate someone to exercise your rights if you die or become unable to.
Businesses can export a customer’s data or erase it from the inbox. Customers can reply STOP to stop messages, DELETE to ask the business to erase their data, ask the assistant for a person, or contact the business directly. If you are in the EU, UK or a similar jurisdiction, you also have rights to portability, objection, restriction and to complain to your supervisory authority. We may need to verify your identity before acting on a request.
Contact
Privacy questions and requests: privacy@unitoneai.com. Grievances: grievance@unitoneai.com. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Related: Privacy Policy · Terms · Data Processing Addendum · Sub-processors