Privacy Policy

1. Who we are

Uniwork AI (“Uniwork”, “we”, “us”) is an AI work platform for small and growing businesses: organizations get workspaces, ready-made and custom-built business apps, an AI assistant (UniAgent), automations, and messaging channels such as WhatsApp and Telegram. Uniwork is a product of Estreetz Technologies Private Limited, a company incorporated in India (CIN [CIN]), registered office at [REGISTERED ADDRESS].

This policy covers our website (https://uniwork.ai), the Uniwork app and APIs, our desktop and mobile clients, and our communications with you. Questions: hello@uniwork.ai.

2. Our role: controller or processor

Customer Data — we are a processor. Content that an organization (our “Customer”) and its users put into Uniwork — records in apps, documents, files, chat with UniAgent, automations, WhatsApp and Telegram conversations with the Customer’s own contacts, and data about the Customer’s external users (for example its clients signing in to a portal or website the Customer built on Uniwork) — is processed on the Customer’s behalf and on its instructions. The Customer is the controller (under India’s DPDP Act, the Data Fiduciary) and we are its processor (Data Processor). If you are an end user of a Customer’s app or channel, please contact that business first; we will help it respond. Our Data Processing Addendum ([DPA LINK]) applies to Customer Data.

Everything else — we are the controller. Account and sign-in data, billing relationship data, security and fraud-prevention signals, website visits, waitlist sign-ups, cookie choices, support and marketing communications are processed by us as controller (Data Fiduciary), as described below.

3. Data we collect

You give us

• Account data — name, work e-mail, password (stored by our identity provider as a salted hash, never by us in plain text), phone number if you add one, profile photo, and if you sign in with Google, your Google profile name, e-mail and picture.
• Organization data — business name, brand, industry, workspace and team settings, the people you invite and their roles.
• Customer Data — anything you or your team create, upload, connect or send through Uniwork (see section 2).
• Waitlist and contact — name, e-mail, referral code and the page you came from when you request early access; whatever you write to us in support requests.
• Billing — plan, seats, billing country and tax details. Card and payment details are collected and held by our Merchant of Record, Dodo Payments, not by us; we receive the payment status, a reference and limited details (for example card brand and last four digits).

Collected automatically

• Usage data — features used, apps opened, AI credits and storage consumed, timestamps, errors, and audit-log events in your organization.
• Device and connection data — IP address, browser and OS type, language, approximate location derived from IP, and referring page.
• Security signals — a device identifier and a browser fingerprint, both stored only as one-way hashes (section 6).
• Cookies and similar technologies — see our Cookie Policy.

From third parties

• Google, when you choose Google sign-in; Meta (WhatsApp) and Telegram, when your organization connects a channel; and the tools your organization connects through integrations (for example Gmail or Outlook via Composio). We receive only what you authorize.

4. How we use it

We do not sell personal data, and we do not use Customer Data for advertising.

5. AI processing

• How it works. When you use UniAgent, App Studio or another AI feature, the prompt and the context needed to answer it (for example the records you asked about, within your permissions) are sent to an AI model provider listed on our Subprocessors page, and the answer is returned to you. The AI acts with your permissions — it cannot read data you are not allowed to see.
• No training on your data. We do not use Customer Data, prompts or outputs to train or fine-tune our own or anyone else’s AI models. We use model providers under API terms that prohibit them from training on that data; some providers may keep it for a short period solely for abuse monitoring, as their terms allow.
• Accuracy. AI output can be wrong or incomplete. Review it before relying on it, especially for legal, financial, medical or employment decisions. We do not make decisions that produce legal or similarly significant effects about you solely by automated means.
• Your control. Organization admins choose which AI features and models their team uses, and can see AI usage in the organization’s audit log.

6. Security and fraud prevention

To keep the platform safe and fair — for example to stop people from farming free trials with many accounts, signing up with disposable e-mail addresses, or using bots — we process:

• IP addresses (hashed where stored for rate limiting), sign-up and sign-in events, and e-mail domain checks;
• a device identifier and a browser fingerprint (characteristics such as browser, screen and platform settings), which we store only as one-way cryptographic hashes, so the original values cannot be read back;
• bot-protection signals from Cloudflare Turnstile on our forms.

These signals are used only for security, fraud and abuse prevention and enforcing our Acceptable Use rules — never for advertising. They may lead to an account being suspended or an IP address being temporarily blocked; if you think that happened in error, contact us and a person will review it.

7. Who we share it with

• Subprocessors who host and run the service for us under written contracts with confidentiality and data-protection obligations — the current list, with purpose and location, is on our Subprocessors page.
• Dodo Payments, our Merchant of Record, which sells the subscription to you and processes payments, taxes and invoices under its own privacy policy.
• Services your organization connects (WhatsApp, Telegram, Gmail, Outlook, payment providers and others) — data flows to them because you or your admin asked for it.
• Inside your organization — admins and members can see data according to the roles and permissions your organization sets.
• Authorities and advisers — where required by law, to respond to valid legal process, or to protect the rights, safety and security of our users, the public or us.
• Business transfers — in a merger, acquisition or sale of assets, subject to this policy.

8. International transfers

Our primary hosting is Microsoft Azure in the Central India region. Some subprocessors (for example our CDN, e-mail, sign-in and AI model providers) process data in other countries. Where data leaves the EEA, UK or Switzerland we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (and the UK Addendum) with supplementary measures. Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies.

9. How long we keep it

Customer admins can delete individual data at any time, and can delete the whole organization from its settings, which starts the post-cancellation window above.

10. How we protect it

Encryption in transit (TLS) and at rest; each organization’s compute and database isolated from every other organization’s; permissions enforced in the data layer for people and AI alike; least-privilege staff access with logging; an org-wide audit log; single sign-on and multi-factor authentication options; and regular backups. No system is perfectly secure — if a personal data breach affects you we will notify you and the relevant authorities as the law requires. Report a vulnerability to hello@uniwork.ai. More on our Security page.

11. Your rights

Depending on where you live you may ask us to: give you access to or a copy of your personal data; correct, complete or update it; delete it; restrict or object to some processing; port it to another service; withdraw consent at any time (without affecting earlier processing); and not be discriminated against for exercising a right. Email hello@uniwork.ai with the subject “Privacy request”. We will verify your identity before acting, and answer within the time the applicable law sets (one month under the GDPR). Many requests can also be handled directly in your account settings.

If your data is Customer Data (section 2), we will pass your request to the organization that controls it and help it respond.

12. India — Digital Personal Data Protection Act, 2023

As a Data Principal you have the right to: obtain a summary of the personal data we process and the processing activities; obtain the identities of other Data Fiduciaries and Data Processors we have shared it with; correction, completion, updating and erasure; grievance redressal; and to nominate another individual to exercise your rights in the event of death or incapacity. Where we rely on consent, you may withdraw it as easily as you gave it.

Grievance Officer. [GRIEVANCE OFFICER NAME], Estreetz Technologies Private Limited, [REGISTERED ADDRESS] · [GRIEVANCE OFFICER EMAIL]. We acknowledge grievances promptly and resolve them within the period prescribed under the DPDP Act and rules. If you are not satisfied, you may complain to the Data Protection Board of India after exhausting this process.

13. EEA, UK and Switzerland

The controller is Estreetz Technologies Private Limited (section 1). Our legal bases are listed in section 4. Our EU representative under Article 27 GDPR: [EU REPRESENTATIVE, if appointed]; UK representative: [UK REPRESENTATIVE, if appointed]. You have the right to lodge a complaint with your local supervisory authority.

14. California (CCPA/CPRA)

In the last 12 months we collected the categories in section 3 (identifiers, commercial information, internet activity, approximate geolocation, and professional information) for the business purposes in section 4, and disclosed them to the service providers in section 7. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing data of consumers under 16. We do not use sensitive personal information for purposes that require a right to limit. You have the rights to know, delete, correct and opt out, and to use an authorized agent. We honour Global Privacy Control signals as an opt-out.

15. Children

Uniwork is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children; if you believe a child has given us data, contact us and we will delete it. Customers whose own apps serve children are responsible for obtaining verifiable parental consent where the law requires it.

16. Changes to this policy

We will post any change here with a new “Last updated” date. For material changes we will also notify account owners by e-mail or in the app at least 30 days before they take effect, unless the change is required sooner by law.

17. Contact and grievances

Estreetz Technologies Private Limited (Uniwork AI), [REGISTERED ADDRESS]
General and privacy: hello@uniwork.ai
Grievance Officer: [GRIEVANCE OFFICER NAME] · [GRIEVANCE OFFICER EMAIL]