Privacy policy

Who is responsible

Unisonia decides how and why the information described here is processed. For anything about your information, write to [email protected].

A workspace's owner decides what their team and their agents put into it. When you add other people's information to a workspace (in an issue, a video, a financial entry), make sure you may share it.

Information we handle

• Account: your name, email address, profile image and sign-in identifiers, received through our sign-in provider when you sign up or sign in, including through Google or GitHub. We do not request access to your Gmail, Drive or other Google content.
• Workspace content: what you and your team add, including files and your conversations with Sona.
• Connected services: when you connect a service, the credentials you enter, encrypted before storage, and the data you asked Unisonia to sync, such as repositories, issues, revenue, costs and analytics.
• Billing: Stripe customer, subscription, invoice and payment identifiers, billing status, credit balance and usage. Card details are entered on Stripe's pages; Unisonia never receives full card numbers or security codes.
• Sona's work: records of each run and what it produced.
• Technical data: IP address, browser and device details and request logs, needed to deliver and secure the service, and error reports. Logs do not hold your prompts or Sona's responses.
• Product analytics, when enabled: on public pages, which page a signed-out visitor opens (without any query), the referring site, campaign tags, the browser, system and device type, and how long and how far the page was read; and, without a profile, that an account signed up (with the site and campaign it came from), made a project, connected an integration (which provider), started the trial or paid for the plan, under an opaque sign-in identifier. Visitors are counted by a code our analytics provider derives from the IP address, browser and time zone with a key it replaces and deletes daily, so a visitor is not recognised across days and the IP address is not stored. A random visit code, kept in the open page's memory and carried by the sign-up link, connects a landing visit to its sign-up. A visit notes the country our network provider reads from the IP address, and nothing finer; our analytics provider receives the IP address of each request but is told not to derive a location from it. Nothing is sent from your browser while you are signed in. No names, email addresses, credentials or workspace content, and no cookies.

Why we use it, and on what basis

• To provide Unisonia (performing our contract with you): your account and workspaces, syncing the services you connect, Sona's work, emails about your workspace and support.
• To bill (contract, and the legal duty to keep tax and accounting records): the plan, credits, invoices, refunds and taxes.
• To keep Unisonia secure and working (our legitimate interest in a reliable, abuse-free service): request logs, error reports, rate limits and fraud and abuse checks.
• To improve Unisonia (our legitimate interest in understanding how the product is used): the product analytics above, which use no cookies. You can object at any time by writing to us.

We do not sell your information, use it for advertising, or use your workspace content to train AI models.

Sona and AI providers

Sona's work runs on AI models from OpenAI and Anthropic. What you send her (messages, attachments, the items you put in context) and the workspace data her work needs (a project's issues, numbers, site pages, assets) are sent to these providers to produce her answer. We use their business APIs, whose terms describe that they do not train their models on this content by default and may keep it for a limited time for safety and abuse monitoring.

A video is made in a working session at Anthropic that holds its conversation and files; it is deleted after 30 days without use, or with its project or workspace.

Who processes it for us

Providers process information on our behalf, only to perform their function; the subprocessors page lists each with its purpose, the data it handles and where.

Services you connect, such as GitHub, Google and ElevenLabs, are not our processors: Unisonia retrieves data from them, or writes to them, at your request, and each handles your data under its own terms.

International transfers

Unisonia runs in the United States: its application and database are hosted in the US East region, and most of the providers above are based in the US. If you are outside the US, your information is transferred there. Where a provider relies on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework for such transfers, we rely on the same mechanism in our agreement with it.

How long we keep it

• Your account, while it exists. Deleting your account removes you from your workspaces; a workspace you were the last owner of passes to its longest-serving admin, or, with no admin, is deleted with its plan.
• A workspace's content, while the workspace exists. When it is deleted, its data is deleted from our database, and its files and video agents' sessions are removed from storage and from Anthropic shortly after; our storage keeps a deleted file recoverable for 14 more days.
• Synced data from a connected service, until you disconnect it.
• Activity history and records of Sona's runs for 12 months; a conversation with Sona until it has gone 12 months without a new message.
• Payment records, as long as tax and accounting rules require, also after a workspace is deleted.
• Logs and error reports, about 30 days.
• Backups of the database, 90 days.

Your rights

Depending on where you live, you can ask to access your information, receive a copy in a portable format, correct it, delete it, restrict or object to how we use it, and withdraw any consent you gave. You can also complain to your local data protection supervisory authority.

You can export a workspace's data, or delete a workspace you own, under Settings › Workspace › General. For anything else, write to [email protected]; we answer within a month and may first confirm it is you.

Cookies

Unisonia uses only the cookies it needs: your sign-in session, and cookies that remember your last page tabs and how you arranged the app (a list or a board, Sona's panel). Cloudflare may set a security cookie, and Stripe sets its own on its checkout pages. Product analytics use no cookies.

Security

Data is encrypted in transit, credentials are encrypted at rest, and each workspace's data is kept apart from the others'. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Children

Unisonia is for people building and running software, and is not meant for anyone under 16. We do not knowingly collect information from children; if you believe a child has given us information, write to us and we will delete it.

Changes

When we change this policy we update the date above, and we tell workspace owners by email or in the app before a material change takes effect.