Privacy Policy

Who we are

unvelt is provided by Kanishak Sangwan, an individual based in India (“unvelt”, “we”, “us”). This policy explains how we handle personal data when you use the unvelt apps, website and related services (the “Service”).

For the purposes of applicable data protection laws, we are the data fiduciary (India) and the controller (EU and UK) of the personal data described in this policy.

• Contact: privacy@unvelt.co
• Grievance Officer (India): Kanishak Sangwan, privacy@unvelt.co

Information we collect

What we collect depends on the sources you turn on, which you control separately for each device. Sources are off until you turn them on. One source, which apps you use on your phone and when, is needed to use the Service. We collect:

• Account information, such as your email address, sign-in information, plan and subscription status, the services you connect, and your settings and choices.
• Location information, such as the precise location of phones where you turn location on, including when the app isn't open, and the places where you spend time. We don't collect the location of computers, but we may note when a computer moves between networks and, where you choose, the name of the Wi‑Fi network it uses.
• Movement and activity, such as when you start or stop walking, running, cycling, travelling in a vehicle or staying still.
• App and device activity, such as which apps you use and when; on computers, which app is in front, window and tab titles where you choose (never from private windows), whether you were active at the keyboard or mouse and for how much of the time (we never collect what you type), whether the camera or microphone is in use (never what they capture), and which app is playing sound; and screen, lock, idle, sleep, battery and charging state.
• Notifications, such as which app notified you, the kind of notification, and when. We never collect a notification's title, text or sender.
• Media you play, such as the title, artist, album and length.
• Health information, such as steps and sleep, including sleep stages, only where you turn on health access.
• Content you provide, such as your check-ins and the questions you ask, typed or spoken (including voice recordings and their transcripts), and corrections and other information you give us.
• Information from connected services, from third-party services you choose to connect, as you authorise.
• Information we create, such as your written days, and the places and routines we work out from your record. You can correct or delete it.
• Payment information. Payments are processed by our payment provider, which acts as the merchant of record under its own privacy terms. We receive your subscription status and related details, not your full card details.
• Communications, such as invite requests (including your country and, in the United States, your state) and messages you send us.
• Website information, such as the address your device uses to reach us, your browser and device type, and the pages you visit. We use the address to work out your approximate location, such as your country, and we keep it only in our service logs for a limited period.
• Technical information, such as an identifier for each installation of the apps, the device model, operating system, time zone, the name you give a device, or the one it already has, which may include your name, app version, IP address and log information. We receive some of this when you sign in on a device, and while the apps are running.

Location in the background. unvelt collects location data to show the places you went and the journeys between them in your record, even when the app is closed or not in use. Your location is never used for advertising and is never sold. Location is off until you turn it on.

When you turn a source on, we may also collect a short period of recent history from your device, so your first days aren't empty.

We don't collect your calls, text messages, contacts, calendar, photos, files or clipboard, and we don't take screenshots or screen recordings.

Information about other people. Your record may include information about other people, for example because you mention them in a check-in. We process that information only to provide the Service to you, as part of your record, and we don't use it to build profiles of the people in your life. If you tell us about someone else, you're responsible for doing so lawfully.

How we use information

We use the information we collect to:

• provide the Service to you, including recording and writing your days, answering your questions, learning your places, routines and preferences so that the Service works better for you, and providing the features you turn on;
• keep the Service secure, and detect and prevent fraud and abuse;
• work out approximately where you are, such as your country, from the address your device uses to reach us, so that we can tell you whether the Service is available where you live;
• operate the Service, including by producing aggregated statistics, such as usage and cost, that do not identify you;
• diagnose and fix problems, where you ask us to or choose to share diagnostics with us;
• process payments, and meet our legal, tax and accounting obligations; and
• send you messages about your account and the Service. We don't send marketing without your consent.

We don't sell your personal data, use it for advertising, or use it to train AI models.

Legal bases (EU and UK). We process personal data to perform our contract with you, including setting up and keeping your devices working with the Service, and the activity the Service needs in order to write your days at all; with your consent for the sources you choose to turn on, including location and health information, and your explicit consent where you turn on health access; for our legitimate interests in keeping the Service secure and operating it; and to comply with legal obligations. You can withdraw consent at any time.

India. We process personal data on the basis of your consent, which you can withdraw at any time, and for other uses permitted by the Digital Personal Data Protection Act, 2023.

AI

The Service uses AI models provided by third parties, for example to write your days and to answer your questions. These providers process your data on our behalf only to return a result, under terms that do not allow them to use it to train their models. Some providers, such as our speech-to-text provider, may hold what they process briefly, as described in “How long we keep information”.

When you ask unvelt a question, the answer is written by AI, not by a person.

Content produced with AI, such as a description of your day, may be incomplete or wrong. You can correct it.

How we share information

We share personal data only as described here.

• Service providers that process it on our behalf under contract, such as providers of cloud hosting and storage, sign-in and account authentication, AI models, speech-to-text, payment processing (our merchant of record) and email, and, only for people who opt in, diagnostics.
• At your direction, such as with services you choose to connect.
• Services that act on their own behalf. Some services receive information when you use a feature that depends on them, and act as their own controllers under their own terms rather than ours. For example, a service you connect receives what you choose to share with it. They are not processing it for us, and their own privacy terms apply to what they receive.
• For legal reasons, where we believe in good faith that the law requires it, or to protect the rights, safety and security of our users, the public or unvelt.
• In a business transfer, such as a merger or sale of the Service, subject to this policy, and with notice to you.

Where your information is processed

Your data is stored primarily in India. Our service providers may process it in other countries, including the United States and member states of the European Union. Where the law requires, we use appropriate safeguards for these transfers, such as standard contractual clauses.

How long we keep information

• We keep your record for as long as your account is open. If you stop using unvelt entirely, we delete your record after three years of inactivity, and we email you before we do.
• When you delete data, we remove it from our active systems promptly, and from backups within a limited period, typically up to 14 days. Service logs are kept for a limited period.
• Invite requests are deleted once your invite is sent, or after 180 days.
• We have your check-in recording and its transcript deleted from our speech-to-text provider shortly after it has been transcribed. Limited technical information about the request may remain with that provider for up to a year.
• We may retain limited information as needed to honour your choices, to comply with the law, or to resolve disputes.

Security

We use administrative, technical and physical measures designed to protect your data. Your data is encrypted in transit and at rest, access is restricted to the systems and people who need it to provide the Service, and access to the keys that protect your data is logged.

No system is completely secure. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.

Your rights and choices

You can:

• see what unvelt holds about you, in the app;
• get a copy of your personal data, on request;
• correct it;
• pause recording, or turn off any source on any device;
• delete your data, from a part of it to all of it; and
• withdraw consent, for example by turning a source off in Settings, which stops future processing for that purpose.

If you are in the EEA or the UK, you also have the right to object to processing, to ask us to restrict it, to receive your data in a portable form, and to lodge a complaint with your local data protection authority. If you are in India, you may also nominate someone to exercise your rights on your behalf, and raise a grievance with our Grievance Officer.

To make a request, write to privacy@unvelt.co. We respond within 30 days. If we need longer, we'll tell you why, and when to expect a reply. In India, you can also complain to the Data Protection Board of India.

Children

The Service is for people aged 18 and over. We don't knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data.

Additional information for US residents

• We don't sell personal information, or share it for cross-context behavioural advertising.
• We use precise geolocation only to provide the Service.
• Wherever you live in the United States, you can ask to know, access, correct and delete your personal information. We won't discriminate against you for asking.
• Washington residents: our Consumer Health Data Privacy Policy describes how we handle consumer health data and your rights under Washington law.

Cookies and information on your devices

Our website uses no cookies and stores nothing on your device. The unvelt apps use no analytics or crash reporting, and read information from your devices only for the sources you turn on and as needed to run the Service, such as device information. You can turn sources off at any time.

Changes to this policy

We may update this policy. If we make a material change, we'll tell you by email before it takes effect.