Privacy Policy
Last updated: 19 October 2026
Draft — pending legal review. Text in [square brackets] is still to be confirmed.
1. About this policy
This Privacy Policy explains how UnitOne AI [Private Limited — confirm exact registered name] (“UnitOne AI”, “we”, “us”), CIN [CIN], registered office at [Registered office address], [Hyderabad, Telangana], India, handles personal data in Beyond Replying — an AI sales receptionist that answers a business’s customers on WhatsApp, a website chat widget, Telegram, Instagram and Facebook Messenger, takes orders, tracks stock and alerts the business owner.
It covers unitoneai.com, app.unitoneai.com, the chat widget and the messaging channels connected to Beyond Replying. It is written to meet India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules under it, the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), and, for people outside India, the principles of the EU/UK GDPR.
2. Our two roles
- Businesses and their staff (our customers). For account, billing, support and security data about the businesses that sign up and their team members, UnitOne AI is the Data Fiduciary (controller).
- The business’s own customers. When you chat with or order from a business that uses Beyond Replying, that business is the Data Fiduciary and decides how your data is used. UnitOne AI is its Data Processor: we process that data only on the business’s instructions, under our Data Processing Addendum. Each business publishes its own notice at
/privacy/<business id>, linked in the first reply you receive.
If you are a business’s customer, please send requests about your data to that business first. If you contact us, we will pass your request to the business and help it respond.
Your data at a glance
- Stored: name, phone number or chat-app ID, delivery address (encrypted), order history, and chat messages for the period the business chooses.
- Not stored: no payment card or bank details, no ID documents, no contacts. Photos and voice notes are not downloaded.
- Who can see it: the business’s own team, limited by their role. UnitOne staff look only when needed for support, security or the law, and every look is logged.
- Deleted automatically: chats are deleted once the retention period ends.
3. What we collect
From businesses and their staff
- Account: name, email, password (stored only as an argon2id hash), role, two-step login secret (encrypted) and recovery codes (hashed).
- Business setup: business name, profile, opening hours, catalog, prices, stock, offers, delivery rules, staff WhatsApp numbers for alerts, and the privacy notice and terms you publish to your customers.
- Channel connections: identifiers and access tokens for WhatsApp, Telegram, Instagram and Messenger (tokens encrypted).
- Billing: plan, credit usage, invoices and GST details. Card or bank details are handled by our payment provider [name of payment gateway]; we do not store them.
- Security and usage: sign-in events, IP address (for attempt limits and abuse prevention), an audit log of actions in the dashboard (without message bodies), and AI usage counts.
- Support: what you tell us when you contact us.
From a business’s customers (as processor)
- Name or profile name, phone number or chat-app ID (Telegram, Instagram or Messenger ID), or a random visitor ID for the website widget.
- Messages exchanged with the business and its AI assistant, including messages in WhatsApp groups the business connects.
- Delivery address and notes (encrypted), orders and bookings, and whether you opted out (replied STOP).
Not collected: payment card or bank details, government ID numbers, location tracking, phone contacts. Photos and voice notes are not downloaded or stored — the assistant is only told that one was sent. Please do not send sensitive data over chat.
4. How we use data and our legal basis
| Purpose | Data | Basis |
|---|---|---|
| Create and run your account; provide the service | Account, business setup, channels | Contract; your consent at sign-up (DPDP Act s.6) |
| Answer customers, take orders, alert staff — for the business | Customer data | The business’s instructions and its own lawful basis (we are processor) |
| Billing, invoices and tax records | Billing data | Contract; legal obligation (GST and accounting laws) |
| Security, fraud and abuse prevention, two-step login | Security and usage data | Legitimate uses permitted by law (DPDP Act s.7); legal obligation (IT Act, CERT-In) |
| Support and service messages (e.g. password reset, account alerts) | Account data | Contract |
| Product news and offers to businesses | Consent — you can opt out at any time |
We do not sell personal data, do not use a business’s customer data for our own marketing, and do not use it to build profiles across businesses.
5. AI processing
Replies are generated by large language models from OpenAI and Anthropic, which we use as sub-processors through their business APIs. We send only what is needed to reply: the conversation text, the business’s catalog and settings, and order details. Customer phone numbers are not sent to AI providers.
Under their API terms, these providers do not use API data to train their models, and they keep it only for a limited period for abuse monitoring unless a zero-data-retention arrangement applies. We do not use customer data to train any model.
The AI does not make decisions with legal or similarly significant effects on anyone. Businesses choose how much it may do on its own (“Co-pilot” drafts for approval or “Autopilot”), set approval limits for large orders, and their staff can take over any conversation.
6. Sharing and sub-processors
We share personal data only with:
- the business you are dealing with and its authorised staff;
- our sub-processors listed on the sub-processors page (hosting, AI models, messaging platforms, email), under written contracts that require confidentiality and security;
- authorities, when required by law or a valid legal order, or to protect people’s safety or our legal rights;
- a buyer or successor if our business is merged or sold, who must continue to protect it under this policy.
Messaging platforms (Meta for WhatsApp, Instagram and Messenger; Telegram) carry messages between the business and its customers and process them under their own terms and privacy policies.
7. Where data is stored and international transfers
Our application servers and database are hosted by Amazon Web Services in the Mumbai (ap-south-1) region, India, including encrypted backups.
Some sub-processors (AI model providers, Meta, Telegram, our email provider) may process data outside India, mainly in the United States. The DPDP Act allows such transfers except to countries the Government of India restricts by notification; we will stop or adapt transfers if a destination is restricted. For data of people in the EU or UK, we rely on the providers’ Standard Contractual Clauses or equivalent safeguards.
8. How long we keep data
| Data | Kept for |
|---|---|
| Customer chats and AI conversation state | Chosen by each business: 7 days to 5 years (default 180 days). Deleted automatically every hour once older. |
| Orders and order items | As long as the business needs them for its records and tax law; a customer’s name, number and address can be erased on request. |
| Customer profile (name, number, address) | Until erased on request, or deleted with the business’s account. |
| Business account and setup | While the account is active, then deleted within [90] days after closure, except invoices. |
| Invoices and billing records | 8 years, as required by Indian tax and company law. |
| Audit log and UnitOne staff access log | With the business’s account; security logs at least 180 days (CERT-In Directions, 2022). |
| Backups | Rolling [35] days, then overwritten. |
9. How we protect data
- Encryption: TLS 1.2+ in transit; database and backups encrypted at rest; customer addresses and notes, channel access tokens and two-step login secrets additionally encrypted field-by-field (AES-256-GCM) with a key kept outside the database.
- Isolation: every business’s data is separated by PostgreSQL row-level security, so the database itself refuses to return one business’s rows to another; the application checks the business on every query as well.
- Access: role-based permissions (owner, admin, member); two-step login is mandatory for owners and admins; sessions expire after 12 hours idle; passwords hashed with argon2id; sign-in attempt limits.
- UnitOne staff: our team sees usage numbers only. A small number of named super-admins can view a business’s chats or customer records, only to provide support the business asked for, for security, or where the law requires — and every such view is logged. Production database access is restricted to named engineers through a secrets manager.
- Platform security: webhook signatures verified, inputs validated, security headers, dependency audits, and a reasonable security practices programme under the SPDI Rules [ISO/IEC 27001-aligned — confirm].
No system is perfectly secure, but we work to protect data and review our measures regularly.
10. Your rights
Under the DPDP Act you can:
- get a summary of your personal data we process and who we shared it with;
- have it corrected, completed, updated or erased;
- withdraw consent at any time (this does not affect processing already done);
- have a grievance addressed (see Contact and Grievance Officer); and
- nominate another person to exercise your rights if you die or become incapable.
If you are in the EU, UK or a similar jurisdiction, you also have the right to data portability, to object to or restrict processing, and to complain to your local supervisory authority.
Businesses can export or erase a customer’s data from the Inbox. Customers can reply STOP to stop messages, ask the assistant for a person, or contact the business. To exercise rights against UnitOne AI, write to privacy@unitoneai.com. We may need to verify your identity. We respond within [30] days, and in any case within the time the law allows.
11. Children
Beyond Replying is a business tool and is not directed at children. Business accounts are for people aged 18 or over. Businesses must not use Beyond Replying to knowingly process children’s data without verifiable consent of a parent or lawful guardian as required by section 9 of the DPDP Act, or to track, behaviourally monitor or target advertising at children.
12. Cookies and local storage
| Name | Where | Why | Lasts |
|---|---|---|---|
__Host-fl_session | Dashboard (app.unitoneai.com) | Keeps you signed in. Strictly necessary; httpOnly, SameSite, Secure. | Up to 14 days (12 hours idle) |
br_visitor | Website chat widget (browser local storage) | A random ID so the chat continues where you left it. No tracking across sites. | Until you clear site data |
We use no advertising or analytics cookies. If we add any, we will update this table and ask for consent where required.
13. Personal data breaches
If a breach affects personal data, we will contain it, investigate and:
- notify affected businesses without undue delay and within 72 hours of becoming aware, with the details they need to meet their own duties;
- for data where we are the Data Fiduciary, inform the Data Protection Board of India and affected people as required by the DPDP Act and rules;
- report cyber incidents to CERT-In within 6 hours where the CERT-In Directions (2022) require.
14. Contact and Grievance Officer
In line with the IT Act, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, our Grievance Officer is:
[Name of Grievance Officer], Grievance Officer, UnitOne AI [Private Limited — confirm exact registered name]
[Registered office address], [Hyderabad, Telangana], India
Email: grievance@unitoneai.com · Phone: [+91 phone number]
Hours: Monday–Friday, 10:00–18:00 IST
We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. For general privacy questions, write to privacy@unitoneai.com.
15. Changes to this policy
We may update this policy as the product or the law changes. The date at the top shows the current version. For material changes we will notify account owners by email or in the dashboard at least [30] days before they take effect, unless a change is required sooner by law.