Privacy Policy
Last updated: 10 October 2026
How Yuniqa handles your personal data.
1. Who is responsible for your data?
The controller of your personal data is Yuniqa OÜ, an Estonian private limited company (registry code 17568749), Sepapaja tn 6, 15551 Tallinn, Estonia. It decides why and how Yuniqa processes your data. For data-protection requests, write to privacy@yuniqa.ai.
Some providers act as processors on Yuniqa's instructions; they are listed in section 7. Third-party services you choose to connect, such as your email account, are independent controllers for their own processing.
2. Scope and important points
This Policy applies to Yuniqa's website, web application, mobile applications, AI assistant, mini-apps, connected services, public or shared content, support, subscriptions and related services offered to individuals. A business customer may receive separate terms and a data processing agreement.
- You are interacting with an artificial-intelligence system when you use Yuniqa's assistant, agents, generation tools or automated features.
- Prompts, files and relevant context may be sent to the AI provider selected by you or routed by Yuniqa to deliver the requested feature.
- Do not enter another person's confidential or sensitive data unless you are authorised to do so and the feature is appropriate for it.
- Some optional Yuniqa AI features work out daily calorie targets on your device: the height, weight, age and sex you type for that are never sent to or stored by Yuniqa.
- Content can be private, shared with named people, or public. Yuniqa will identify the visibility choice before publication or sharing.
3. Data we collect
| Category | Examples |
|---|---|
| Account and identity | Clerk user identifier, email address, name, profile, authentication state, language, timezone, currency, settings and consent or legal-acceptance records. |
| Conversations and AI content | Prompts, messages, generated answers, system instructions, model choice, feedback, tool calls, search queries, conversation titles, files, images, audio, transcripts and generated applications. |
| Memory and personalisation | Facts or preferences saved or inferred from conversations, user instructions, custom assistants, reminders, routines, notification settings and feature configuration. |
| Connected services and email | Connected-account identifiers, authorisation status, email content and metadata, attachments, contacts or recipients, webhook events, trigger instructions, scheduled actions, tool approvals and execution results. |
| Meals and daily targets | Your daily calorie, macro and water targets, your goal, dietary preferences, liked and disliked foods, and the meals, scans and water you log. The height, weight, age and sex used to work out the targets stay on your device and are not collected. |
| Finance and productivity | Budgets, transactions, merchants, wallets, income, spending, recurring subscriptions, savings goals, notes, tasks, CVs, job preferences and documents. |
| Location and device permissions | Precise or approximate coordinates, accuracy, related queries, microphone/audio, camera, photo library, files, notifications and push token when you enable the relevant feature. |
| Shared and public content | Notes and task lists you share with named people, agents you make public, apps you publish, and the content associated with them. |
| Subscription and transaction data | Plan, status, customer and subscription identifiers, billing email, renewal/cancellation dates, transaction status, payment provider and limited card descriptors such as brand and last four digits. Yuniqa does not need to receive full card details. |
| Technical, security and analytics | IP address, device and browser information, operating system, app version, diagnostics, logs, security events, feature interactions, network telemetry, crash data, analytics identifiers and, only where lawfully enabled, session replay. |
| Support and communications | Support requests, correspondence, survey responses, complaints, privacy requests and information needed to verify and answer them. |
Data usually comes from you, your device, your use of Yuniqa, an account you connect at your request, a payment or app-store provider, another user who shares with you, or a service provider helping operate Yuniqa.
4. Why we process data and our legal bases
| Purpose | Main data | Legal basis |
|---|---|---|
| Create and secure your account; provide conversations, storage, requested models and product features | Identity, settings, content, files, device and service events | Performance of the contract |
| Connect third-party accounts and execute actions you request | Connection identifiers, authorised scopes, instructions, content and results | Performance of the contract; your instruction to connect the service |
| Provide some optional Yuniqa AI features | Daily targets, food preferences and meal logs | Performance of the requested feature |
| Provide personalisation and persistent memory | Conversation-derived facts, preferences, history and configuration | Performance of the contract for user-requested settings; consent where the feature is optional and the law requires it |
| Process subscriptions, credits, refunds, invoices and accounting | Identity, plan, transaction and limited payment metadata | Performance of the contract and legal obligations |
| Keep the service safe, prevent fraud and enforce rules | Account, technical, content and security events strictly necessary for investigation | Legitimate interests in service security and legal claims; legal obligations where applicable |
| Answer support, complaints and privacy-rights requests | Contact, account, request and relevant service data | Contract, legal obligations and legitimate interests in resolving disputes |
| Trace and debug AI requests and answers to improve the service | Requests sent to the AI models we use (your messages and their context) and the answers, with errors, response times, the model used and costs (kept 30 days) | Our legitimate interest in a service that works well |
| Measure and improve Yuniqa using non-essential analytics or replay | Identifiers, interactions, diagnostics and replay data | Consent where required by applicable tracking and device-access rules |
| Send optional product news or marketing | Email, language and communication preferences | Consent, with an unsubscribe option in every message |
| Establish, exercise or defend legal claims and comply with binding requests | Data relevant to the claim or request | Legal obligation or legitimate interests in legal defence |
Where Yuniqa relies on legitimate interests, it must first assess necessity and the effect on your rights. You may object for reasons relating to your situation. Yuniqa does not rely on consent where the processing is genuinely necessary to perform the service you requested.
5. AI providers, memory and automated features
Yuniqa does not build or run AI models itself. When you use an AI feature, Yuniqa passes your request to a third-party AI provider, either directly or through OpenRouter, a routing service that forwards it to a provider of the model in use. Yuniqa only routes requests to providers that do not use your content to train their models, and Yuniqa does not train AI models on your content either. OpenRouter and the provider that answers process the prompts, files, conversation context and responses needed to produce the answer. Some providers keep this content for a limited time under their own policies, for example for security, abuse prevention, service reliability or legal compliance; how long depends on the provider and the purpose.
Memory features can store or infer durable facts and preferences from conversations to personalise later answers. Yuniqa must provide controls to review, edit, disable and erase these memories. Agent and automation features can act on connected accounts, including after a trigger or schedule; the interface will show the relevant service, requested scope, approval state and result.
Yuniqa does not intend to make decisions producing legal or similarly significant effects about you solely through automated processing. If that changes, Yuniqa will provide the information and safeguards required by Articles 13, 14 and 22 GDPR before the processing begins.
6. Sensitive data and sharing controls
Yuniqa does not ask for health data. When some optional Yuniqa AI features log your meals, Yuniqa keeps only the daily targets you accept, your goal, your food preferences and what you log; the body measurements used to work out the targets are processed on your device only. If you choose to write health information in a conversation, a note or a meal description, it is handled like the rest of that content. You can delete any logged meal at any time, and all of it is deleted when you close your account.
- Accepting the Terms is never consent to process health data.
- Finance, email, precise location and uploaded documents are highly personal even when they are not special-category data under Article 9 GDPR.
- Yuniqa is not a medical device or healthcare professional and does not provide diagnosis or treatment.
7. Who receives data
| Recipient category | Purpose and examples |
|---|---|
| Hosting, database and content delivery | Cloudflare provides application data, files, execution, network and security infrastructure. |
| Authentication | Clerk provides sign-in, account identity and session management. |
| AI and search providers | OpenAI, Anthropic, Google, xAI, Mistral, OpenRouter and selected downstream providers process the content needed for the chosen model or feature; search/map providers process the relevant query and context. |
| Connected-service infrastructure | Composio and the service you connect process authorisation, actions, triggers and returned content. |
| Payments and app stores | Superwall, Apple and other applicable stores process purchases, subscriptions, refunds and fraud checks. When you ask Apple for a refund, Apple may ask us how much of the subscription was used, and we may answer through Superwall so that Apple can decide. |
| Analytics and support | We use PostHog (EU, Frankfurt) to trace and debug the requests sent to the AI models we use and their answers, so we can improve our service. This data is kept for 30 days. How PostHog measures use of the app and website is explained in section 11. Support requests are answered by email. |
| Communications and notifications | Resend, Apple, Google, Expo or applicable delivery providers transmit email and push notifications. |
| Professional advisers and authorities | Auditors, legal advisers, insurers, courts or authorities receive only data justified by a legal duty, request or claim. |
| Other users and the public | Recipients you select can access shared content; anyone may access content you deliberately publish. Visibility will be indicated before sharing. |
Yuniqa remains responsible for selecting and supervising the processors it uses to provide the service.
The companies behind these categories are named on the sub-processors page, with what each one does, where it is, the safeguard for data leaving the European Economic Area and a link to its own privacy policy. We keep that page up to date when a company is added, replaced or removed.
8. International transfers
Some of the companies that receive data are outside the European Economic Area, mostly in the United States. Each transfer has a safeguard recognised by the GDPR: the EU–US Data Privacy Framework when the company takes part in it, otherwise the European Commission's standard contractual clauses in its data processing agreement. The sub-processors page lists each company with its country and its safeguard; to get a copy of a safeguard, write to privacy@yuniqa.ai.
9. How long we keep data
Yuniqa keeps personal data only for the purpose described, then deletes or irreversibly anonymises it unless a law or legal claim requires restricted retention.
| Data | How long |
|---|---|
| Account, conversations, memory and user-created content | While the account or item remains active, then deletion at the user's request or account closure, subject to a documented backup deletion period and legal exceptions. |
| Meals and daily targets, finance, location and connected-service content | Until the user deletes the item, disconnects/withdraws where applicable, or closes the account; shorter feature-specific limits must be configured where the data is no longer needed. |
| Provider-side prompts, files, cache and output | AI providers never train on your content. OpenRouter keeps requests and answers for at least 3 months in a private log used only for Yuniqa's debugging. OpenAI and Anthropic keep requests for up to 30 days for abuse monitoring, longer only for content flagged as harmful (up to 2 years at Anthropic); OpenAI keeps no voice recordings it transcribes. Google keeps requests, voice included, for up to 55 days. Composio keeps the content of connected-app actions and incoming events for up to one year. |
| Traces of AI requests and answers in PostHog | 30 days |
| Usage analytics, error reports and screen recordings in PostHog | Usage events and error reports are deleted with your account, and PostHog never keeps them longer than 7 years. Screen recordings, if you agreed to them: 30 days. |
| Data held by other service providers | Resend keeps the emails it sends for 30 days. Expo does not store notification text after delivery. Sail keeps a crew desktop's files and browser sessions until the desktop is deleted, at the latest with your account. Clerk, Superwall and web search providers keep data under their own policies, only as long as they need to provide their service. |
| Security logs | Server logs at Cloudflare: 7 days. Only Yuniqa's administrator can read them. |
| Consent and legal-acceptance proof | For the duration needed to demonstrate the choice and defend related claims; a withdrawn choice remains recorded as proof, not as permission for new processing. |
| Invoices and mandatory accounting records | For the period required by applicable accounting, tax and record-keeping law. |
| Support and disputes | For handling the request, then the applicable limitation period where needed for legal claims. |
| Cookie/mobile tracker choice | Normally six months before requesting the choice again, unless a shorter period or material change requires renewal. |
| Backups | Encrypted backups are overwritten within 30 days and are used only to repair an incident, never for ordinary use. A scrambled marker of a deleted account is kept for 90 days so that a restored backup deletes it again. |
| Public content | Until unpublished/deleted or the account closes, subject to legal retention and copies independently made by others. |
10. Cookies, mobile tracking and permissions
Yuniqa uses storage that is strictly necessary for authentication, security, language, consent choices, service state and requested preferences. Non-essential audience measurement, analytics, advertising or session replay will not be read, written or transmitted until the required consent is obtained. Refusing must be as easy as accepting, and a persistent settings control must allow withdrawal at any time.
These rules cover cookies and similar technologies such as local storage, mobile file/device persistence, SDK identifiers and replay—not only browser cookies. Section 11 lists every one of them, with its provider, purpose, legal basis and lifetime.
Camera, photos, files, microphone, location and notifications are requested only when needed for a feature you choose. The operating-system permission can be changed in device settings. When you allow location, the app sends your position with your messages so that answers fit where you are, such as nearby places; a place search passes it to the map provider for that search only. Yuniqa keeps one thing from it: your last position, rounded to about one kilometre, so that later answers and the work of your agents fit where you are. It is replaced each time, never kept as a history of your movements, never stored with what you searched for, and deleted with your account. Granting an OS permission does not authorise unrelated analytics or replay.
11. Cookies and trackers in detail
The three categories
- Essential — sign-in, security, your display preferences and the record of your choice on this page. Always active; exempt from consent under Article 82 of the French Data Protection Act and Article 5(3) ePrivacy.
- Audience measurement — statistics on which pages and features are used, so we know what to improve. Consent required.
- Session replay — a masked recording of your navigation, used to reproduce bugs you report. Consent required, and it is off by default.
We use no advertising trackers, no ad network tags, no cross-site tracking and no data brokers, and we never sell any of this data.
Web trackers
| Tracker | Provider | Purpose | Category | Legal basis | Lifetime on your device |
|---|---|---|---|---|---|
| __session, __client_uat (cookies) | Clerk, Inc. (United States) | Keeps you signed in and protects the session | Essential | Strictly necessary for the service you asked for | Session; up to 1 year for __client_uat |
| cookie_consent_record (local storage) | Yuniqa OÜ | Remembers the choice you make here, with its date and version | Essential | Strictly necessary; also our proof of consent under Article 7(1) GDPR | 6 months, after which we ask again |
| theme (local storage) | Yuniqa OÜ | Remembers whether you chose the light or dark display | Essential | A preference you set yourself | Until you clear your browser storage |
| __cf_bm, cf_clearance (cookies) | Cloudflare, Inc. (United States) | Filters bots and protects the site against attacks | Essential | Strictly necessary for security | 30 minutes to 1 year |
| ph_<project>_posthog (cookie and local storage) | PostHog, Inc. — EU Cloud, Frankfurt | Audience measurement: pages viewed, features used, errors encountered | Audience measurement | Your consent | 12 months |
| PostHog session replay (session storage and recording) | PostHog, Inc. — EU Cloud, Frankfurt | Replays your navigation so a reported bug can be reproduced. Text and form inputs are masked | Session replay | Your consent | For the duration of the session |
If you refuse, nothing is written to or read from your browser by PostHog. Technical errors are then sent to our own servers only, without any identifier, without cookies, and reduced to the error type and the path of the page — never the content of your messages, files or forms.
Mobile app trackers
The mobile app works in three tiers. Crash and error reports are always on, because they are how we learn that the app is broken; they carry none of your content. Usage insights run from the start and are linked to your account; they never include what you write or read, and you can switch them off at any time. Masked screen replays are off until you say yes: the app asks once you have used it for a few days, with yes and no each one tap away. Both choices can be changed at any time in Settings, under Help improve Yuniqa.
| Tracker | Provider | Purpose | Category | Legal basis | Lifetime on your device |
|---|---|---|---|---|---|
| Clerk session token (secure device storage) | Clerk, Inc. (United States) | Keeps you signed in between launches | Essential | Strictly necessary for the service you asked for | Until you sign out |
| PostHog account-linked and session identifiers (app file storage) | PostHog, Inc. — EU Cloud, Frankfurt | Usage insights: which screens and features you use, linked to your account, to improve them and to help you faster when you contact us. Never what you write or read, never used for advertising, never shared across other apps or sites | Usage insights | Our legitimate interest in understanding and improving the app; you can object at any time in Settings, which unlinks your account and stops the events at once | Until you object, sign out or uninstall the app |
| PostHog session replay (mobile) | PostHog, Inc. — EU Cloud, Frankfurt | Replays of your sessions in the app, used to reproduce bugs and to see where the app gets in your way. Every text, input and image is masked, and mail bodies, the crew's live desktop and app previews are blacked out: the replay shows screens and gestures, never what you write or read | Session replay | Your consent | For the duration of the session |
| Pending crash or error report (app storage) | PostHog, Inc. — EU Cloud, Frankfurt | Holds a crash or error report until it can be sent. The report names the failing operation and the technical error, under the same identifier as your usage insights, or a random one if you switched those off | Essential diagnostics | Our legitimate interest in a stable and secure app; the report carries no content | Until it is sent, then deleted |
Accepting, refusing, or changing your mind
- On the web: the banner appears on your first visit, with Accept all and Refuse all each one click away, and a per-category choice behind Customise.
- At any later moment: use the Cookie settings link in the footer of any page. It reopens the same choices, and a withdrawal takes effect immediately, without reloading the page.
- In the mobile app: Settings, then Help improve Yuniqa. Each choice has its own switch and applies immediately.
- We ask again every six months, and whenever this inventory changes.
Refusing costs you nothing: every feature of Yuniqa works exactly the same way.
Your browser also lets you block or delete cookies for this site. Blocking the essential ones will sign you out and may break parts of the service.
Transfers, retention and contact
PostHog data is collected on PostHog's EU Cloud in Frankfurt. Where a provider is established in the United States, the transfer relies on its Data Privacy Framework certification with standard contractual clauses as a fallback; the details are in the Privacy Policy.
Questions about this policy, or a request to exercise your rights: privacy@yuniqa.ai. You can also lodge a complaint with the CNIL (France) or the Estonian Data Protection Inspectorate.
12. Security
Yuniqa uses technical and organisational measures proportionate to risk, including authentication and access controls, encryption in transit, provider and secret management, logging safeguards, backups, vulnerability management, incident response and processor review. No system is completely secure. Users should protect their device and account and report suspected unauthorised access promptly.
If a personal-data breach is likely to create a risk, Yuniqa will notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware. Affected people will be informed without undue delay where the breach is likely to create a high risk.
13. Your GDPR rights
- Access your personal data and receive information about its processing.
- Correct inaccurate or incomplete data.
- Request erasure, subject to lawful exceptions.
- Restrict processing in the cases provided by law.
- Receive data you supplied in a structured, commonly used and machine-readable format, and ask for transmission where technically feasible.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Withdraw consent at any time, without affecting processing already lawfully carried out.
- Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, subject to legal exceptions and safeguards.
- Complain to the data-protection supervisory authority responsible for your place of residence, place of work or the alleged infringement.
To receive a copy of your data (export), email support@yuniqa.ai. Send other privacy rights requests to privacy@yuniqa.ai. Yuniqa may ask for proportionate information to verify identity and will normally answer within one month. That period can be extended by two months for a complex or numerous request, with an explanation within the first month.
A disagreement about the service itself, such as a subscription, a payment or a refund, is a consumer dispute rather than a data-protection matter. Section 17 of the Terms of Service explains how to complain and how to refer it free of charge to the Estonian Consumer Disputes Committee.
14. Account deletion and legal retention
Account deletion must remove or de-identify account data across Yuniqa's active systems and instruct relevant processors, subject to data that must be retained for accounting, fraud prevention, disputes, legal claims or another documented obligation. Legally retained data is isolated and no longer used for ordinary product purposes.
Canceling a subscription stops future renewals under the applicable billing rules; deleting an account is a separate privacy action. Yuniqa may explain how to prevent future billing but will not categorically refuse a valid erasure request solely because a paid subscription is active.
15. Children
Yuniqa is intended only for people aged 18 or older. This threshold reflects the current scope and terms of enabled AI providers and the presence of finance, connected-account and public-sharing features. Yuniqa does not knowingly offer the service to children. Contact the privacy address if you believe a child has provided data.
16. Changes to this Policy
Yuniqa may update this Policy to reflect product, provider or legal changes. The date and version will be recorded. Material changes will be notified in advance through the service or by email where appropriate. If a new purpose requires consent, Yuniqa will ask before starting that processing. Previous versions will remain available or can be requested.
17. Contact
Write to privacy@yuniqa.ai for data-protection requests and to security@yuniqa.ai to report a vulnerability. By post: Yuniqa OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. Do not send passwords, authentication codes or unnecessary sensitive information by email.