Privacy Policy

Last updated: 10 October 2026

How Yuniqa handles your personal data.

1. Who is responsible for your data?

The controller of your personal data is Yuniqa OÜ, an Estonian private limited company (registry code 17568749), Sepapaja tn 6, 15551 Tallinn, Estonia. It decides why and how Yuniqa processes your data. For data-protection requests, write to privacy@yuniqa.ai.

Some providers act as processors on Yuniqa's instructions; they are listed in section 7. Third-party services you choose to connect, such as your email account, are independent controllers for their own processing.

2. Scope and important points

This Policy applies to Yuniqa's website, web application, mobile applications, AI assistant, mini-apps, connected services, public or shared content, support, subscriptions and related services offered to individuals. A business customer may receive separate terms and a data processing agreement.

  • You are interacting with an artificial-intelligence system when you use Yuniqa's assistant, agents, generation tools or automated features.
  • Prompts, files and relevant context may be sent to the AI provider selected by you or routed by Yuniqa to deliver the requested feature.
  • Do not enter another person's confidential or sensitive data unless you are authorised to do so and the feature is appropriate for it.
  • Some optional Yuniqa AI features work out daily calorie targets on your device: the height, weight, age and sex you type for that are never sent to or stored by Yuniqa.
  • Content can be private, shared with named people, or public. Yuniqa will identify the visibility choice before publication or sharing.

3. Data we collect

CategoryExamples
Account and identityClerk user identifier, email address, name, profile, authentication state, language, timezone, currency, settings and consent or legal-acceptance records.
Conversations and AI contentPrompts, messages, generated answers, system instructions, model choice, feedback, tool calls, search queries, conversation titles, files, images, audio, transcripts and generated applications.
Memory and personalisationFacts or preferences saved or inferred from conversations, user instructions, custom assistants, reminders, routines, notification settings and feature configuration.
Connected services and emailConnected-account identifiers, authorisation status, email content and metadata, attachments, contacts or recipients, webhook events, trigger instructions, scheduled actions, tool approvals and execution results.
Meals and daily targetsYour daily calorie, macro and water targets, your goal, dietary preferences, liked and disliked foods, and the meals, scans and water you log. The height, weight, age and sex used to work out the targets stay on your device and are not collected.
Finance and productivityBudgets, transactions, merchants, wallets, income, spending, recurring subscriptions, savings goals, notes, tasks, CVs, job preferences and documents.
Location and device permissionsPrecise or approximate coordinates, accuracy, related queries, microphone/audio, camera, photo library, files, notifications and push token when you enable the relevant feature.
Shared and public contentNotes and task lists you share with named people, agents you make public, apps you publish, and the content associated with them.
Subscription and transaction dataPlan, status, customer and subscription identifiers, billing email, renewal/cancellation dates, transaction status, payment provider and limited card descriptors such as brand and last four digits. Yuniqa does not need to receive full card details.
Technical, security and analyticsIP address, device and browser information, operating system, app version, diagnostics, logs, security events, feature interactions, network telemetry, crash data, analytics identifiers and, only where lawfully enabled, session replay.
Support and communicationsSupport requests, correspondence, survey responses, complaints, privacy requests and information needed to verify and answer them.

Data usually comes from you, your device, your use of Yuniqa, an account you connect at your request, a payment or app-store provider, another user who shares with you, or a service provider helping operate Yuniqa.

4. Why we process data and our legal bases

PurposeMain dataLegal basis
Create and secure your account; provide conversations, storage, requested models and product featuresIdentity, settings, content, files, device and service eventsPerformance of the contract
Connect third-party accounts and execute actions you requestConnection identifiers, authorised scopes, instructions, content and resultsPerformance of the contract; your instruction to connect the service
Provide some optional Yuniqa AI featuresDaily targets, food preferences and meal logsPerformance of the requested feature
Provide personalisation and persistent memoryConversation-derived facts, preferences, history and configurationPerformance of the contract for user-requested settings; consent where the feature is optional and the law requires it
Process subscriptions, credits, refunds, invoices and accountingIdentity, plan, transaction and limited payment metadataPerformance of the contract and legal obligations
Keep the service safe, prevent fraud and enforce rulesAccount, technical, content and security events strictly necessary for investigationLegitimate interests in service security and legal claims; legal obligations where applicable
Answer support, complaints and privacy-rights requestsContact, account, request and relevant service dataContract, legal obligations and legitimate interests in resolving disputes
Trace and debug AI requests and answers to improve the serviceRequests sent to the AI models we use (your messages and their context) and the answers, with errors, response times, the model used and costs (kept 30 days)Our legitimate interest in a service that works well
Measure and improve Yuniqa using non-essential analytics or replayIdentifiers, interactions, diagnostics and replay dataConsent where required by applicable tracking and device-access rules
Send optional product news or marketingEmail, language and communication preferencesConsent, with an unsubscribe option in every message
Establish, exercise or defend legal claims and comply with binding requestsData relevant to the claim or requestLegal obligation or legitimate interests in legal defence

Where Yuniqa relies on legitimate interests, it must first assess necessity and the effect on your rights. You may object for reasons relating to your situation. Yuniqa does not rely on consent where the processing is genuinely necessary to perform the service you requested.

5. AI providers, memory and automated features

Yuniqa does not build or run AI models itself. When you use an AI feature, Yuniqa passes your request to a third-party AI provider, either directly or through OpenRouter, a routing service that forwards it to a provider of the model in use. Yuniqa only routes requests to providers that do not use your content to train their models, and Yuniqa does not train AI models on your content either. OpenRouter and the provider that answers process the prompts, files, conversation context and responses needed to produce the answer. Some providers keep this content for a limited time under their own policies, for example for security, abuse prevention, service reliability or legal compliance; how long depends on the provider and the purpose.

Memory features can store or infer durable facts and preferences from conversations to personalise later answers. Yuniqa must provide controls to review, edit, disable and erase these memories. Agent and automation features can act on connected accounts, including after a trigger or schedule; the interface will show the relevant service, requested scope, approval state and result.

Yuniqa does not intend to make decisions producing legal or similarly significant effects about you solely through automated processing. If that changes, Yuniqa will provide the information and safeguards required by Articles 13, 14 and 22 GDPR before the processing begins.

6. Sensitive data and sharing controls

Yuniqa does not ask for health data. When some optional Yuniqa AI features log your meals, Yuniqa keeps only the daily targets you accept, your goal, your food preferences and what you log; the body measurements used to work out the targets are processed on your device only. If you choose to write health information in a conversation, a note or a meal description, it is handled like the rest of that content. You can delete any logged meal at any time, and all of it is deleted when you close your account.

  • Accepting the Terms is never consent to process health data.
  • Finance, email, precise location and uploaded documents are highly personal even when they are not special-category data under Article 9 GDPR.
  • Yuniqa is not a medical device or healthcare professional and does not provide diagnosis or treatment.

7. Who receives data

Recipient categoryPurpose and examples
Hosting, database and content deliveryCloudflare provides application data, files, execution, network and security infrastructure.
AuthenticationClerk provides sign-in, account identity and session management.
AI and search providersOpenAI, Anthropic, Google, xAI, Mistral, OpenRouter and selected downstream providers process the content needed for the chosen model or feature; search/map providers process the relevant query and context.
Connected-service infrastructureComposio and the service you connect process authorisation, actions, triggers and returned content.
Payments and app storesSuperwall, Apple and other applicable stores process purchases, subscriptions, refunds and fraud checks. When you ask Apple for a refund, Apple may ask us how much of the subscription was used, and we may answer through Superwall so that Apple can decide.
Analytics and supportWe use PostHog (EU, Frankfurt) to trace and debug the requests sent to the AI models we use and their answers, so we can improve our service. This data is kept for 30 days. How PostHog measures use of the app and website is explained in section 11. Support requests are answered by email.
Communications and notificationsResend, Apple, Google, Expo or applicable delivery providers transmit email and push notifications.
Professional advisers and authoritiesAuditors, legal advisers, insurers, courts or authorities receive only data justified by a legal duty, request or claim.
Other users and the publicRecipients you select can access shared content; anyone may access content you deliberately publish. Visibility will be indicated before sharing.

Yuniqa remains responsible for selecting and supervising the processors it uses to provide the service.

The companies behind these categories are named on the sub-processors page, with what each one does, where it is, the safeguard for data leaving the European Economic Area and a link to its own privacy policy. We keep that page up to date when a company is added, replaced or removed.

8. International transfers

Some of the companies that receive data are outside the European Economic Area, mostly in the United States. Each transfer has a safeguard recognised by the GDPR: the EU–US Data Privacy Framework when the company takes part in it, otherwise the European Commission's standard contractual clauses in its data processing agreement. The sub-processors page lists each company with its country and its safeguard; to get a copy of a safeguard, write to privacy@yuniqa.ai.

9. How long we keep data

Yuniqa keeps personal data only for the purpose described, then deletes or irreversibly anonymises it unless a law or legal claim requires restricted retention.

DataHow long
Account, conversations, memory and user-created contentWhile the account or item remains active, then deletion at the user's request or account closure, subject to a documented backup deletion period and legal exceptions.
Meals and daily targets, finance, location and connected-service contentUntil the user deletes the item, disconnects/withdraws where applicable, or closes the account; shorter feature-specific limits must be configured where the data is no longer needed.
Provider-side prompts, files, cache and outputAI providers never train on your content. OpenRouter keeps requests and answers for at least 3 months in a private log used only for Yuniqa's debugging. OpenAI and Anthropic keep requests for up to 30 days for abuse monitoring, longer only for content flagged as harmful (up to 2 years at Anthropic); OpenAI keeps no voice recordings it transcribes. Google keeps requests, voice included, for up to 55 days. Composio keeps the content of connected-app actions and incoming events for up to one year.
Traces of AI requests and answers in PostHog30 days
Usage analytics, error reports and screen recordings in PostHogUsage events and error reports are deleted with your account, and PostHog never keeps them longer than 7 years. Screen recordings, if you agreed to them: 30 days.
Data held by other service providersResend keeps the emails it sends for 30 days. Expo does not store notification text after delivery. Sail keeps a crew desktop's files and browser sessions until the desktop is deleted, at the latest with your account. Clerk, Superwall and web search providers keep data under their own policies, only as long as they need to provide their service.
Security logsServer logs at Cloudflare: 7 days. Only Yuniqa's administrator can read them.
Consent and legal-acceptance proofFor the duration needed to demonstrate the choice and defend related claims; a withdrawn choice remains recorded as proof, not as permission for new processing.
Invoices and mandatory accounting recordsFor the period required by applicable accounting, tax and record-keeping law.
Support and disputesFor handling the request, then the applicable limitation period where needed for legal claims.
Cookie/mobile tracker choiceNormally six months before requesting the choice again, unless a shorter period or material change requires renewal.
BackupsEncrypted backups are overwritten within 30 days and are used only to repair an incident, never for ordinary use. A scrambled marker of a deleted account is kept for 90 days so that a restored backup deletes it again.
Public contentUntil unpublished/deleted or the account closes, subject to legal retention and copies independently made by others.

10. Cookies, mobile tracking and permissions

Yuniqa uses storage that is strictly necessary for authentication, security, language, consent choices, service state and requested preferences. Non-essential audience measurement, analytics, advertising or session replay will not be read, written or transmitted until the required consent is obtained. Refusing must be as easy as accepting, and a persistent settings control must allow withdrawal at any time.

These rules cover cookies and similar technologies such as local storage, mobile file/device persistence, SDK identifiers and replay—not only browser cookies. Section 11 lists every one of them, with its provider, purpose, legal basis and lifetime.

Camera, photos, files, microphone, location and notifications are requested only when needed for a feature you choose. The operating-system permission can be changed in device settings. When you allow location, the app sends your position with your messages so that answers fit where you are, such as nearby places; a place search passes it to the map provider for that search only. Yuniqa keeps one thing from it: your last position, rounded to about one kilometre, so that later answers and the work of your agents fit where you are. It is replaced each time, never kept as a history of your movements, never stored with what you searched for, and deleted with your account. Granting an OS permission does not authorise unrelated analytics or replay.

11. Cookies and trackers in detail

The three categories

  • Essential — sign-in, security, your display preferences and the record of your choice on this page. Always active; exempt from consent under Article 82 of the French Data Protection Act and Article 5(3) ePrivacy.
  • Audience measurement — statistics on which pages and features are used, so we know what to improve. Consent required.
  • Session replay — a masked recording of your navigation, used to reproduce bugs you report. Consent required, and it is off by default.

We use no advertising trackers, no ad network tags, no cross-site tracking and no data brokers, and we never sell any of this data.

Web trackers

TrackerProviderPurposeCategoryLegal basisLifetime on your device
__session, __client_uat (cookies)Clerk, Inc. (United States)Keeps you signed in and protects the sessionEssentialStrictly necessary for the service you asked forSession; up to 1 year for __client_uat
cookie_consent_record (local storage)Yuniqa OÜRemembers the choice you make here, with its date and versionEssentialStrictly necessary; also our proof of consent under Article 7(1) GDPR6 months, after which we ask again
theme (local storage)Yuniqa OÜRemembers whether you chose the light or dark displayEssentialA preference you set yourselfUntil you clear your browser storage
__cf_bm, cf_clearance (cookies)Cloudflare, Inc. (United States)Filters bots and protects the site against attacksEssentialStrictly necessary for security30 minutes to 1 year
ph_<project>_posthog (cookie and local storage)PostHog, Inc. — EU Cloud, FrankfurtAudience measurement: pages viewed, features used, errors encounteredAudience measurementYour consent12 months
PostHog session replay (session storage and recording)PostHog, Inc. — EU Cloud, FrankfurtReplays your navigation so a reported bug can be reproduced. Text and form inputs are maskedSession replayYour consentFor the duration of the session

If you refuse, nothing is written to or read from your browser by PostHog. Technical errors are then sent to our own servers only, without any identifier, without cookies, and reduced to the error type and the path of the page — never the content of your messages, files or forms.

Mobile app trackers

The mobile app works in three tiers. Crash and error reports are always on, because they are how we learn that the app is broken; they carry none of your content. Usage insights run from the start and are linked to your account; they never include what you write or read, and you can switch them off at any time. Masked screen replays are off until you say yes: the app asks once you have used it for a few days, with yes and no each one tap away. Both choices can be changed at any time in Settings, under Help improve Yuniqa.

TrackerProviderPurposeCategoryLegal basisLifetime on your device
Clerk session token (secure device storage)Clerk, Inc. (United States)Keeps you signed in between launchesEssentialStrictly necessary for the service you asked forUntil you sign out
PostHog account-linked and session identifiers (app file storage)PostHog, Inc. — EU Cloud, FrankfurtUsage insights: which screens and features you use, linked to your account, to improve them and to help you faster when you contact us. Never what you write or read, never used for advertising, never shared across other apps or sitesUsage insightsOur legitimate interest in understanding and improving the app; you can object at any time in Settings, which unlinks your account and stops the events at onceUntil you object, sign out or uninstall the app
PostHog session replay (mobile)PostHog, Inc. — EU Cloud, FrankfurtReplays of your sessions in the app, used to reproduce bugs and to see where the app gets in your way. Every text, input and image is masked, and mail bodies, the crew's live desktop and app previews are blacked out: the replay shows screens and gestures, never what you write or readSession replayYour consentFor the duration of the session
Pending crash or error report (app storage)PostHog, Inc. — EU Cloud, FrankfurtHolds a crash or error report until it can be sent. The report names the failing operation and the technical error, under the same identifier as your usage insights, or a random one if you switched those offEssential diagnosticsOur legitimate interest in a stable and secure app; the report carries no contentUntil it is sent, then deleted

Accepting, refusing, or changing your mind

  • On the web: the banner appears on your first visit, with Accept all and Refuse all each one click away, and a per-category choice behind Customise.
  • At any later moment: use the Cookie settings link in the footer of any page. It reopens the same choices, and a withdrawal takes effect immediately, without reloading the page.
  • In the mobile app: Settings, then Help improve Yuniqa. Each choice has its own switch and applies immediately.
  • We ask again every six months, and whenever this inventory changes.

Refusing costs you nothing: every feature of Yuniqa works exactly the same way.

Your browser also lets you block or delete cookies for this site. Blocking the essential ones will sign you out and may break parts of the service.

Transfers, retention and contact

PostHog data is collected on PostHog's EU Cloud in Frankfurt. Where a provider is established in the United States, the transfer relies on its Data Privacy Framework certification with standard contractual clauses as a fallback; the details are in the Privacy Policy.

Questions about this policy, or a request to exercise your rights: privacy@yuniqa.ai. You can also lodge a complaint with the CNIL (France) or the Estonian Data Protection Inspectorate.

12. Security

Yuniqa uses technical and organisational measures proportionate to risk, including authentication and access controls, encryption in transit, provider and secret management, logging safeguards, backups, vulnerability management, incident response and processor review. No system is completely secure. Users should protect their device and account and report suspected unauthorised access promptly.

If a personal-data breach is likely to create a risk, Yuniqa will notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware. Affected people will be informed without undue delay where the breach is likely to create a high risk.

13. Your GDPR rights

  • Access your personal data and receive information about its processing.
  • Correct inaccurate or incomplete data.
  • Request erasure, subject to lawful exceptions.
  • Restrict processing in the cases provided by law.
  • Receive data you supplied in a structured, commonly used and machine-readable format, and ask for transmission where technically feasible.
  • Object to processing based on legitimate interests and object at any time to direct marketing.
  • Withdraw consent at any time, without affecting processing already lawfully carried out.
  • Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, subject to legal exceptions and safeguards.
  • Complain to the data-protection supervisory authority responsible for your place of residence, place of work or the alleged infringement.

To receive a copy of your data (export), email support@yuniqa.ai. Send other privacy rights requests to privacy@yuniqa.ai. Yuniqa may ask for proportionate information to verify identity and will normally answer within one month. That period can be extended by two months for a complex or numerous request, with an explanation within the first month.

A disagreement about the service itself, such as a subscription, a payment or a refund, is a consumer dispute rather than a data-protection matter. Section 17 of the Terms of Service explains how to complain and how to refer it free of charge to the Estonian Consumer Disputes Committee.

14. Account deletion and legal retention

Account deletion must remove or de-identify account data across Yuniqa's active systems and instruct relevant processors, subject to data that must be retained for accounting, fraud prevention, disputes, legal claims or another documented obligation. Legally retained data is isolated and no longer used for ordinary product purposes.

Canceling a subscription stops future renewals under the applicable billing rules; deleting an account is a separate privacy action. Yuniqa may explain how to prevent future billing but will not categorically refuse a valid erasure request solely because a paid subscription is active.

15. Children

Yuniqa is intended only for people aged 18 or older. This threshold reflects the current scope and terms of enabled AI providers and the presence of finance, connected-account and public-sharing features. Yuniqa does not knowingly offer the service to children. Contact the privacy address if you believe a child has provided data.

16. Changes to this Policy

Yuniqa may update this Policy to reflect product, provider or legal changes. The date and version will be recorded. Material changes will be notified in advance through the service or by email where appropriate. If a new purpose requires consent, Yuniqa will ask before starting that processing. Previous versions will remain available or can be requested.

17. Contact

Write to privacy@yuniqa.ai for data-protection requests and to security@yuniqa.ai to report a vulnerability. By post: Yuniqa OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia. Do not send passwords, authentication codes or unnecessary sensitive information by email.