Privacy policy

1. Who we are

Unireply is an email assistant built in Portugal by Unireply (being incorporated) (“Unireply”, “we”). For any question about your data, write to [email protected].

This policy explains what personal data we process when you visit unireply.com or use Unireply, what for, who we share it with, how long we keep it and how you can exercise your rights.

2. Our role

We are the controller of your account data, website usage data and the service emails we send you.

We are a processor of the data that client organizations (for example universities and public bodies) put into Unireply: documents, received emails and the replies sent, and emails they ask a draft reply for. For that data the organization is the controller and decides how it is used. We process it only on its instructions and under a data processing agreement (GDPR article 28).

3. What data we process

We only process the data we need:

• Account: name, email, username (optional), profile photo (optional) and the organizations and roles you belong to.
• Sign-in: a password (stored only as a hash, never as text) or the link to a Google, GitHub or X account. In that case we receive your name, email and photo from that service.
• Sessions and security: IP address, browser and sign-in dates.
• Organization content: uploaded documents, received emails and the replies sent (Q&A pairs) and email assistant settings. They can contain personal data of people who wrote to the organization.
• Emails you ask a draft reply for, and the drafts: the subject and text of the email (in the browser extension, the whole conversation open in Gmail or Outlook), the draft, the model’s explanation, who asked for it and when. They are stored so the organization can see how the email assistant is used and how drafts compare with what was sent.
• Replies sent from the browser extension: when you send a draft from Gmail or Outlook, the text you sent. It is stored with the email as a new Q&A pair of the organization, and used to estimate the time saved.
• Browser extension errors: when the extension fails in Gmail or Outlook, it sends us what it was doing, the error, the page address, the extension and browser versions and a copy of the page’s HTML. That copy holds whatever was on the screen, including emails; it is deleted after 30 days.
• Contacts: whatever you write to us by email.

4. What we use data for, and on what basis

Each purpose has a legal basis under GDPR article 6:

• Providing the service to your organization (knowledge base, draft replies): performance of the contract with the organization; for content, we act on its instructions.
• Managing your account and access: performance of a contract and your organization’s legitimate interest in giving its staff access.
• Protecting the service (sessions, technical logs, abuse prevention): legitimate interest.
• Sending service emails (sign-in codes, invitations, role change notices): performance of a contract.
• Meeting legal obligations (for example tax): legal obligation.

5. Artificial intelligence and human review

The email assistant uses language models to suggest draft replies from the organization’s documents and Q&A pairs. This is how it works:

• Personal data masked: before any request to an external model, our server replaces names, emails, phone numbers and ID numbers with placeholders, and puts them back into the draft on our server. Names already found in the organization’s other texts are masked too. Detection is automatic and may not catch everything.
• Exception: scanned pages and uploaded images are sent unmasked to Google Vertex AI, in the EU, so their text can be read.
• Models in the EU: requests go through OpenRouter’s EU endpoint and are only routed to providers that process data in the EU.
• No retention: model providers don’t keep requests or responses and don’t use them for training.
• A person always decides: Unireply only suggests text. A person at the organization reads every draft and decides what to send. Unireply doesn’t send emails or make decisions about people.

We don’t use your data, or organizations’ data, to train AI models.

6. Who we share data with

We use these providers, each under a data processing agreement:

• OVH (France): the server hosting the database and the application, in Gravelines, France.
• Cloudflare (US): storage of uploaded files and profile photos (Cloudflare R2), in data centers in Western Europe. This is Cloudflare’s Western Europe location, not its EU jurisdiction option, so staying in the EU is not contractually guaranteed.
• Cloudflare (US): protecting and delivering the site. All traffic passes through Cloudflare’s network, usually through the data center closest to you.
• OpenRouter (US): routes requests to AI models through its EU endpoint, where requests and responses are processed. Our OpenRouter account data (usage and billing) stays in the US.
• AI model providers, all processing in the EU: Google (Vertex AI) for draft replies, for searching documents and to read scanned pages and uploaded images; Microsoft (Azure) for document summaries and tag suggestions.
• Resend, Inc. (US): sending service emails. Sending data (address, subject and content of the email) is processed and stored in the US, under standard contractual clauses.
• GitHub (US): hosts our code and runs the automatic deploys and a daily check of the server, which copies the latest lines of its technical logs (section 8).

We don’t sell personal data. We only disclose it to authorities when the law requires it.

7. Transfers outside the EU

Organizations’ database is stored in the EU (France), their files in Western Europe, and AI models process their data in the EU. Some providers (Cloudflare, OpenRouter, Google, Microsoft, Resend and GitHub) are US companies. Service emails, the copies of technical logs and our OpenRouter account data are processed in the US.

In those cases the transfer is covered by the EU-US Data Privacy Framework, when the provider is certified, or by standard contractual clauses approved by the European Commission. You can ask for a copy of these safeguards at [email protected].

8. How long we keep data

• Emails you ask a draft reply for, and the drafts: while the organization uses Unireply. They are deleted when the organization is deleted, or earlier at its request.
• Documents and Q&A pairs: until the organization deletes them or the contract ends. When a document is deleted, its file, its text and the chunks used for search are deleted right away; its title and tags stay in the organization’s history. A deleted Q&A pair stops being used right away; its text is kept so a deletion can be undone, and erased when the organization asks or the contract ends.
• Browser extension errors: the copy of the page is deleted 30 days after the error; the rest of the report (error, page address, versions) is kept to follow up the fix.
• Account: until you delete it (in Account) or your organization stops using Unireply.
• Sessions: expire after 30 days without use.
• Technical logs: the web server’s logs (IP address, page requested, date) are kept for 14 days. The application’s logs are kept until the next update of the service; a daily check copies their latest lines to GitHub, where they are kept for up to 90 days.
• Backups: the database is copied by hand before maintenance work, onto the computer of the person doing it, in Portugal. There is no fixed period yet: copies are deleted by hand.

9. Security

• Every connection is encrypted (HTTPS).
• Database hosted in the EU (France); files in Western Europe.
• Personal data masked before every request to an external AI model.
• Each organization only sees its own data.
• Files can only be opened through temporary links, created after checking that you belong to the organization.
• Passwords are stored only as a hash.

10. Your rights

Under the GDPR you have the right to:

• Access: know what data we process and get a copy.
• Rectification: correct wrong or incomplete data. You can change your name, email and photo in Account.
• Erasure: ask us to delete your data. You can delete your account in Account.
• Restriction: ask us to pause processing in certain cases.
• Portability: receive the data you gave us in a commonly used format.
• Objection: object to processing based on legitimate interest.

To exercise any right, write to [email protected]. We answer within one month, which can be extended by two more months for complex requests; if so, we let you know.

If you wrote to an organization that uses Unireply and want to exercise your rights over that email, contact that organization: it is the controller. If you contact us directly, we forward the request to the organization.

11. Complaints

You can lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD) at www.cnpd.pt, or with the supervisory authority of the country where you live or work.

12. Cookies on the website

We use these cookies and similar technologies:

• Session (necessary): keep you signed in and remember your last sign-in method. The app can’t be used without them.
• Language (necessary): the NEXT_LOCALE cookie stores the language you picked, for one year.
• Video on the home page: it only loads from YouTube (Google), in its privacy-enhanced mode, when you press play.

We don’t use analytics or advertising cookies, so the website doesn’t ask for your consent.

13. Changes to this policy

When we change this policy we update the date at the top. If the change is significant, we email users who have an account.

14. Contact

For any question about this policy or your data, write to [email protected].