Legal

Privacy Notice

Last updated: July 2026

This Privacy Notice explains how unlockedai ("we", "us", "our") collects and uses personal data when you use the Unlocked AI service. unlockedai is the data controller for the personal data described here.

1. Data we collect

• Account data — email, password hash, and any name or avatar you set.
• Content — the prompts you send, the projects and pages you build, and the memory notes you save to a project.
• Usage & telemetry — approximate token counts, build durations, error events, and feature usage, used to keep the Service running and to improve it.
• Device & network — IP address, browser type, operating system, and referring page, from standard server logs.
• Support messages — anything you send us by email or in-app.
• Payment data — handled directly by Paddle (see "Sharing" below). We receive a subscription status and customer identifier, not full card details.

2. Why we use it

• Provide and operate the Service (contract).
• Authenticate you and secure your account (contract, legitimate interest).
• Prevent fraud, abuse, and security incidents (legitimate interest, legal obligation).
• Bill you and manage your subscription (contract, legal obligation).
• Improve the product, debug problems, and understand usage (legitimate interest).
• Respond to support requests (contract, legitimate interest).
• Send occasional service updates by email (legitimate interest, or consent where required).

3. AI model providers

When you send a prompt, it is transmitted to our AI gateway and to the underlying model provider to generate a response. Prompts and responses may be logged briefly for reliability and abuse-prevention purposes. Do not send personal data, credentials, or confidential information you would not paste into a third-party AI service.

4. Sharing

• Paddle — Merchant of Record for all payments. Paddle handles checkout, invoicing, tax, subscription management, and refund processing.
• Infrastructure & subprocessors — hosting, database, edge functions, error monitoring, and email delivery vendors that we use to run the Service.
• Professional advisers — legal, tax, and accounting advisers under confidentiality.
• Authorities — where required by law, or to protect rights, safety, or property.

We do not sell your personal data.

5. International transfers

Our subprocessors may process personal data outside the country you are in, including in the United States. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

6. Retention

We keep account and content data for as long as your account exists. When you delete your account, we delete or anonymise the data within a reasonable period, except where we must keep records for legal, tax, or fraud-prevention purposes.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to our processing of your personal data, and to withdraw consent. In the UK/EEA you also have the right to complain to your local data protection authority. To exercise any of these rights, email privacy@unlockedai.dev. We aim to respond within one month.

8. Security

We use encryption in transit, hashed passwords, row-level security in the database, and least-privilege service credentials. No system is perfectly secure — please use a strong, unique password and enable multi-factor authentication where available.

9. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember your preferences. We do not run third-party advertising cookies.

10. Contact

Questions? Email privacy@unlockedai.dev.