Privacy policy
Who we are
unbreach.io is operated by [Company legal name], a [legal form] registered under number [registration number], with its registered office at [registered address]. We are the data controller for the personal data described in this policy.
When you send content to our API, you decide what that content contains. For that content, we act as a processor on your behalf, under the data processing terms in our terms of service.
Zero data retention
unbreach is zero data retention by default, for every plan and every API key. The content you send (prompts, messages, uploaded files and log exports) and the responses our models return are processed in memory and discarded as soon as the response is delivered. They are never written to disk, never included in logs, never reviewed by staff and never used for training.
Abuse prevention runs in real time on content while it is in memory. Only the result of that check and the usage metadata listed below are kept.
In the unbreach app, your conversation history is stored on your own device, not on our servers. Clearing it in the app deletes it for good.
Data we collect
- Sign-up data. The email you enter and the plan you choose.
- Account and billing data. Name, company, billing address and payment details, handled by our payment provider [payment provider]. We never see your full card number.
- Content you send. Prompts, messages and files, and the responses our models return. Processed in memory only and never stored (see zero data retention above).
- Subscription data. Your plan, renewal dates and usage, used to apply your plan’s limits and bill you.
- Usage data. Token counts, timestamps, model used, API key identifier and IP address, used for billing, rate limiting and security.
- Website analytics. Only if you accept analytics: anonymous, aggregated page views and the sign-up event, measured with Plausible Analytics without cookies.
Why we use it
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Create your account and send your API key | Sign-up and account data | Contract |
| Run the API and the app, and return responses | Content you send (in memory only), usage data | Contract |
| Apply your plan’s usage limits | Subscription and usage data | Contract |
| Billing and accounting | Billing and usage data | Contract, legal obligation |
| Prevent abuse and keep the service secure | Content checked in memory, usage data | Legitimate interest |
| Understand which pages are useful | Website analytics | Consent |
We never store your content, and never use it to train or improve our models.
Who we share it with
We do not sell personal data. We share it only with providers that help us run the service, under written agreements:
- Hosting and model infrastructure, in data centers located in the European Union.
- [Form provider, e.g. Formspree], to receive API key requests.
- [Payment provider], to process payments.
- Plausible Analytics (EU-hosted), only if you accept analytics.
If a provider processes data outside the European Economic Area, we rely on an adequacy decision or the European Commission’s standard contractual clauses.
How long we keep it
- Prompts, messages, files and responses: not retained. Discarded as soon as the response is delivered.
- App conversation history: on your device only, until you clear it.
- Usage data: [24 months], for billing disputes and security.
- Account data: as long as your account is open, then [3 years] after closure.
- Billing records: [10 years], as required by accounting law in [country].
- Sign-up requests that never became an account: [12 months].
Your rights
You can ask to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent at any time. Write to [email protected]; we answer within one month.
You can also complain to your data protection authority, for example the CNIL in France.
Cookies and local storage
This website does not set advertising or tracking cookies. It stores your analytics choice in your browser’s local storage, and remembers for the current session only that you have already seen the intro animation. Analytics only loads after you click Accept, and you can change your mind at any time from the .
Security
Data is encrypted in transit and at rest. Access is limited to staff who need it, and every access to API content is logged.
Changes to this policy
If we make a material change, we will email account holders at least 30 days before it takes effect. The date at the top of this page shows the latest version.
Contact
[Company legal name], [registered address]. Email: [email protected].