Privacy Policy

Unitive is a social-media management and collaboration tool. This page describes what the software actually collects and where it sends it. It is written to be checkable against the product rather than to be broad enough to cover anything.

1. What we collect

Account data: your name, email address, and the organizations you belong to. Collected because there is no account without it.

Content you create: posts, drafts, media, documents, projects, messages, whiteboards and comments. We store it so the product can show it back to you and to the people you share a workspace with. We do not use it to train AI models.

Connected-account data: when you connect a social channel, we store the access tokens (encrypted) and the profile and metrics that network returns, so we can publish on your behalf and report back.

Technical data: IP address, browser and timestamps, in server logs and error reports. This is a by-product of running a website securely, not something we set out to gather.

Usage data: which pages and features get used. Only if you consent. See Cookies.

2. Why we are allowed to

Account data and your content: to perform our contract with you. Technical data and security logging: our legitimate interest in keeping the service up and not being attacked. Analytics: your consent, which you can withdraw at any time. Billing records: our legal obligation to keep them.

3. Cookies and local storage

We use two categories, and only two, because those are the only two anything in the product reads:

Necessary: your sign-in session, which workspace you have open, your sidebar and theme. Without these you cannot stay signed in. These cannot be switched off, and they are never used to track you across other sites.

Analytics: Vercel Web Analytics and PostHog, telling us which pages and features get used. Off unless you turn them on. PostHog runs on its European Union infrastructure and is proxied through our own domain, so your browser never contacts a third-party analytics host directly. Session recording is disabled.

We do not run advertising, we do not embed advertising pixels, and we do not sell or share personal data with data brokers. Cookie settings to change or withdraw your choice at any time. Withdrawing is exactly as easy as consenting, and takes effect immediately.

4. Who else sees your data

Only the processors below, each for the stated purpose, and the members of your own organization according to the permissions you give them.

Transfers outside the European Economic Area rely on the European Commission’s Standard Contractual Clauses, or on the EU–US Data Privacy Framework where the processor is certified under it.

5. Google and YouTube data

Unitive uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service and the Google Privacy Policy.

What we access. With the youtube.readonly permission: your channel’s name, avatar and subscriber count, and the status and links of the videos you uploaded through Unitive. With youtube.upload: uploading the videos you approve in Unitive to your channel. If you connect Google Drive, the drive.file permission reaches only the files you pick in the Drive picker, never your whole Drive. If you connect a Google Business Profile, the business.manage permission reaches the listings you choose to publish to.

What we do with it. Only provide those features: show your channel in Channels, publish the videos and posts you schedule, and report their status back to you. It is never sold and never used for advertising. Unitive’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI features. Data received from Google APIs is never used to develop, improve or train generalized AI or machine-learning models. Your YouTube channel details and video status, and your Google Business Profile, are never sent to an AI processor at all. A file you import from Google Drive is not sent either: what our AI processor (OpenAI, or Google’s embedding API) receives is its file name together with any alt text and tags you add, turned into a search embedding so My Files can be searched by meaning. If you ask the in-app agent what to attach to a post, it sees the names and links of the matching files, only to produce that answer. Separately, the agent can connect Gmail, Google Calendar and Google Drive through our connector provider, Composio, which asks for its own Google permissions; the agent then reads those apps when you ask it to, and for Gmail a scheduled job copies your recent messages into the agent’s memory so it can use them in later answers. Removing the app under Agent › Connections stops both.

Revoking access. Disconnect the channel in Unitive under Publish › Channels › Disconnect (Google Drive: under its own settings), or revoke Unitive at myaccount.google.com/permissions. On disconnect we delete the stored access and refresh tokens at once, and the data we held from that connection is removed within 30 days.

6. Meta (Facebook and Instagram) data

What we access. When you connect a Facebook Page (and the Instagram professional account linked to it) through Facebook Login, Meta gives us the Page’s name, id and picture, the linked Instagram account’s id, username and picture, and a Page access token, which we store encrypted. The permissions we ask for are public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, business_management (to list Pages owned by a business portfolio), instagram_basic and instagram_content_publish.

What we do with it. Publish the posts, reels and stories you schedule to that Page or account, post the first comment you write, and read back each post’s id, link and basic engagement (reach, impressions, reactions) to show its status in Unitive. Nothing else: it is not sold, not used for advertising, and not shared with anyone outside your organization.

Deleting it. Disconnect the channel under Publish › Channels › Disconnect, which deletes the stored tokens at once. Removing Unitive from your Facebook account’s Business Integrations settings tells us too, and we delete the stored connection and its unpublished posts. To have everything we hold about your Page or Instagram account deleted, use our data deletion page at unitive.app/data-deletion (the data deletion URL registered with Meta); we complete deletion within 30 days.

7. How long we keep it

Your content stays until you delete it or close your workspace. After a workspace is deleted we remove its data within 30 days, except billing records, which tax law requires us to keep for longer. Server logs are kept by Vercel for the short period its hosting plan sets, then deleted by Vercel. Analytics events are retained by PostHog for 12 months.

8. Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and take it elsewhere in a portable form. Deleting an account is self-service (see data deletion), or ask us and we will do it. We answer within 30 days, and there is no charge. If you think we have handled your data badly you can complain to your national data protection authority.

9. Security

Data is encrypted in transit and at rest. Social access tokens are encrypted with a separate key. Access between organizations is enforced in the database itself, not only in the application. Administrative access to customer data is restricted and every such action is recorded in an audit log.

10. Children

Unitive is a business tool and is not directed at anyone under 16. We do not knowingly collect their data.

11. Changes

If we change what we collect or who we send it to, we update this page and its date, and re-ask for consent where consent is what allows it.

Contact

Questions, or a request about your data: contact us.