Privacy

Unibox Chat (“Unibox”, “we”) is a business based in Vancouver, British Columbia, Canada, and it provides a shared inbox that brings your team’s WhatsApp conversations into one place, with a sales pipeline attached. Because we are in Canada, your data is handled under Canadian privacy law as well as the laws of your own country — see section 7. Which privacy role we play depends on the data, and the distinction matters:

For your account data — your name, email address, workspace, plan and billing status — we are the controller. We decide what to collect and why.

For the contents of your connected WhatsApp numbers — the messages and contacts we sync on your behalf — we are a processor. Your organisation is the controller. We act on your instructions, and we do not decide what those conversations are used for.

This matters in practice: if someone who messaged your company wants their data deleted, that request goes to you, not to us. We will help you carry it out, but we cannot act on your customers’ data without your instruction.

On behalf of your workspace:

• Messages from the WhatsApp numbers you connect — sender, recipient, body, timestamp and thread identifiers.
• Contacts derived from those conversations — name, company, phone number, and any details your team adds.
• Your sales records — pipeline stage, labels, notes, snooze reminders and contact cadence.
• Connection credentials — the session data needed to keep a WhatsApp number connected. See section 5.
• AI agent settings, if your workspace has the add-on — the instructions and knowledge your team writes, the drafts the agent proposes, your ratings and corrections, and how many replies it has used.

About the people on your team: name, email address, role and workspace.

We do not store payment card details. Payments run through Stripe’s hosted pages, and card numbers never reach our servers.

To provide the service — displaying, searching, organising and sending your conversations. This is the performance of our contract with you. Without this data there is no product.

To keep accounts secure and working — confirmation and password-reset emails, detecting a WhatsApp number that has disconnected, diagnosing sync failures. This is our legitimate interest in running a reliable service.

To bill you — plan, seat count and connected-account count. A legal and contractual obligation.

We do not use your messages for advertising, profiling, resale, or to train machine learning models — ours or anyone else’s.

We use a small number of sub-processors. Each one is contractually limited to processing data on our instructions.

Your WhatsApp connection runs on a gateway we host ourselves, so WhatsApp message content is not handed to a third-party WhatsApp vendor.

The AI agent is optional. Nothing is sent to Anthropic unless your workspace has the add-on. Anthropic’s commercial terms do not allow it to train models on what we send.

Our database, application servers, payment provider, transactional email provider and AI provider store data in the United States, and the AI provider may generate a reply in another country, so your data crosses borders. Those transfers rely on the providers’ standard contractual clauses and equivalent safeguards. If you are in Brazil, this means your data is processed outside Brazil — which the LGPD permits on those safeguards.

Separation between workspaces is enforced in the database itself, through row-level security on every table, not by application code that could be bypassed by a bug in a query.

Connection credentials are encrypted with AES-256-GCM before they are written to the database. The encryption key is held outside the database, so a copy of the database alone does not reveal them.

Message content is not separately encrypted by us. It is protected by our database provider’s encryption at rest and in transit, by access controls, and by the workspace separation above — but we want to be straightforward that we do not add a second layer of application-level encryption to message bodies today. We would rather state this plainly than imply protection we have not built.

Who can read your conversations. The in-app platform-administration role exists for billing and account health, and it was built with no database permission to read message or contact content. That much is a structural limit rather than a policy promise.

The people who operate the service are a different matter. The credential our servers use bypasses row-level security by design, and the self-hosted WhatsApp gateway holds message payloads in a database of its own; today that access sits with the founder. It is used to keep the service running and to investigate a problem you have reported — not to read your conversations for any other purpose, not to sell them, and not to train models on them. We would rather write that down than claim a limit we do not have.

No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authority without undue delay.

While your workspace is active, we keep your conversations so you can search your history.

When you delete your workspace, everything belonging to it — messages, contacts, pipeline records and stored credentials — is deleted within 7 days. Backups age out on our provider’s ordinary cycle after that.

If your workspace uses the AI agent, Anthropic deletes what we send it within 30 days of receiving it, or keeps it for up to 2 years if its automated systems flag it as breaking Anthropic’s usage policy.

We keep a minimal billing record for as long as tax and accounting law requires.

Under Brazil’s LGPD, the GDPR, and comparable laws, you can ask us to confirm what we hold about you, correct it, export it in a portable format, delete it, restrict or object to how we use it, and withdraw consent where consent is the basis.

We operate from British Columbia, so Canadian law applies to us as well: PIPEDA federally and British Columbia’s Personal Information Protection Act. Those give you much the same rights — access to what we hold, correction of what is wrong, and an explanation of why we have it. Our privacy officer reads [email protected]; you do not need to name anyone to reach them.

Write to [email protected] and we will respond within 30 days. We do not charge for this.

If you are unhappy with our response, you can complain to your data protection authority — in Brazil, the ANPD; in Canada, the Office of the Privacy Commissioner of Canada or, in British Columbia, the Office of the Information and Privacy Commissioner for BC.

A reminder from section 1: if you are asking about messages inside someone’s Unibox workspace, that organisation controls them. Ask them, and we will support them in answering you.

WhatsApp has its own terms and privacy policy, which continue to govern your use of it. Connecting a number to Unibox does not change your relationship with WhatsApp.

You are responsible for connecting only numbers you are entitled to use, for complying with WhatsApp’s terms, and for having a lawful basis to store the conversations you sync. You can disconnect a number at any time in Settings; disconnecting stops new messages from syncing and leaves already-synced history in place until you delete it.

When you report a bug or a suggestion from inside Unibox, we store what you wrote, any files you attach, and — if you leave the switch on — technical details about that moment: the screen you were on, the app version, your plan, your browser and screen size, your language and time zone, and the last errors and failed requests your browser recorded. The form shows you all of it before you send, and you can turn the technical part off.

No message text and no customer data are collected. Addresses have their identifiers removed, so a conversation page is recorded as /inbox rather than the conversation you had open.

A screenshot you attach may show your customers’ information, because it is a picture of your screen. Attachments are stored privately, are never public, and can only be opened by us through a link that expires within the hour. A report and its files are deleted 90 days after we close it.

We set one cookie to keep you signed in, and two small preference cookies that remember your chosen language and currency. That is all. They are necessary for the product to work, which is why you are not asked to consent to a banner.

We run no advertising trackers. To know whether our public pages work, we count visits with PostHog in a cookieless configuration: nothing is stored on your device, no profile is built, and visits are not linked to you or across sessions. Only public pages (the home page, sign-up, pricing and similar) are counted. No page inside your workspace is ever reported: any address from the app is replaced with a placeholder before it is sent, so no inbox, contact or conversation page is ever named. Personal names and access tokens are removed from addresses too, there is no session recording, and clicks are not captured.

We also count five moments in setting an account up, so we can tell where people get stuck: creating an account, confirming your address, connecting a WhatsApp number, starting a checkout, and paying. These are counts of the step — no message, contact, phone number or name is attached, and we learn that a number was connected, never which one or to whom. Like the page counts above, they are sent to the same analytics service, which receives the network address and browser your request arrives with; nothing is stored on your device and no profile is built.

If this ever changes, we will update this page before turning anything on.

Unibox is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.

If we make a material change to this policy, we will email workspace owners before it takes effect. The date at the top always reflects the current version.

Privacy questions and deletion requests: [email protected]
Anything else: [email protected]