Privacy Policy

1. Introduction

At UNIQCO, we believe your data is your private property. Our core commitment is simple: we answer your question and forget.

For consumer (non-business) users interacting with our AI personas and services, we have architected the platform from the ground up so that your most sensitive personal information is never stored on our servers — not because we promise not to look, but because our systems are designed to make it technically impossible.

This policy describes how we handle your data, what we keep, what we immediately discard, and how our optional zero-knowledge vault gives you full control over your own history — without us ever holding the key.

2. Information We Collect

We collect the minimum information necessary to provide our Services:

2.1 Account Information

• Account Information: Name, email address, and password when you create an account.
• Usage Data: Information about how you interact with our Services, including features used and session metadata.
• Technical Data: IP address, browser type, device identifiers, and diagnostic logs.
• Payment Information: Billing address and payment method details, processed securely through our payment provider.

2.2 Consumer Prompt Data

When you interact with our AI personas, your prompts pass through our tiered data classification system. What we retain depends entirely on the sensitivity tier — see Section 3 for details.

2.3 Information We Do NOT Collect

• We do not train third-party AI models on your personal data.
• We do not store Tier 3 or Tier 4 data on our servers — it never touches our disk.
• We do not know which cloud provider you use for your optional private vault.
• We do not store, read, or transmit your vault encryption key — ever.
• We do not persist AI responses on our servers — responses are rendered on your device only.

3. Our Data Classification Framework

Every piece of data that flows through UNIQCO is automatically classified into one of four sensitivity tiers. This classification is built into our architecture — it is not a policy promise, it is a technical constraint.

4. How We Process Your Data

When you submit a prompt, the following sequence occurs:

1. Persona Creation: Your prompt is analyzed and an AI persona is selected to generate your answer.
2. Answer Generated: The persona generates a response using our AI infrastructure.
3. Tier Classification: Your prompt and response are automatically classified into Tier 1, 2, 3, or 4 based on their content sensitivity.
4. Tier 1-2 Anonymized Retention: Only anonymized behavioral patterns (no personal content, no identity) from Tier 1-2 data are retained to improve our AI architectural layer.
5. Tier 3-4 Immediate Auto-Purge: All Tier 3-4 data is purged from memory immediately after your response is prepared. No disk write ever occurs for Tier 3-4 data.
6. Response Delivered to Your Device: Your response is sent to your device and rendered there. We do not retain a copy.

5. Your Data Stays On Your Device

AI responses are rendered on your device. We never persist responses on our servers. You may save any response locally on your own device using your browser or export features — that storage belongs entirely to you.

If you clear your browser data or switch devices, locally saved responses are gone — unless you opt in to our encrypted cloud vault (see Section 6).

6. Opt-In Private Vault with Cloud Sync

If you choose to save your history, you may opt in to our zero-knowledge encrypted vault. Here is exactly how it works:

• Zero-Knowledge Encryption: A vault is created on your device using AES-256-GCM encryption. Your encryption key is derived from your passphrase or biometric — only on your device. UNIQCO holds no decryption key and cannot read your data — technically or legally.
• Your Own Cloud Provider: You connect your own cloud storage (iCloud Drive, Google Drive, OneDrive, Dropbox, or any S3-compatible service). UNIQCO never touches your OAuth tokens — they are stored on your device only.
• Encrypted Before Sync: Data is encrypted on your device before being uploaded. Your cloud provider sees only encrypted binary blobs — they cannot read the content either.
• Cross-Device Sync: Your encrypted blobs sync automatically across all your devices — just like Apple iCloud Keychain. A new device enters your passphrase, downloads encrypted blobs, and decrypts locally.
• We Do Not Know Your Provider: UNIQCO never learns which cloud provider you chose. The OAuth flow happens entirely between your device and your chosen provider.
• Full User Control: You can export all vault data, delete the vault permanently, or disconnect your cloud provider at any time.

7. What We Use For LLM Improvement

Only anonymized Tier 1-2 behavioral patterns are used to improve our AI architectural layer. These patterns contain:

• Broad query category (e.g., "finance", "health-general", "how-to")
• Which AI persona was used
• Response latency metrics
• Hour-precision timestamps (never exact)

They contain no user identity, no personal content, and no information that could be linked back to you. We never use Tier 3-4 data for any purpose — it is purged before we could even attempt to analyze it.

8. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information in the following limited circumstances:

• Service Providers: With trusted vendors who assist in operating our platform (hosting, payments, analytics), bound by confidentiality obligations.
• Legal Requirements: When required by law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate data protection commitments.
• With Your Consent: In any other case, only with your explicit permission.

9. Your Rights (GDPR, CCPA, PIPEDA)

Depending on your location, you may have specific rights regarding your personal data:

To exercise any of these rights, email us at privacy@uniqco.dev. We will respond within 30 days.

10. Cookie Policy

We use cookies and similar tracking technologies to enhance your experience. These include:

• Essential Cookies: Required for the Services to function. Cannot be disabled.
• Analytics Cookies: Help us understand how users interact with our platform (anonymous, aggregated data only).
• Preference Cookies: Remember your settings and preferences across sessions.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

11. Security Measures

We implement industry-standard and privacy-by-architecture security measures:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• SOC 2 Type II compliance (in progress)
• Regular third-party penetration testing
• Role-based access controls and audit logging
• Automatic security patching and vulnerability management
• In-memory-only processing for Tier 3-4 data — no disk write guarantee
• Automatic volatile memory purge post-response for all sensitive data
• Zero-knowledge AES-256-GCM encryption for opt-in vaults — key held by user only
• Client-side-only OAuth for cloud sync — tokens never transmitted to our servers

Despite our best efforts, no security measures are perfect. If you believe your account has been compromised, please contact us immediately.

12. International Data Transfers

UNIQCO operates with team members and infrastructure across India, China, the United States, and Canada.

• Tier 3-4 data never leaves your device. It is processed in volatile memory and purged — no cross-border transfer occurs because the data is never stored.
• Tier 1-2 anonymized patterns may be transferred internationally for LLM architectural improvement with appropriate safeguards (Standard Contractual Clauses where required by GDPR).
• Vault datais stored in your chosen cloud provider's infrastructure — subject to your cloud provider's data residency settings.

13. Contact Information

For privacy-related questions or to exercise your rights, contact our Data Protection Officer: