Unframe Product Privacy Policy
Effective Date: July 12, 2026
1. Purpose
This Product Privacy Policy ("Policy") explains how Unframe ("Company", "we", "our", or "us") collects, processes, stores, protects, and discloses information processed through our AI-powered software products, cloud services, APIs, applications, and related services (collectively, the "Products").
This Policy applies solely to information processed through the Products. Information collected through our corporate website, including marketing activities, recruitment, newsletters, cookies, and contact forms, is governed by our separate Website Privacy Policy.
This Policy should be read together with our AI Usage Policy, Data Processing Agreement ("DPA"), and any applicable customer agreements.
2. Definitions
For purposes of this Policy:
Customer
A legal entity or organization that licenses or subscribes to the Products.
Authorized User
An employee, contractor, consultant, agent, or other individual authorized by a Customer to access or use the Products.
Customer Data
Customer Data means all information, content, data, records, documents, communications, and materials submitted, transmitted, uploaded, stored, generated, or otherwise made available by or on behalf of a Customer or its Authorized Users through the Products, regardless of format or source.
Customer Data includes, without limitation:
personal information and personally identifiable information (PII);
special category or sensitive personal information where permitted by applicable law;
protected health information (PHI), where applicable;
financial, banking, insurance, and transactional information;
employee, customer, supplier, and business records;
data transferred through APIs, integrations, webhooks, connectors, or automated workflows;
uploaded files and documents;
images, audio, video, and structured or unstructured content;
prompts, questions, instructions, commands, and other user inputs submitted to AI features;
conversation history and chat interactions;
AI-generated responses, summaries, recommendations, classifications, and other outputs;
operational data processed through the Products;
logs, metadata, identifiers, and contextual information associated with customer requests; and
any derivative information generated by the Products solely for the purpose of delivering the contracted services.
Customer Data remains the property of the Customer or the Customer's licensors. Nothing in this Policy transfers ownership of Customer Data to the Company.
3. Our Role
For Customer Data processed through the Products:
Customers generally act as the Data Controller (or equivalent under applicable privacy laws).
We generally act as the Data Processor under the GDPR and UK GDPR, and as a Service Provider or Contractor under the CCPA/CPRA, processing Customer Data solely on behalf of and in accordance with our customers' documented instructions.
For information relating to our own business operations (including account administration, billing, support, compliance, and security), we act as the Data Controller.
4. Information We Process
Depending on the Products and customer configuration, we process the following categories of information.
Customer Account Information
This may include:
user names;
business email addresses;
company names;
job titles;
authentication credentials;
user roles and permissions;
account preferences;
audit records.
We process this information to:
authenticate users;
provide access to the Products;
administer customer accounts;
maintain security;
provide technical support;
communicate regarding the Products;
improve service reliability.
Where the GDPR or UK GDPR applies, the legal basis is performance of a contract and our legitimate interests.
Customer Business Data
Customers may submit Customer Data through:
APIs;
software integrations;
uploaded files;
connected business applications;
workflow automation;
enterprise systems;
databases.
Depending on customer usage, this information may contain personal information, confidential business information, regulated information, or other sensitive data.
We process this information solely to provide the contracted Products and services.
AI Inputs and Outputs
Our Products process:
prompts;
questions;
uploaded documents;
contextual information;
conversation history where enabled;
AI-generated responses;
summaries;
recommendations;
workflow outputs.
These inputs may contain personal information submitted by Customers or Authorized Users.
Such information is processed only to generate the requested AI functionality.
System and Security Information
We automatically collect technical information required to operate and secure the Products, including:
IP addresses;
browser information;
device information;
operating system information;
authentication logs;
API request metadata;
timestamps;
audit logs;
error reports;
security events.
This information supports security, fraud prevention, monitoring, troubleshooting, compliance, and service reliability.
5. How We Use Customer Data
We process Customer Data only for legitimate business purposes necessary to provide the Products, including:
providing AI-powered services;
processing customer requests;
generating AI responses;
authenticating users;
operating APIs and integrations;
maintaining service availability;
securing our infrastructure;
monitoring system performance;
detecting fraud and security incidents;
troubleshooting technical issues;
complying with legal obligations;
providing customer support;
maintaining product quality and reliability.
We do not use Customer Data for:
advertising;
behavioural marketing;
unrelated commercial purposes;
employee monitoring;
unrelated profiling; or
training generalized AI models.
6. Legal Basis for Processing
Where applicable under the GDPR and UK GDPR, processing is based upon:
performance of a contract;
compliance with legal obligations;
legitimate interests in operating secure Products;
documented customer instructions;
consent where required by law.
7. AI Processing
Our Products use artificial intelligence to:
analyse information;
answer user questions;
summarize information;
classify information;
extract insights;
automate workflows;
generate recommendations;
support business processes.
AI processing is performed solely to deliver the functionality requested by Customers.
AI-generated outputs should be reviewed by appropriately qualified personnel before being relied upon for decisions involving healthcare, financial services, insurance, employment, legal matters, public services, or other high-impact activities.
8. AI Model Training
We recognize that Customers entrust us with confidential, proprietary, and regulated information.
Neither the Company nor our approved third-party AI service providers use Customer Data to train, retrain, fine-tune, or improve publicly available or generalized artificial intelligence or machine learning models.
Customer Data—including prompts, uploaded documents, API-transferred information, conversation history, AI inputs, AI-generated outputs, metadata, and all other information processed through the Products—is processed solely for the purpose of delivering the contracted Products and services.
We do not use Customer Data for unrelated commercial purposes, advertising, marketing, profiling, or AI model training.
Where product testing, diagnostics, quality assurance, or service improvements are performed, these activities use data that has been appropriately de-identified, anonymized, or otherwise expressly authorized by the Customer, and only where permitted by applicable law.
Should we ever propose to use Customer Data for AI model training or any materially different purpose, we will do so only with the Customer's prior written authorization and, where required, an appropriate legal basis.
9. Third-Party AI Services
To provide AI-powered functionality, our Products may use approved third-party AI service providers, including providers of large language models (LLMs).
When Customers submit prompts, documents, API data, or other Customer Data to AI-enabled features, the information necessary to generate the requested response may be securely transmitted to these providers solely for the purpose of delivering the requested functionality.
Our AI providers process Customer Data only under contractual obligations requiring:
confidentiality;
appropriate technical and organizational security measures;
compliance with applicable privacy and data protection laws;
restrictions on the use of Customer Data;
processing only for authorized purposes.
We conduct due diligence and ongoing assessments of our AI providers as part of our vendor risk management program.
10. Security
We implement technical and organizational measures designed to protect Customer Data.
These measures include:
AES-256 encryption for Customer Data at rest;
TLS 1.2 or TLS 1.3 encryption for all Customer Data transmitted over public networks;
role-based access controls;
least-privilege access principles;
authentication and authorization controls;
audit logging;
continuous monitoring;
vulnerability management;
backup and disaster recovery procedures;
employee confidentiality obligations.
Although no system can guarantee absolute security, we maintain safeguards appropriate to the sensitivity of the information we process.
11. Subprocessors and Third-Party Service Providers
We engage carefully selected Subprocessors to support the operation and delivery of the Products.
These may include providers of:
cloud infrastructure and hosting;
artificial intelligence services;
managed databases;
storage services;
networking;
monitoring;
identity management;
communications;
backup services;
disaster recovery;
cybersecurity.
Subprocessors may process Customer Data only to the extent necessary to perform the contracted services.
All Subprocessors are contractually required to:
process Customer Data only on documented instructions;
maintain confidentiality;
implement appropriate security measures;
comply with applicable privacy laws;
notify us of security incidents where required;
support our compliance obligations.
A current list of approved Subprocessors is available upon request or through customer documentation.
12. International Data Transfers
Customer Data may be processed in jurisdictions where we, our affiliates, or approved Subprocessors operate.
Where international transfers occur, we implement appropriate safeguards, including where applicable:
Standard Contractual Clauses;
UK International Data Transfer Addendum;
Swiss transfer mechanisms;
adequacy decisions;
other legally recognized safeguards.
13. Data Retention
We retain Customer Data only as necessary to provide the Products, maintain security, comply with legal obligations, resolve disputes, and fulfil our contractual obligations.
Specific retention periods are established in the applicable customer agreement, Data Processing Agreement (DPA), Statement of Work, or other contractual documentation and may vary depending on the Products and services provided.
Where Customers configure retention settings within the Products, those settings will apply unless otherwise required by law or agreed contractually.
Upon termination of the applicable agreement, Customer Data will be returned, deleted, or securely disposed of in accordance with the applicable agreement, the DPA, documented customer instructions, and applicable law.
14. Privacy Rights
Where applicable, individuals may have rights to:
access personal information;
correct inaccurate information;
request deletion;
restrict processing;
object to processing;
receive a copy of their personal information;
withdraw consent where applicable;
lodge complaints with an appropriate supervisory authority.
Where we act as a Data Processor, requests relating to Customer Data should normally be directed to the relevant Customer acting as Data Controller.
15. Applicable Privacy Laws
We process Customer Data in accordance with applicable privacy and data protection laws, including, where applicable:
the EU General Data Protection Regulation (GDPR);
the UK GDPR and the UK Data Protection Act 2018;
the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA);
the Swiss Federal Act on Data Protection (FADP);
the Israeli Protection of Privacy Law and applicable regulations; and
other applicable privacy and data protection laws governing the jurisdictions in which our Products are offered or Customer Data is processed.
Our Products are designed to support Customers in meeting their privacy obligations; however, each Customer remains responsible for ensuring that its own collection, submission, and use of Customer Data complies with applicable laws, regulations, and contractual obligations.
16. Changes to this Policy
We may update this Policy from time to time to reflect changes in our Products, legal requirements, security practices, or business operations. Material changes will be communicated to Customers through appropriate channels where required by applicable law.
17. Contact
Questions regarding this Product Privacy Policy or our privacy practices may be directed to:
Privacy Officer
Yossi Bronshtein
Email : privacy@unframe.ai