Privacy policy
1. Who we are
Unagi is operated by [Company name], [registered address] ("we", "us"). Contact: uk@youok.uk.
We handle two kinds of personal data in two different roles, and this policy covers both:
- Our customers' account data. We decide how this is used, so we are the controller.
- Visitors to our customers' websites. Our customers decide why and how their visitors' data is processed and we process it on their instructions, so we are their processor. The customer's own privacy notice is the primary one for their visitors. The terms of that relationship are in our data processing addendum.
2. Data about people who use our dashboard (customers)
| Data | Why | Basis |
|---|---|---|
| Email address and a salted hash of your password (never the password itself) | To create and secure your account | Contract |
| Names and domains of sites you add, and your site keys | To provide the service | Contract |
A session cookie (unagi_session) holding a random token | To keep you signed in. It is strictly necessary and set only when you sign in | Contract / strictly necessary |
| Your sender name, reply-to address and business postal address, and chat and email settings | To run the chat and email on your behalf | Contract |
| Temporary request counts per network address | To limit abuse and brute-force attempts. Held in memory, not stored with your account | Legitimate interests (security) |
3. Data about visitors to our customers' websites
If the visitor has not consented: we receive the page path, a timestamp, and the hostname of the referring site and any utm_source value. We do not receive or store a visitor ID, a session ID, or anything on the visitor's device.
If the visitor has consented (through the customer's cookie banner): a random visitor ID and session ID (kept in the visitor's browser localStorage and sessionStorage on the customer's own website, so they are specific to that website), the pages and page titles viewed, product names, SKUs and prices viewed, time actively spent and scroll depth, the text labels of buttons and links clicked (up to 100 characters, unless the customer disables this), searches typed into the site's search box, and add-to-cart, checkout and purchase events (optionally with an order value).
Device and approximate location (consented visitors only). Once per visit we record a short, fixed list of coarse facts about the browser: device type (desktop, mobile or tablet), browser name and operating system, language, time zone, screen size, whether dark mode is on, connection type, the site they came from (host only) and any campaign tag. We use the time zone, or the country your hosting provider's network reports if it supplies one, to show roughly where a customer is, for example a city-level time zone such as “London” or a country. We never store or look up IP addresses, and we do not use canvas, font, audio or hardware fingerprinting. A returning visit from the same browser is recognised by its random ID and added to the same record.
Optional data a customer may switch on. Each customer decides what to collect from their own visitors, and is responsible for telling those visitors in their own privacy notice. The options are: (1) location: approximate (the city or country the hosting network reports for the visit) or precise (the visitor chooses to share their location through their browser or phone, and we keep it rounded to about a kilometre, so the shop can say where its nearest branch is and quote that branch's offer); (2) IP address: none (the default), shortened, a salted hash, or in full; (3) phone number, offered in the chat with its own separate tick box. Visitors who have not accepted analytics are never asked for any of this.
Cookie banner (if the customer switches it on). We can show a consent banner on the customer's site on their behalf. Its wording and privacy-notice link are the customer's. Before a visitor chooses, nothing about them is stored on their device by us except, after a choice, a record of that choice in their browser. We count how many times the banner was shown, accepted and rejected as anonymous daily totals with no identifier. If the visitor accepts, we record the consent in the consent log below.
Consent log. For visitors who accepted tracking, we record each time they give or withdraw a consent (analytics, email, text or phone, notifications, location), with the wording they saw, the time and where it happened, so the customer can show what was agreed. It is erased with the visitor.
Joining visits to an email address. If a visitor gives an email address in the chat, we link it to that browser's record so the customer can see the visitor's earlier and later visits together, and we show the visitor this in the wording of the box they tick (“link my email to my visits on this device”). The same email given from another browser links that browser too. Erasing the customer removes the email, the linked browser records, their events and conversations.
What analytics events do not contain: names, email addresses, postal addresses, phone numbers or payment details. (Email addresses and names reach us only through the chat form described below.) Our script does not read form fields, apart from a site-search box when it is submitted, and our servers discard event properties whose names look personal. By default we do not store visitors' IP addresses or raw browser user-agent strings; a customer may choose to keep an IP address (see below). IP addresses are used only transiently to rate-limit requests. Because the visitor ID lives in the customer's own origin, we cannot link a person across different customers' websites.
Browsers that send Global Privacy Control or Do Not Track are always treated as not having consented.
Chat and email (only if the customer turns them on). Visitors who have consented to analytics may be offered an automated chat. If they use it we store the conversation (their messages and the assistant's replies) and a record of which products they had looked at, and delete it with the other visitor data after 395 days. If a visitor chooses to give an email address, ticks the box, and optionally gives a first name, we store those, the exact wording they agreed to, the time, and the products involved, until the customer erases them or the visitor unsubscribes (after which we keep only the minimum needed to remember they must not be emailed). We send the customer's emails for them. These details are used only for the customer's own follow-up, never by us for our own purposes.
If the customer switches on live agents, the people they add as team members can read chat transcripts and the browsing context shown beside them (products viewed, basket, device type, region, and the email address if the shopper has given one) so they can help. The shopper is told when a person has joined. Alert emails and webhooks to the customer contain the same information.
The chat is automated, and says so. To produce replies we may send the visitor's messages, the product facts from the customer's pages and the customer's configured offer to an AI provider (see section 6). We do not send names or email addresses to it.
4. Our crawler
For domains whose owner has proved control of them, UnagiBot reads public pages (titles, links and product prices). This is not personal data about visitors.
5. How long we keep data
- Visitor events are deleted automatically after 395 days.
- Account data is kept while your account exists. Deleting your account removes your sites and all their data immediately.
- A customer can erase an individual visitor's data, or a whole site, at any time.
- Copies in server backups, if any, are removed when those backups expire in the normal rotation.
6. Who we share data with
We do not sell personal data, use it for advertising, or share it with data brokers. Our infrastructure provider (Namecheap) hosts the service and processes data on our behalf. If a customer enables them, an AI provider (Anthropic) generates chat replies and an email delivery provider (Resend) sends emails; both process only what is needed for that task on our behalf. Our servers are located in [server location].
7. Your rights
Under UK GDPR you have the right to access, correct, erase and receive a copy of your personal data, to restrict or object to its use, and to withdraw consent where we rely on it. To exercise these for your account data, email us. To exercise them for data collected on a customer's website, please contact that website's owner, who decides how the data is used. We will help them respond. You can complain to the Information Commissioner's Office at ico.org.uk.
8. Security
See our security page for the measures we use and the ones we have not yet taken.
9. Changes
If we change this policy materially we will update the date above and notify account holders.