Privacy Policy

Last updated 17 October 2026 · Invite-gated beta

Unadmin ("we", "us") provides an AI back office for small businesses. This policy explains what personal data we collect, why, and the choices you have. Unadmin is operated from the United Kingdom and we act as the data controller for account data, and as a processor for the business content you connect. Questions or requests: hello@unadmin.co.uk.

What we collect

• Account data. Name, email address, and authentication identifiers, managed through our sign-in provider (Clerk).
• Business profile data. The business details, tone, services, FAQs, and policies you enter to configure your assistants.
• Connected source data. When you connect a source (for example a Gmail or Outlook mailbox, accounting platform, or Google Business Profile), we access the messages and records needed to prepare drafts and surface signals for you. For email, we store only message headers and a short preview of up to 240 characters. When your assistant drafts a reply to a customer enquiry, it reads that one message in full at the moment of drafting, holds it in memory for the length of that request, and does not store it, log it or show it anywhere in Unadmin afterwards. The draft and your decision on it are stored; the customer's message is not.
• Billing data. Plan, credit usage, and payment status. Card details are handled by Stripe and never touch our servers.
• Service telemetry. Operational logs and usage metrics. We do not write your customer content into our logs.

How we use it

• To run the product: watching connected sources, preparing drafts, and queueing them for your approval. Nothing is sent without your say-so.
• To operate billing, support, and security.
• To improve the product using aggregate, de-identified usage patterns. We do not use your customer content to train general-purpose AI models.

How drafts are written

Drafts are generated by the Microsoft Azure OpenAI Service, running in Unadmin's own Azure subscription, which Microsoft operates as our processor. To write a reply, we send the model your business profile, your assistant's instructions and the customer message being answered. Microsoft does not use this content to train its models or anyone else's, and we send every request with storage turned off, so Microsoft keeps no copy of the conversation for us to retrieve later. Microsoft may hold prompts and generated text for a limited period for abuse monitoring, as described in its own terms; we have applied for Microsoft's modified abuse monitoring, under which that storage and human review do not take place. We do not use your customer content to train general-purpose AI models, and no model provider is permitted to.

Google user data — Limited Use disclosure

Unadmin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain language: data we receive from Google APIs (such as Gmail, Google Business Profile, Google Calendar, Search Console, Google Analytics, or Merchant Center) is used only to provide the features you asked for — drafting replies, chasing invoices, surfacing signals — and is never sold, never used for advertising, and never used to train generalised AI or machine-learning models. Human access is limited to cases where you ask us for support, security requires it, or the law demands it. When you connect Gmail, we tell you on the connection screen that message content is sent to the Microsoft Azure OpenAI Service to draft replies, and we ask for your agreement before any message is read in full.

Meta Platform Data — what we access and why

If you connect a Facebook Page, an Instagram professional account, or a Messenger inbox, we receive Platform Data from Meta and handle it under the Meta Platform Terms and Developer Policies. What we access:

• Page and account details. The list of Pages and Instagram accounts you manage and their profile information, so you can choose which ones Unadmin works with.
• Messages and comments. Conversations in your Page inbox, Instagram direct messages, and comments on your posts, so we can prepare replies for your approval.
• Posts and content. Existing and scheduled content, so drafts fit what you already publish and we can post the ones you approve.
• Engagement and insights. Aggregate reach and interaction figures used to surface signals in your workspace.

We use Platform Data only to provide the features you asked for. We do not sell it, use it for advertising or ad targeting, transfer it to data brokers or ad networks, use it to build profiles of the people who message you, or use it to train general-purpose AI models. Nothing is posted or sent from your Page or account without a person in your workspace approving it first.

You can revoke our access from Facebook at any time under Settings & privacy → Settings → Apps and websites, or delete the Platform Data we hold by following Deleting your data. When you disconnect or remove the app we delete the stored access tokens immediately and stop all access.

Disconnecting and revoking access

You can disconnect any source from your workspace settings at any time. We stop syncing straight away and delete the stored connection tokens. For Google accounts you can also revoke Unadmin's access yourself at myaccount.google.com/permissions. Disconnecting does not remove data already in your workspace; you can delete that from settings or ask us to — see Deleting your data for every route, including how to remove Unadmin from Facebook and Instagram.

Lawful bases

We process account and billing data to perform our contract with you. We process connected-source data on your instruction as part of the service. Security telemetry rests on our legitimate interest in keeping the service safe. Where consent is required (for example connecting a provider account), we ask for it explicitly and you can withdraw it by disconnecting the source.

Where your data lives

Production data is hosted on Microsoft Azure infrastructure in the UK South region. Our subprocessors are Microsoft Azure (hosting and the Azure OpenAI Service for draft generation, under terms that prohibit training on your content), Clerk (authentication) and Stripe (payments).

International transfers

Your data is stored in the United Kingdom. The Azure OpenAI deployment we use is a global deployment type, so Microsoft may process an individual request in another region where the model runs, while the data at rest stays in the UK. Where processing happens outside the UK we rely on Microsoft's UK data transfer terms, which incorporate the UK International Data Transfer Addendum.

Security

Data is encrypted in transit and at rest. Connection tokens are held in a dedicated secret vault rather than our application database, and each connection requests the narrowest scopes its workflow needs. Access to production systems is limited and logged.

Retention

We keep your data while your workspace is active. If you close your workspace, we delete or de-identify personal data within 30 days, except where a longer period is required for legal or accounting reasons. You can request an export or deletion at any time from your workspace settings or by emailing us. Full instructions are on Deleting your data.

Your rights

Under UK GDPR you can request access, correction, deletion, restriction, or a portable copy of your personal data, and you can object to processing. Email hello@unadmin.co.uk and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use only the cookies needed to sign you in and keep your session secure, set by our authentication provider. We do not use advertising or cross-site tracking cookies.

Changes

We will post any changes here and, for material changes during the beta, email workspace owners before they take effect.