1. What this policy covers
This policy explains how Unio collects, uses, stores, and shares personal information when you use the platform. Unio is operated from the United States and serves users worldwide; we apply one global baseline to everyone, plus the region-specific rights described in section 8 — including rights under the EU and UK GDPR and under US state privacy laws such as the California Consumer Privacy Act — where they apply to you.
2. What we collect
We collect the following categories of information:
- Account data — your email address, optional display name, avatar, sign-in events, and the approval state of your access request.
- Authentication data — passkey public-key credentials (never your biometrics, which stay on your device) and short-lived email sign-in codes.
- Financial records you enter — holdings, transactions, contributions, decisions, votes, theses, and documents you or your collective import (including broker CSV files and forwarded broker confirmation emails).
- Connection credentials — API keys for third-party exchange or brokerage connections you add, stored encrypted (AES-256-GCM).
- Product telemetry — server logs, error journals, and security events needed to run and protect the service. We may introduce product usage analytics (which screens and features are used) to improve the product; if we do, it will be covered by this policy and used only in aggregate.
- Support communications — messages you send us.
3. How we use it
We use personal information to:
- operate the product — display your collective's positions, tally votes, generate briefings, and keep members in sync;
- secure the service — rate limiting, abuse detection, audit trails of security-relevant events;
- communicate — sign-in codes, membership and governance notifications, and (if you opt in or your collective mandates them) scheduled portfolio briefings, each carrying working unsubscribe controls;
- improve the product — aggregate, de-identified analysis of how features perform.
4. AI processing
Unio's AI features send relevant context — which can include your collective's holdings, decision drafts, and market data — to third-party large-language-model providers (via our AI infrastructure) to generate research answers, intake assistance, and briefings. We send what the feature needs, not your whole account.
Where you configure your own AI provider key, requests for those features are billed to and processed under your provider account and that provider's privacy terms.
5. Who sees your data
Inside the product: members of your collective see the collective's shared records according to the product's roles and rules (for example, votes can be anonymised per the collective's settings). Unio staff access production data only when needed to operate or support the service.
Service providers we use to run Unio process data on our behalf, including: cloud hosting and databases, email delivery, inbound-email processing and object storage, AI model providers, payment processing (if billing applies to you), and market-data sources. We do not sell personal information, and we do not share it for targeted advertising.
We may disclose information where the law requires it, or to protect the safety and integrity of the service.
6. Cookies and sessions
Unio uses first-party cookies for sign-in sessions, security (cross-site request protection), and remembering interface preferences such as theme and your active collective. We do not use third-party advertising cookies.
7. Storage, security, and international transfers
Data is stored and processed in managed cloud infrastructure in the United States and in other countries where our service providers operate. If you use Unio from outside the United States, your information is transferred to and processed in the United States; we protect it the same way wherever it is processed — encryption in transit, encryption of connection credentials at rest, access controls, and audit logging.
We keep your records while your account is active because they are your collective's books. Some operational data expires automatically (for example, transient market-news reads). If you close your account, contact us to request deletion of your personal information; note that a collective's shared governance records (contracts signed, votes cast) may need to be retained for the other members' legitimate record-keeping.
8. Your choices and rights
You can access and correct your profile inside the app, control briefing emails via settings and the unsubscribe link in every email, and request a copy or deletion of your personal information by contacting us. We may need to verify your identity before acting on a request.
Depending on where you live, you may have additional statutory rights. If you are in the EU, UK, or another GDPR-like jurisdiction: rights of access, rectification, erasure, restriction, portability, and objection; where we rely on consent you can withdraw it at any time; and you can complain to your local data protection authority. Our legal bases are performing our contract with you (operating the service), our legitimate interests (securing and improving it), legal obligations, and consent where we ask for it. If you are in California or another US state with a privacy law: rights to know, access, correct, and delete personal information, and not to be discriminated against for exercising them — and, as stated above, we do not sell personal information or share it for targeted advertising.
We extend these rights to all users where we reasonably can, regardless of where you live. If you believe we have mishandled your information, contact us first; you can also complain to the data protection authority where you live.
9. Children
Unio is not directed to children. You must be at least 18 years old (or the age of majority where you live, if higher) to use the service. We do not knowingly collect personal information from anyone under 18; if we learn we have, we will delete it.
10. Changes and contact
When this policy changes substantively, we bump the revision date and ask you to accept the new version before continuing.
Privacy questions and requests: support@unio.fund.