Privacy Policy

This Privacy Policy explains how VARK TECHNOLOGIES MMC (VÖEN 1310018631, office: Bakı, Ağ Şəhər, Mərkəzi Bulvar 8, "VARK", "we") processes personal data in connection with UNFYCHAT (the "Service") and the website unfychat.com.

1. Our role

1.1. As controller. We decide how and why we process the personal data of people who visit our website, contact us, and create or use an UNFYCHAT account (name, e-mail, role and similar account data).

1.2. As processor. Messages, attachments and contact details of a business customer's own clients ("end customers") are processed on behalf of that business (the "Customer"). The Customer is the controller of that data and decides why it is processed. Our obligations for this data are set out in the Data Processing Agreement. End customers who want to exercise their rights should first contact the business they wrote to.

2. What we process

Account users (owners, administrators, managers) - Name, e-mail address, password (stored only as a one-way hash), interface language and role. - If you sign in with Google: your Google account e-mail and name, which Google confirms to us. - Workspace membership, invitations, department membership and actions in the workspace (for example, who took or closed a conversation). - Security data: sign-in times, IP address, browser user agent, and records in the audit log.

End customers of our Customers (processed on the Customer's behalf) - Messages and attachments sent to the Customer through connected channels, and replies from the Customer's staff. - Profile information provided by the messaging platform, such as display name, username, platform user ID and, for WhatsApp, the phone number. - Internal notes, tags and assignment history created by the Customer's staff.

Channel connections - Access tokens and identifiers issued by the messaging platforms (for example Meta) when the Customer connects a channel. Tokens are encrypted at rest and are never shown in the browser.

Website visitors and enquiries - Information you enter in our contact and demo forms: name, e-mail, phone (optional), company, team size, channels of interest and your message, plus the page and campaign parameters (UTM) through which you arrived. - Cookies and similar technologies as described in the Cookie Policy.

Billing - Plan, subscription status and payment history. Online payments are not yet enabled. Before they are, we will name the payment provider here. We will never receive or store full card numbers.

3. Why we process it and on what legal basis

• To provide the Service under our contract with the Customer and with you: creating accounts, delivering and storing messages, assigning conversations, analytics.
• To keep the Service secure and prevent abuse (legitimate interest and legal obligations): authentication, rate limiting, audit logs, investigating incidents.
• To answer enquiries sent through our website (your request / steps before entering into a contract; your consent where required).
• To communicate about the account, for example invitations, password resets and important service notices (contract).
• To measure our marketing with analytics and advertising cookies, only if you consent (consent, which you can withdraw at any time).
• To comply with law, including accounting and tax obligations and lawful requests from authorities (legal obligation).

We apply the Law of the Republic of Azerbaijan "On Personal Data" and, where it applies to our activity, the EU General Data Protection Regulation (GDPR).

4. What we do not do

• We do not sell personal data.
• We do not use the content of conversations for advertising, and we never send message contents to advertising or analytics systems.
• Our platform administrators manage workspaces and plans without access to conversations in the application. We access a Customer's content only at the Customer's request and only as far as needed to help.

5. Service providers (sub-processors)

We use the following providers to run the Service:

• Vercel Inc.: application hosting; servers in Frankfurt, Germany, with a global content delivery network for static files.
• Supabase Inc.: database and real-time updates; servers in Frankfurt, Germany (AWS eu-central-1).
• Meta Platforms (Instagram, Facebook Messenger, WhatsApp): only for the channels the Customer connects; messages pass through Meta according to Meta's own terms.
• Google LLC: sign-in with Google, if you choose it.
• Resend, Inc. (United States): delivery of transactional e-mails such as invitations, e-mail confirmations and password resets.
• AI features are not active yet. Before they are enabled, we will name the AI model provider here; AI will be used only in workspaces whose owner turns it on.
• Analytics and advertising (Google Analytics, Google Ads, Meta Pixel): only on our public website and only with your consent.

The current list is also kept in the Data Processing Agreement.

6. International transfers

Our main servers are in the European Union (Germany). Some providers are based in the United States or other countries. Where personal data is transferred outside Azerbaijan or the EU, we rely on the safeguards those providers offer in their data processing terms, such as standard contractual clauses, and on the other grounds permitted by applicable law.

7. How long we keep data

• Account data: while the account exists. If you ask us to delete your account, we delete it within the time limits set by applicable law (see section 9), except data we must keep by law.
• Conversation content: as long as the Customer keeps it. Workspace owners can set an automatic retention period after which message texts and attachments are removed. After the Customer's subscription ends, the workspace becomes read-only; Customer Data is kept only as long as needed for the Customer to reactivate the workspace, and is deleted at the Customer's request or when it is no longer needed for that purpose, unless the law requires longer storage.
• Unconfirmed sign-ups: accounts whose e-mail was never confirmed and that belong to no workspace are deleted after 7 days.
• Website enquiries: while we handle the enquiry and for as long as needed for the business relationship that follows; you can ask us to delete an enquiry at any time.
• Security and audit logs: as long as they are needed to protect the Service, investigate incidents and meet legal obligations.
• Billing records: as long as required by tax and accounting law.

8. Security

We use encryption in transit (HTTPS with HSTS), encryption of platform tokens at rest, strict separation between workspaces, role-based permissions enforced on the server, rate limiting and audit logs. More detail is in the Security & Data Protection Policy.

9. Your rights

Depending on the law that applies to you, you may have the right to access your personal data, correct it, delete it, restrict or object to processing, receive a copy in a portable format, and withdraw consent at any time. To exercise these rights, write to support@unfychat.com. We will answer within the time limits set by applicable law. You also have the right to complain to the data protection authority of your country.

If your messages were handled by a business that uses UNFYCHAT, please contact that business first; we will help it respond.

To remove UNFYCHAT's access to your Facebook or Instagram data, follow the Data deletion instructions.

10. Children

The Service is for businesses and is not directed to children. We do not knowingly collect personal data of children as account users.

11. Changes

We may update this policy. The current version is always on this page with its date. For material changes we will inform account owners in advance.

12. Contact

VARK TECHNOLOGIES MMC, office: Bakı, Ağ Şəhər, Mərkəzi Bulvar 8. E-mail: support@unfychat.com.