Privacy Policy

Last updated: 27 July 2026

This notice explains how Simone Marrocco ("we", the Controller) processes personal data when you use UnlockGPT (the "App" or the "Service"), an AI-powered productivity assistant that integrates with your email accounts, calendars, document storage, and other services to provide intelligent task automation.

Our guiding principle is simple: your data is yours. It is encrypted so that we cannot read it, you can delete it at any time, and the only thing we collect about your usage is anonymous-by-design statistics (such as token counts) that never include the content of your conversations. For a plain-language explanation of how this works, see How We Protect Your Data.

1. Controller and Contact

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national laws.

2. Where Your Data Is Stored

All data is stored exclusively within the European Union:

• MongoDB Atlas (Europe): User accounts, chat metadata, connected account information, uploaded document content (encrypted), and usage statistics.
• Google Cloud (Europe): Application servers and temporary file processing.

Your chat messages and uploaded documents are encrypted using AES-256-GCM with a per-user encryption key derived from your account password (PBKDF2, 600,000 iterations, performed in your browser). The encryption key is derived client-side and never stored on our servers — we keep only a one-way bcrypt hash of your password to verify your login, which cannot be reversed into the password or the key. This means that even we cannot read your messages or documents. Changing your password re-encrypts your data with the new key; resetting a forgotten password deletes your encrypted content, because nobody can decrypt it.

Encryption with your personal key covers: your messages, the AI's responses, the results and arguments of every tool the AI uses (email contents, file contents, calendar data it retrieves), the AI's reasoning traces, and chat previews. Only minimal operational metadata remains unencrypted so the App can function: chat titles, timestamps, message counts, tool names, and token usage statistics.

OAuth tokens for your connected accounts (Google, Microsoft, Dropbox) are likewise encrypted at rest with AES-256-GCM using a separate server-side key that is stored outside the database. We never receive or store your account passwords.

3. What We Log (and What We Don't)

We do NOT log, store, or have access to:

• The content of your chat messages (encrypted with your personal key)
• The text you send to or receive from the AI
• The content of your emails, calendar events, or files
• The inputs and outputs of the tools the AI uses on your behalf, or the AI's reasoning traces (all encrypted with your personal key)
• Your password or derived encryption key

We DO log for service improvement and platform analytics:

• Token usage statistics: For each AI request we record numeric counters only — input tokens, output tokens, cached tokens — plus the model name used. These are pure numbers used for billing, capacity planning, and cost optimization; they contain no text.
• Feature usage: Which features you use (e.g., file uploads) and which tools the AI invoked by name (e.g., "email search") — not what you say, upload, search, or find
• Connected account types: Which services you connect (Gmail, Outlook, etc.) — not your email content
• Error logs: Technical errors for debugging (anonymised where possible)
• Performance metrics: Response times, time-to-first-token, API latency, and success/error rates for service optimization

Our administrators see this data only as aggregate dashboards (total requests, token volumes, response times, error rates). By design, no message content, prompt text, or AI output is ever written to these logs — so neither administrators nor anyone else can read your conversations through them.

These usage logs are stored in a dedicated collection, separate from your messages, and contain your email address and the internal account identifier alongside the technical figures. They are retained independently of your messages: deleting a chat, a message, or your account does not delete them. They are kept for 36 months, after which they are deleted automatically (see Section 8). Our legal basis for keeping them after account deletion is our legitimate interest (Art. 6(1)(f) GDPR) in proving service delivery for payment disputes and refunds. Because they contain no message content, they cannot be used to reconstruct anything you wrote.

This data is used solely to improve the Service, understand usage patterns, and ensure reliable operation. It is never sold or shared with third parties for advertising purposes, and it is never used to train AI models.

4. Categories of Data We Process

Depending on how you use the Service, we may process:

We do not intentionally collect special categories of data (Art. 9 GDPR). Please avoid entering unnecessary sensitive information.

5. AI Provider: Fireworks AI

To generate AI responses, your prompts are sent to Fireworks AI, our AI infrastructure provider, which processes them in the United States (see Section 10). Fireworks AI provides strong privacy guarantees:

• Zero Data Retention by default: Prompts and outputs exist only in volatile memory for the duration of the request and are not logged to persistent storage.
• No model training: Your data is never used to train AI models without explicit opt-in.
• Certifications: SOC 2 Type II, HIPAA, ISO 27001, ISO 27701, and ISO 42001; Fireworks AI maps its security controls to GDPR requirements.
• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256).

For more information, see:

• Fireworks AI Data Security Documentation
• Fireworks AI Trust Center
• Fireworks AI Privacy Policy

6. Security Certification

UnlockGPT has achieved CASA Tier 2 certification (Cloud Application Security Assessment), validated by TAC Security using the ESOF AppSec ADA framework.

• ESOF Cyber Score: 9.4 / 10 (Low risk)
• Assessment date: October 2025
• No critical or high-severity vulnerabilities identified

CASA is built upon OWASP's Application Security Verification Standard (ASVS) and provides trusted assurance assessments for applications handling sensitive data.

7. Purposes and Legal Bases

We process data for:

8. Data Retention

We retain data only for as long as necessary:

• Chat messages: Retained until you delete them or your account. Encrypted and inaccessible without your password.
• Usage logs and statistics (token counts, model names, response times, tool names, success/error status, and the account email address — never content): Retained for 36 months, after which they are deleted automatically. They are not deleted when you delete individual chats or messages, nor when you delete your account: they stay linked to your email as the record of service delivery. Our legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in proving service delivery for payment disputes and refunds. They contain no message content.
• Connected-account tokens: Disconnecting an account in the App immediately and permanently deletes the stored encrypted token from our database. To also revoke the underlying authorization at the source, use the security settings of your Google, Microsoft, or Dropbox account. If a provider reports a connection as broken (for example, because you revoked it provider-side), we deactivate it and the defunct token is removed when you delete your account.
• Account data: Retained for the duration of your account plus any legally required retention period.
• Billing records: The subscription record (email, provider customer and subscription identifiers, status, period end, and cancellation and deletion dates) is retained after account deletion for the same purpose as the usage logs: proving service delivery for payment disputes and refunds. Creem, acting as Merchant of Record, holds the invoices, which are retained as required by Italian tax law (typically 10 years).

Deletion is self-service. You can delete any individual chat (which immediately removes the chat, all its messages, and its task lists from our production database) or delete your entire account. Deleting your account removes, in a single cascading operation: your chats and messages, your jobs, your tasks and suggestions, your uploaded documents and their pages, your connected-account tokens, your proactive analysis records, your bug reports, your artifacts, your waitlist and invite entries, and your profile. Three records are kept: the usage logs (linked to your email) and the subscription record, both described above, and the Instant Scan run record that holds the address you connected, which enforces one free scan per address. You must cancel your subscription before you can delete your account. Residual copies may persist temporarily in the automated backups of our infrastructure providers before expiring on their standard rolling cycles; in any case, we complete deletion within 30 days, except for the kept records described above and where retention is required by law. Deleted conversations remain encrypted with your personal key in any such residual copy, so they stay unreadable even before the backup expires.

9. Recipients and Disclosures

We may share data with the following categories of recipients:

We do not sell your personal data. We require recipients acting as processors to follow our documented instructions and to implement appropriate safeguards (Art. 28 GDPR).

10. International Data Transfers

All primary data storage is within the EU/EEA (MongoDB Atlas Europe, Google Cloud Europe). Fireworks AI may process data in the United States; transfers are covered by EU Standard Contractual Clauses and supplementary technical measures. Information on specific transfers is available on request.

11. Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten"). You can also do this yourself at any time by deleting individual chats or your entire account from the App. Two records are kept after deletion — the usage logs linked to your email and the subscription record — under our legitimate interest in proving service delivery for payment disputes (see Section 8 for what is removed and what is retained).
• Restriction: Limit how we process your data.
• Portability: Receive your data in a structured, machine-readable format.
• Object: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent.

To exercise your rights, contact: [email protected]

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) at www.garanteprivacy.it.

12. Children

The Service is not intended for children under 14 (per Italian law). If you believe a minor has provided personal data without valid consent, contact us to request removal.

13. Automated Decision-Making

We do not carry out solely automated decisions producing legal or similarly significant effects. AI-generated outputs are tools to assist you, not automated decisions about you.

14. Instant Scan (the free demo)

Instant Scan lets you connect one or more Gmail or Outlook accounts on our homepage and receive a one-off summary of what needs your attention, without creating an account. It is optional and separate from the Service described above.

What we ask for. Read-only access to your mail and calendar, and your email address. We do not request permission to send, delete, or modify anything, and we do not request offline access — the authorisation we receive expires within about an hour and cannot be renewed by us.

Where the authorisation lives. The access token is held only by your own browser tab, for the duration of your visit. We never write it to our database. When the scan finishes we end the authorisation, and closing the tab discards it.

What is processed. To write your summary, the content of recent messages and calendar entries is sent to our AI provider (Fireworks AI, see section 5) and to our servers in transit. Neither we nor Fireworks retain that content after the scan, and it is not used to train any model.

What we keep. Only the email address of each account you connected — so the free scan stays one per address — together with technical facts about the run: when it happened, how long it took, how many messages were reviewed, how many suggestions were produced, and what it cost us in AI usage. We do not store your messages, their senders or subjects, or the summary itself, unless you press the button offering to send that summary to our team.

Legal basis. Your consent (Art. 6(1)(a) GDPR), given when you authorise the connection. You may withdraw it at any time by closing the tab, and you can ask us to delete your address using the contact details below.

15. Changes to This Notice

We may update this notice to reflect legal or technical changes. Updates will be published on this page with the new effective date. Continued use after changes take effect constitutes acceptance of the updated notice.

Contact

For privacy questions or requests: [email protected]
Simone Marrocco — VAT IT02799690223 — Italy