Unfair ("we", "us") is operated by Unfair, Denmark. This policy explains what data we process when you use Unfair at unfair.app and app.unfair.app, why, and what rights you have.
Contact: privacy@unfair.app
What Unfair does
Unfair connects to your Gmail account (with your explicit consent) to organize your sales inbox: it triages incoming email into labels, and prepares reply drafts in your drafts folder. Unfair never sends email on your behalf. The software contains no code path that can send email — drafts wait in your drafts folder until you review and send them yourself.
Google user data
This section describes our handling of data obtained through Google APIs, which is governed by the Google API Services User Data Policy, including its Limited Use requirements.
What we access
With the gmail.modify permission you grant at connection time, Unfair:
- Reads incoming email in the connected mailbox (message content, headers, thread context) and, once at connection, a sample of your sent messages.
- Applies labels (e.g.
Unfair/Sales) to organize your inbox. - Creates drafts in your drafts folder.
What we use it for
| Data | Purpose |
|---|---|
| Incoming message content | Classifying the email (sales / action needed / newsletter / noise) and, for sales threads, generating a reply draft |
| Sent-mail sample (at connection) | Building your personal style profile (greeting, sign-off, tone) so drafts sound like you — visible and editable in your account |
| Draft vs. what you actually sent | Improving your own style profile over time |
| Your own replies on a thread that belongs to a sales conversation Unfair already tracks, or that holds a draft Unfair wrote | Remembering what you promised (for example a quote by Friday) and whether you have replied, so later drafts keep your promises; shown and editable on the lead's page |
Limited Use commitments
Unfair's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Gmail data to provide and improve the user-facing features described above — never for advertising, market research, or profiling unrelated to the product.
- We do not sell Gmail data, and we do not transfer it to third parties except as necessary to provide the service (see subprocessors below), for security, or to comply with law.
- Humans do not read your email content, except (a) with your explicit consent for a specific support case, (b) for security/abuse investigation, or (c) where required by law.
- We do not use Gmail data to train or improve generalized artificial intelligence or machine-learning models. Email content is sent to our AI provider (Microsoft Azure OpenAI Service) solely to produce classifications and drafts for you at request time; Azure OpenAI contractually does not use this data for model training. Your style profile is a configuration used only for your own drafts — it is not a trained model and is not shared.
Storage and retention of Gmail data
- We do not store your mailbox. Email content is processed transiently to classify and draft, plus a short-lived processing cache (up to 7 days) to avoid re-processing the same thread.
- Draft records (what Unfair drafted, and — to improve your profile — a snapshot of what was ultimately sent from a drafted thread) are retained while your account is active.
- Analytics and error logs are stored anonymized: thread identifiers are hashed; email addresses, phone numbers, URLs, and company names are stripped or replaced with placeholders before storage.
- OAuth tokens are encrypted (AES-256) with keys held in Azure Key Vault.
Disconnecting
Disconnect your mailbox at any time in the app, or revoke Unfair's access at myaccount.google.com/permissions. On disconnect we stop all processing, destroy your OAuth tokens, and stop the Gmail watch. On workspace deletion, associated data is deleted within [30] days, except minimal records we must keep (e.g. invoices, trial-abuse prevention records).
Other data we process
- Account data: name, email, Google account identifier, workspace membership, role.
- Workspace data: company profile you provide (product, pricing, tone).
- Usage data: counts of AI actions (drafts created), feature usage, connection health. Used for billing/trial enforcement and product improvement.
- Billing data: handled by Stripe; we never see full card numbers.
- Transactional email: sent via Azure Communication Services (invites, disconnect alerts).
Legal bases (GDPR)
Performance of contract (providing the service), legitimate interest (security, abuse prevention, product analytics on anonymized data), consent (Gmail access itself — revocable at any time), and legal obligation (accounting records).
Subprocessors
| Provider | Role | Location |
|---|---|---|
| Microsoft Azure | Hosting, database, AI processing (Azure OpenAI), secrets | EU region: Sweden Central |
| OAuth, Gmail API, Pub/Sub notifications | Per your Google account | |
| Stripe | Payments | EU/US (SCCs) |
| Azure Communication Services | Transactional email | EU |
Your rights
Access, rectification, erasure, restriction, portability, objection — email privacy@unfair.app. You can complain to your supervisory authority (in Denmark: Datatilsynet).
Data residency and transfers
Primary processing and storage in Sweden Central. Where a subprocessor processes data outside the EU/EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.
Security
Managed identities (no shared credentials), AES-256 token encryption with Key Vault-held keys, tenant isolation with row-level security, TLS in transit, PII stripping before analytics storage, least-privilege access. See our Security page for detail.
Changes
We will notify workspace admins by email of material changes at least 14 days before they take effect.