Privacy Policy

This Privacy Policy explains how Unified API Inc. (“UnifiedFlows”, “we”, “us”), the company behind Unified.to, collects, uses and shares information when you use the UnifiedFlows website at unifiedflows.com, the UnifiedFlows web application, API and MCP servers (together, the “Service”).

Information we collect

Account information

When you sign up we receive your name and email address. If you sign in with a third-party provider such as Google or Microsoft, we receive your basic profile from that provider; we never see your password for it. If you sign in with an emailed link, we use your email address to send it. We also store the workspaces you belong to, your role in each, and the teammates you invite.

Connected apps

To connect a SaaS app you authorize access with OAuth or an API key. Those credentials are held by the Unified.to platform, which we operate, and are used only to make the requests you set up. UnifiedFlows reads and writes data in your connected apps on your behalf; see Data from your connected apps below.

What you configure

The agents you build: their state graphs, prompts, model choices, tools, triggers, schedules and approval steps.

Activity logs

For each agent run we keep its steps, including the inputs, tool calls and model outputs of each step, so you can follow, replay and audit what the agent did. Tasks waiting for a person, and their answers, are kept with the run.

Billing information

Paid plans are billed through Stripe. We receive your subscription status and limited card details such as the brand and last four digits; we never see or store full card numbers.

Usage and technical data

Log data such as IP address, browser type, pages visited, API and MCP requests, timestamps and error reports, used to operate, secure and improve the Service.

Messages you send us

If you contact us through our contact form or by email, we keep your message and your reply address.

Data from your connected apps

When an agent runs, UnifiedFlows reads and writes data in your connected apps through MCP tools, and sends the data a step needs to the AI model you chose. Run steps are stored as described under Activity logs.

We do not sell data from your connected apps, use it for advertising, or use it to train machine-learning models.

How we use information

• To provide the Service: connect your apps and run the agents you build.
• To authenticate you, your teammates and the AI clients and applications you authorize.
• To process payments and manage your subscription.
• To respond to support requests and send service-related notices.
• To monitor, debug, secure and improve the Service, and to prevent abuse.
• To comply with legal obligations.

We do not sell your personal information.

AI clients and MCP

When you connect an AI client such as Claude, ChatGPT or Cursor to a UnifiedFlows MCP server, the client can use that server's tools with the permissions you approved. Whatever the tools return is sent to that client and then handled by its provider under the provider's own privacy policy. You can revoke a client's access at any time by disconnecting it in the client.

Agents you build run on the AI model you choose. The prompts, tool results and data an agent works with are sent to that model's provider, under its own terms. Choose a provider whose data handling fits your needs.

How we share information

We share information only:

• With the teammates in your workspace, according to their roles.
• With the apps and AI clients you connect, as needed to do what you ask.
• With service providers that host, operate and support the Service, such as cloud hosting, email delivery and payment processing, under contracts that limit their use of the data.
• When required by law, or to protect the rights, property or safety of our users or others.
• In connection with a merger, acquisition or sale of assets, subject to this policy.

Cookies and local storage

We use cookies and browser storage to keep you signed in, complete sign-ins started by AI clients, and remember preferences such as light or dark mode. We do not use advertising cookies.

Data retention

We keep account and configuration data while your account is active. When you delete a connection, agent or your account, we delete the associated data from active systems within 30 days, except where we must keep it to meet legal obligations, resolve disputes or enforce our agreements. Backups are overwritten on a rolling basis.

Security

Data is encrypted in transit using TLS. Access is scoped to your workspace and checked against your role on every request, and MCP access tokens are short-lived and bound to the server they were issued for. No system is perfectly secure, but we work to protect your information and will notify you of a breach as required by law.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to or restrict its processing. You can disconnect apps and delete most data directly in the app. For anything else, contact us or email hello@unified.to, and we will respond within 30 days.

International transfers

We are based in, and process data in, the United States and other countries where our service providers operate. Where required, we use appropriate safeguards such as standard contractual clauses.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, for material changes, notify you by email or in the app.

Contact us

Questions about this policy or your data? Use our contact form or email hello@unified.to.