Privacy Policy

unfolde is a product operated by Novara Systems Private Limited ("Novara Systems," "we," "us," or "our"), based in Bengaluru, Karnataka, India. For privacy questions or to exercise your rights under this policy, contact us at hello@unfolde.in.

2.1 Information you give us directly

When you create an unfolde account, we collect your name, work email address, organization name, role, and a password (stored in salted, hashed form). If you contact support, we collect the contents of your messages and any attachments you send.

2.2 Information we receive from Meta when you connect your ad account

unfolde uses Facebook Login for Business to authorize access to your ad account, and the Meta Marketing API. When you authorize the connection, you grant unfolde access to these five permissions:

• ads_management: Create, edit, and pause ad campaigns in your connected ad account, and read campaign performance data.
• pages_read_engagement: Read basic metadata of the Facebook Page you select, and the text of Page posts you choose to promote, so your ads can be created under that Page's identity and existing posts can be used as ad creative. We do not read comments, follower data, or audience information.
• pages_show_list: Retrieve the list of Facebook Pages you manage so you can select a Page for your ads.
• instagram_basic: Read your Instagram business account details to enable Instagram ad placements.
• business_management: Identify the Business Manager portfolio that owns your ad account, so we can confirm the correct Facebook Page for your ads and avoid publishing under another brand's identity.

unfolde requests three further permissions, in two groups, only for features that are switched on for your account. You see them on unfolde's own consent screen and on Meta's permission dialog before you approve anything, and a feature whose permission you have not granted stays off.

• instagram_manage_insights: Read insights for your connected Instagram professional account: its reach and views for the previous day, and the reach, saves, shares and views of each of its 25 most recent posts. Used for Pulse. We do not read comment text, direct messages, or who your followers are.
• leads_retrieval: Read the details of the leads your Instant Form ads collect, limited to the lead's ID, the form's ID, which ad, ad set and campaign it came from, and when it was created, plus the names of the form's questions. Used to count leads and cost per lead. We never request what people typed into the form (their names, emails or phone numbers).
• pages_manage_ads: Attach one of your existing Instant Forms to the ads you run, and place your Page on the ad set.

If you use Pulse, unfolde reads the posts on your connected Instagram professional account (each post's caption, link, and like and comment counts, and, where you have granted instagram_manage_insights, its reach, saves, shares and views), your account's follower and post totals, and its reach and views for the previous day, to show which posts are working and suggest what to post next. We do not read comment text, direct messages, or who your followers are. To write your content-strategy summary, unfolde sends an AI provider (Anthropic) your brand type, content pillars, posting cadence, and product names with the scores unfolde computed. It does not send your Instagram posts, captions, insights, or followers.

The access token Meta issues is encrypted at rest and stored in AWS Systems Manager Parameter Store as a KMS-encrypted SecureString. It is not stored in our application database.

We do not collect personal information about individuals who saw or interacted with your ads. Insights are retrieved in aggregate form as Meta provides them; we do not request user-level data, custom audience contents, or any data about people in your audience. The one place a record relates to a single person is Instant Form leads: we store a lead's ID and which ad it came from, which identifies that person's submission, but never what they typed into the form. Lead IDs are personal data and are handled as such: used only to measure your own ads, shown only to your workspace, kept for 90 days, and erased when you delete the brand or your account.

2.3 Information we receive from Shopify when you connect your store

If you connect a Shopify store, you authorize unfolde with a single permission, read_orders, and Shopify sends us order events as they happen (order created, updated or cancelled, and refunds). From each order we keep the order ID, its state and history, the gross and net amounts, the currency, the dates it was placed, delivered, returned or refunded, and, for each line item, the product ID, variant ID, quantity and unit price. We use this to attribute revenue and returns to your advertising and to report on it to you.

We do not store the customer's name, email address, phone number or address on order records. If an order event cannot be matched to an order, we keep a copy limited to a short fixed list of non-identifying fields (such as order ID, status, total and dates), not the customer details Shopify may have sent with it. Your customers' email addresses and phone numbers are read from your store, and only if you turn on conversion sharing with Meta, at the moment of sending; they are normalised and hashed before leaving unfolde and are never stored.

The access token Shopify issues is stored in AWS Systems Manager Parameter Store as a KMS-encrypted SecureString, not in our application database. We also keep a record linking your shop domain to your unfolde brand.

2.4 Information collected automatically

We collect standard product telemetry: pages you view, features you use, IP address, browser type, device type, operating system, language, time zone, and timestamps. We use cookies and similar technologies for session management, security, and product analytics.

2.5 Information from payment processors

If you purchase a paid plan, our payment processor (Razorpay) handles your payment details. We receive a token and limited transaction metadata (amount, currency, status, last four digits of the card). We do not store your full card number. If you subscribe through Shopify instead, Shopify Billing is the payment processor and Shopify collects and charges the payment; we receive the subscription's identifier and its status (approved, declined, cancelled), and no card details.

We use the information described above only for the following purposes:

• To provide the Service: authenticate you, connect to your Meta accounts, retrieve the data you've authorized, run analyses, and present insights, summaries, and recommendations.
• To communicate with you: respond to support requests, send service notices, and, only with your consent or where permitted, send product updates.
• To secure and improve the Service: detect and prevent fraud, abuse, and security incidents; debug; measure feature usage; and improve product quality.
• To compute aggregate, de-identified statistics: we may compute statistics across many customers to improve the Service. They are aggregate only: they contain no personal data, are never reported per brand, and do not identify any user, organization, or ad account. Instagram insights and Instant Form lead data are not included in them.
• To meet legal obligations: comply with applicable law, respond to lawful requests, and enforce our Terms.

We do not use the data we receive from Meta for advertising to you or anyone else, do not use it to build audiences, and do not use it for any purpose unrelated to delivering the Service to you.

Where applicable data protection law requires a legal basis, we rely on:

• Performance of a contract: to provide the Service you signed up for.
• Legitimate interests: to secure the Service, prevent abuse, improve the product, and produce de-identified analytics, in ways that do not override your rights.
• Consent: for optional communications and any cookies that require it.
• Legal obligation: where we must process data to comply with law.

We do not sell your personal information, and we do not share data obtained from Meta with third parties for their independent use. We share information only as follows:

• Service providers (sub-processors) that help us run unfolde, under written contracts requiring them to protect the data and use it only on our instructions. These include: Amazon Web Services (cloud hosting), Amazon DynamoDB and Amazon S3 (database and storage), Resend (email delivery), PostHog (product analytics, hosted in the United States; used only if you accept the cookie notice, with no session recording), Razorpay and, for subscriptions taken through Shopify, Shopify Billing (payment processing), Anthropic (AI model provider — receives your campaign and creative content, such as ad copy and creative text, and campaign or business performance data, to generate summaries and recommendations; data sent to Anthropic is not used by them to train their models), and OpenAI (AI model provider — receives the same categories of campaign and creative content, plus audio, image, and video from creatives you upload for transcription and analysis, to generate campaign plans, summaries, and recommendations; data sent to OpenAI is not used by them to train their models). For an up-to-date list, contact us at hello@unfolde.in.
• Within your organization: other authorized users of your unfolde workspace can see the ad accounts and insights you have shared with the workspace.
• Legal and safety: to comply with a valid legal request, to enforce our Terms, or to protect the rights, property, or safety of Novara Systems, our users, or others.
• Business transfers: if Novara Systems is involved in a merger, acquisition, or sale of assets, your information may be transferred, subject to the protections of this policy.

• Account information: kept while your account is active, and deleted within 30 days after account closure.
• Raw Meta Marketing API data (campaign data, insights): retained for up to 13 months, matching Meta's own Insights API availability window. Older raw data is automatically purged.
• Derived insights: kept as long as your account is active, in a form associated with your workspace but de-identified at the individual level.
• Instagram insights (Pulse): kept for 90 days after they were last refreshed, then deleted automatically.
• Instant Form lead details (lead ID, form ID, ad, ad set and campaign IDs, creation time; never answers): kept for 90 days from when the lead was created, then deleted automatically.
• Shopify order records: kept while your brand is connected to Shopify and deleted when your store is erased after you uninstall the app (see below), or when you delete the brand or your account.
• Unmatched Shopify order events (the limited copy described in section 2.3): kept for 90 days, then deleted automatically.
• Logs and telemetry: kept for up to 90 days for security and debugging, then deleted or aggregated.
• Backups: encrypted backups may persist for up to 35 days beyond the deletion of the underlying data, after which they are overwritten.

You can disconnect your Meta account at any time from within unfolde's settings or from your Meta account settings (Settings → Business Integrations on Facebook). When you disconnect, we stop retrieving data immediately. Disconnecting does not by itself delete data we have already retrieved: that is removed on the schedule above, when you delete a brand or your account (see below), or if you remove unfolde from your Facebook account and Meta notifies us, in which case we delete the data associated with your Meta account.

If you uninstall unfolde from your Shopify store, Shopify notifies us and we delete the stored Shopify access token and mark the connection as revoked straight away. Shopify then sends a store-erasure request about 48 hours later; when it arrives we delete your Shopify order records and unmatched order events and remove the shop-domain link, and we complete this within the 30 days Shopify requires. We also act on Shopify's customer data requests (we email the store owner the order records we hold for the requested orders, so you can answer your customer) and customer erasure requests (we store no customer name, email, phone or address on order records, so there is nothing further to delete; we record that the request was received). We keep a record of each request (request ID, shop domain, status, timestamps) with no customer identifiers.

You can request deletion of your entire unfolde account by emailing hello@unfolde.in. We will complete deletion within 30 days and confirm in writing.

In line with Meta's Platform Terms, we honour Data Deletion Requests initiated from Meta. Our deletion callback URL is https://api.unfolde.in/user/meta/data-deletion.

We protect your information with administrative, technical, and physical safeguards proportionate to its sensitivity. These include encryption in transit (TLS 1.2+), encryption at rest for databases and backups, role-based access control, audit logging, secret management, regular dependency and vulnerability scanning, and periodic third-party security testing. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you and the relevant authorities as required by law.

Novara Systems is operated from India. Our infrastructure runs on Amazon Web Services in the United States (us-east-1). Some sub-processors may process data in other countries, including the United States and the European Union. Where we transfer personal data internationally, we rely on appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms.

unfolde uses a small number of cookies and similar technologies:

• Strictly necessary: to keep you logged in and to protect against CSRF and other attacks. These cannot be disabled.

• Analytics and advertising measurement (only if you accept): the Meta Pixel, which tells Meta that a visit or a button click happened so we can measure our own ads, and PostHog, which records which pages and buttons are used. Both load only after you choose Accept on the cookie notice; if you decline, neither loads. For a button click, our server also sends Meta the event, your IP address, your browser details and any Meta browser identifiers you already have. Change your cookie choice at any time.

We do not use cookies to show you ads on other sites.

Depending on where you live, you may have rights to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your information (subject to limited exceptions);
• Object to or restrict certain processing;
• Receive your information in a structured, machine-readable format (portability);
• Withdraw consent for processing that relies on consent, at any time;
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@unfolde.in. We will respond within the time required by applicable law (typically 30 days). We may need to verify your identity before acting on a request.

unfolde is not directed to, and we do not knowingly collect information from, anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

unfolde produces recommendations and analyses generated in part by automated systems, including machine learning and large language models. These outputs are decision-support, not automated decisions made about you. A human (you) decides what to do with the recommendations.

We may update this policy from time to time. If we make material changes, we will notify you in advance, for example by email or an in-product notice, and update the "Last updated" date above. Continued use of the Service after the effective date constitutes acceptance.

Our Grievance Officer handles complaints about how we process personal data:

Harshit Chandra, Director
Novara Systems Private Limited
CIN U62099KA2026PTC221734
2F, J-Block, Phase-2, Kogilu Main Road, Yelahanka, Bangalore North, Bengaluru 560064, Karnataka
hello@unfolde.in

Where we process personal data on behalf of a brand, the Data Processing Agreement sets out how we do so.

For any privacy question, request, or complaint:

Novara Systems Private Limited
(operator of unfolde)
Bengaluru, Karnataka, India
hello@unfolde.in