Privacy Policy

unfolde is a product operated by Novara Systems Private Limited ("Novara Systems," "we," "us," or "our"), based in Bengaluru, Karnataka, India. For privacy questions or to exercise your rights under this policy, contact us at hello@unfolde.in.

2.1 Information you give us directly

When you create an unfolde account, we collect your name, work email address, organization name, role, and a password (stored in salted, hashed form). If you contact support, we collect the contents of your messages and any attachments you send.

2.2 Information we receive from Meta when you connect your ad account

unfolde uses Facebook Login for Business to authorize access to your ad account, and the Meta Marketing API. When you authorize the connection, you grant unfolde access to exactly these five permissions:

• ads_management: Create, edit, and pause ad campaigns in your connected ad account, and read campaign performance data.
• pages_read_engagement: Read basic metadata of the Facebook Page you select, and the text of Page posts you choose to promote, so your ads can be created under that Page's identity and existing posts can be used as ad creative. We do not read comments, follower data, or audience information.
• pages_show_list: Retrieve the list of Facebook Pages you manage so you can select a Page for your ads.
• instagram_basic: Read your Instagram business account details to enable Instagram ad placements.
• business_management: Identify the Business Manager portfolio that owns your ad account, so we can confirm the correct Facebook Page for your ads and avoid publishing under another brand's identity.

The access token Meta issues is encrypted at rest and stored in AWS Systems Manager Parameter Store as a KMS-encrypted SecureString. It is not stored in our application database.

We do not collect personal information about individuals who saw or interacted with your ads. Insights are retrieved in aggregate form as Meta provides them; we do not request user-level data, custom audience contents, or any data about people in your audience.

2.3 Information collected automatically

We collect standard product telemetry: pages you view, features you use, IP address, browser type, device type, operating system, language, time zone, and timestamps. We use cookies and similar technologies for session management, security, and product analytics.

2.4 Information from payment processors

If you purchase a paid plan, our payment processor (Razorpay) handles your payment details. We receive a token and limited transaction metadata (amount, currency, status, last four digits of the card). We do not store your full card number.

We use the information described above only for the following purposes:

• To provide the Service: authenticate you, connect to your Meta accounts, retrieve the data you've authorized, run analyses, and present insights, summaries, and recommendations.
• To communicate with you: respond to support requests, send service notices, and, only with your consent or where permitted, send product updates.
• To secure and improve the Service: detect and prevent fraud, abuse, and security incidents; debug; measure feature usage; and improve product quality.
• To produce de-identified, aggregated insights: we may combine data across customers, stripped of identifiers, to produce benchmarks, train and evaluate our internal models, and improve the Service. These outputs do not identify any user, organization, or ad account.
• To meet legal obligations: comply with applicable law, respond to lawful requests, and enforce our Terms.

We do not use the data we receive from Meta for advertising to you or anyone else, do not use it to build audiences, and do not use it for any purpose unrelated to delivering the Service to you.

Where applicable data protection law requires a legal basis, we rely on:

• Performance of a contract: to provide the Service you signed up for.
• Legitimate interests: to secure the Service, prevent abuse, improve the product, and produce de-identified analytics, in ways that do not override your rights.
• Consent: for optional communications and any cookies that require it.
• Legal obligation: where we must process data to comply with law.

We do not sell your personal information, and we do not share data obtained from Meta with third parties for their independent use. We share information only as follows:

• Service providers (sub-processors) that help us run unfolde, under written contracts requiring them to protect the data and use it only on our instructions. These include: Amazon Web Services (cloud hosting), Amazon DynamoDB and Amazon S3 (database and storage), Resend (email delivery), Razorpay (payment processing), Anthropic (AI model provider — receives your campaign and creative content, such as ad copy and creative text, and campaign or business performance data, to generate summaries and recommendations; data sent to Anthropic is not used by them to train their models), and OpenAI (AI model provider — receives the same categories of campaign and creative content, plus audio, image, and video from creatives you upload for transcription and analysis, to generate campaign plans, summaries, and recommendations; data sent to OpenAI is not used by them to train their models). For an up-to-date list, contact us at hello@unfolde.in.
• Within your organization: other authorized users of your unfolde workspace can see the ad accounts and insights you have shared with the workspace.
• Legal and safety: to comply with a valid legal request, to enforce our Terms, or to protect the rights, property, or safety of Novara Systems, our users, or others.
• Business transfers: if Novara Systems is involved in a merger, acquisition, or sale of assets, your information may be transferred, subject to the protections of this policy.

• Account information: kept while your account is active, and deleted within 30 days after account closure.
• Raw Meta Marketing API data (campaign data, insights): retained for up to 13 months, matching Meta's own Insights API availability window. Older raw data is automatically purged.
• Derived insights: kept as long as your account is active, in a form associated with your workspace but de-identified at the individual level.
• Logs and telemetry: kept for up to 90 days for security and debugging, then deleted or aggregated.
• Backups: encrypted backups may persist for up to 35 days beyond the deletion of the underlying data, after which they are overwritten.

You can disconnect your Meta account at any time from within unfolde's settings or from your Meta account settings (Settings → Business Integrations on Facebook). When you disconnect, we stop retrieving data immediately and delete previously retrieved Meta data within 30 days.

You can request deletion of your entire unfolde account by emailing hello@unfolde.in. We will complete deletion within 30 days and confirm in writing.

In line with Meta's Platform Terms, we honour Data Deletion Requests initiated from Meta. Our deletion callback URL is https://api.unfolde.in/user/meta/data-deletion.

We protect your information with administrative, technical, and physical safeguards proportionate to its sensitivity. These include encryption in transit (TLS 1.2+), encryption at rest for databases and backups, role-based access control, multi-factor authentication for our staff, audit logging, secret management, regular dependency and vulnerability scanning, and periodic third-party security testing. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you and the relevant authorities as required by law.

Novara Systems is operated from India. Our infrastructure runs on Amazon Web Services in the United States (us-east-1). Some sub-processors may process data in other countries, including the United States and the European Union. Where we transfer personal data internationally, we rely on appropriate safeguards, such as Standard Contractual Clauses or equivalent mechanisms.

unfolde uses a small number of cookies and similar technologies:

• Strictly necessary: to keep you logged in and to protect against CSRF and other attacks. These cannot be disabled.

We do not use advertising or cross-site tracking cookies.

Depending on where you live, you may have rights to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your information (subject to limited exceptions);
• Object to or restrict certain processing;
• Receive your information in a structured, machine-readable format (portability);
• Withdraw consent for processing that relies on consent, at any time;
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@unfolde.in. We will respond within the time required by applicable law (typically 30 days). We may need to verify your identity before acting on a request.

unfolde is not directed to, and we do not knowingly collect information from, anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

unfolde produces recommendations and analyses generated in part by automated systems, including machine learning and large language models. These outputs are decision-support, not automated decisions made about you. A human (you) decides what to do with the recommendations.

We may update this policy from time to time. If we make material changes, we will notify you in advance, for example by email or an in-product notice, and update the "Last updated" date above. Continued use of the Service after the effective date constitutes acceptance.

For any privacy question, request, or complaint:

Novara Systems Private Limited
(operator of unfolde)
Bengaluru, Karnataka, India
hello@unfolde.in