Privacy Policy

1. Who controls your data

EveryUnitKnown is the controller of the personal data it processes to operate the early-access waitlist, accounts, the Service, support, and Service security. The operator and address for legal notices are identified in the Terms of Service. Privacy questions and requests may be sent to support [at] everyunitknown.com.

For the inventory records and other content you enter into the Service ("Customer Data"), EveryUnitKnown acts as a processor on behalf of you or your organization, which is the controller of any personal data it contains. If your Customer Data includes personal data about your own customers, staff, or suppliers, you are responsible for having a lawful basis to enter it and for informing those people where required.

2. Data we collect

EveryUnitKnown does not collect or store payment-card numbers or payment-account credentials: they are entered directly with the payment provider.

3. How we use data and our legal bases

• Operate the early-access waitlist and contact you when a workspace is available.
• Create and secure accounts, authenticate users, and provide the Service.
• Host and process Customer Data on your instructions so the Service works.
• Maintain account, security, and activity records.
• Take payment for paid plans, calculate tax, and handle invoices, refunds, and billing questions.
• Prevent fraud and abuse, and protect the Service and its users.
• Send verification, password-reset, security, and service messages.
• Answer support, privacy, and legal requests.
• Comply with legal obligations and establish, exercise, or defend legal claims.

Where the GDPR or a similar law applies, our legal bases are performance of a contract or steps requested before entering a contract, compliance with legal obligations, our legitimate interests in operating, securing, and improving the Service, and consent where specifically requested. You may withdraw consent at any time without affecting processing already performed. For Customer Data we process as a processor, the legal basis is determined by you as the controller.

EveryUnitKnown does not use personal data for advertising, does not sell personal data, and does not use advertising or cross-site tracking technologies.

4. Cookies and similar technologies

• session_id keeps you signed in and expires with the selected session duration.
• Short-lived sign-in cookies preserve OAuth state and the requested return page during a Google sign-in and normally expire within a few minutes.
• Theme cookies remember your light or dark preference and colour palette between visits.

These cookies are essential to signing in and to keeping the Service working, so the Service does not currently show a cookie-consent banner. EveryUnitKnown does not use advertising or cross-site tracking cookies. If we later add non-essential technologies that require consent, we will update this Policy and provide consent controls where required.

5. When we share data

We disclose only the data reasonably necessary for the relevant purpose to:

• Google, when you choose Google sign-in, to authenticate you.
• Resend (Plus Five Five, Inc.), to deliver transactional email such as verification, password-reset, and security messages.
• Google, through the ML Kit barcode-scanning library in the Android app, which sends Google device information (such as manufacturer, model, and OS version), the app package name and version, scanner performance metrics, and scanner settings such as image format and resolution. It does not receive camera images or your inventory.
• Our payment provider, an authorized reseller acting as merchant of record, to process payments, calculate and collect tax, and issue invoices and refunds. It receives the account email, the billing country and postal code, and the order, and collects card details itself.
• Hosting, database, security, and technical service providers that operate the Service infrastructure on our behalf and under contract.
• Authorities, courts, professional advisers, or other parties where required by law or reasonably necessary to protect rights, users, or the Service.

We do not make Customer Data or account data public through the normal Service interface. Where a provider processes personal data on our behalf, it does so under a contract that limits it to our instructions. The payment provider is the seller of record for the purchase and handles the payment data it collects as an independent controller, under its own privacy notice.

6. International transfers

EveryUnitKnown and its providers may process data outside your country, including outside the European Economic Area, the United Kingdom, or Switzerland. Where required, we use recognized safeguards such as adequacy decisions, standard contractual clauses, or another lawful transfer mechanism.

7. Retention

• When you delete your account, your email address, name, and sign-in data are erased at once. Records you created in a workspace that other members keep stay there, shown as created by a deleted user, and a reason for leaving you chose to give is kept.
• Data kept only on your phone by the mobile app stays there until you delete it or the app.
• Waitlist email addresses are kept until we invite you or you ask us to delete the address, after which we remove it.
• Account and profile data is generally kept while the account is active and for a reasonable period afterward to complete deletion, resolve disputes, and prevent abuse.
• Customer Data is retained while the account uses the Service and is deleted or anonymized within a reasonable period after account closure, unless the law requires longer.
• Billing data and payment records are kept for as long as tax and accounting law requires, which can outlast the account.
• Security and operational logs are kept for limited periods appropriate to security, diagnostics, and legal claims.
• Temporary authentication data expires after its security purpose ends, and backups are removed through normal rotation unless preservation is required.

We may retain anonymized or aggregated information that no longer identifies you.

8. Your rights

Depending on your location, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and may complain to a competent data-protection authority. To exercise a right over data we control, email support [at] everyunitknown.com. Where a request concerns Customer Data we process on behalf of your organization, we will refer you to, or act on the instructions of, that organization as the controller. We may request information reasonably needed to verify your identity.

You can delete your account yourself, on the web or in the mobile app. The steps, and what is deleted and kept, are on the account deletion page.

Some data cannot be deleted immediately where retention is required for security, legal claims, or legal obligations. EveryUnitKnown does not sell personal data or share it for cross-context behavioral advertising as those terms are defined by applicable US state privacy laws.

9. Security

We use reasonable technical and organizational safeguards designed to protect personal data, including access controls, encrypted transport, hashed passwords, and HttpOnly or signed cookies where appropriate. No online service can guarantee absolute security.

We maintain procedures to detect and respond to security incidents. If a personal-data breach occurs, we will notify the competent supervisory authority and affected individuals where and within the time the law requires.

10. Children

The Service is intended for business use by adults who are at least 18 years old. We do not knowingly collect personal data from children. Contact support [at] everyunitknown.com if you believe a child provided personal data.

11. Changes and contact

We may update this Privacy Policy when the Service, our providers, or legal requirements change. We will post the updated version with a new effective date and provide additional notice where required by law. Privacy questions and requests may be sent to support [at] everyunitknown.com.