Legal
Privacy Policy
Last updated: 2026-10-11
We at Aryabhatta Labs are committed to maintaining the accuracy, confidentiality, and security of your personally identifiable information ("Personal Information"). As part of this commitment, our privacy policy governs our actions as they relate to the collection, use and disclosure of Personal Information. Our privacy policy is based upon the values set by the Canadian Standards Association's Model Code for the Protection of Personal Information and Canada's Personal Information Protection and Electronic Documents Act.
This policy covers Unveil (the app at app.unveilui.com and prototypes served from proto.unveilui.com) and this website.
What Unveil Collects
Account details
- Your name, email address, preferred language and time zone
- Your password, stored only as a salted argon2id hash
- Your role in your workspace (administrator or member)
Workspace content
- Prototype files your team uploads (HTML, styles, scripts, images and other assets)
- Comments, replies, drawings and annotations, and their edit history
- Walkthroughs: the steps recorded on a prototype (which element was clicked or changed, and in what order)
- Review decisions (accepted, rejected, reopened) and notifications
Security and activity records
- An append-only audit history of actions in your workspace (who did what, and when)
- IP addresses, used to rate-limit sign-in attempts and to investigate abuse
- Server logs containing request paths, status codes and timings. Query strings and feedback content are never logged.
Unveil does not use location data, advertising identifiers or third-party analytics, and does not track you across other websites.
Why We Collect It
- To provide the service: sign you in, show your team's prototypes, and keep feedback attached to the right page and element
- To keep workspaces secure: enforce roles, prevent account takeover, and keep an audit trail your administrators can rely on
- To support you: diagnose problems you report to us, with your consent as described in our Terms of Use
We do not sell your Personal Information or workspace content to any third party.
Third-Party Services & Data Sharing
We use the following service providers to deliver Unveil:
| Provider | Purpose | Data involved |
|---|---|---|
| Fly.io | Application hosting (Toronto, Canada region) and storage of uploaded prototype files | All workspace content and account details, encrypted at rest |
| Aiven | Managed PostgreSQL database | Account details, feedback, walkthroughs, audit history |
| Cloudflare | DNS, TLS and network protection in front of Unveil and this website | IP addresses and request metadata in transit |
| GitHub Pages | Hosting of this website (www.unveilui.com) | Request metadata when you visit this site |
| Formspree | Delivery of messages sent through our contact form | The name, email and message you submit |
We do not share your data with any other third parties without your explicit consent, except where required by law.
1. Introduction
We are responsible for maintaining and protecting the Personal Information under our control. We have designated an individual or individuals who is/are responsible for compliance with our privacy policy.
2. Identifying Purposes
We collect, use and disclose Personal Information to provide you with the product or service you have requested and to offer you additional products and services we believe you might be interested in. The purposes for which we collect Personal Information will be identified before or at the time we collect the information. In certain circumstances, the purposes for which information is collected may be clear, and consent may be implied, such as where your name and email address are provided when you are invited to a workspace.
3. Consent
Knowledge and consent are required for the collection, use or disclosure of Personal Information except where required or permitted by law. Providing us with your Personal Information is always your choice. However, your decision not to provide certain information may limit our ability to provide you with our products or services. We will not require you to consent to the collection, use, or disclosure of information as a condition to the supply of a product or service, except as required to be able to supply the product or service.
4. Limiting Collection
The Personal Information collected will be limited to those details necessary for the purposes identified by us. With your consent, we may collect Personal Information from you in person, over the telephone or by corresponding with you via mail, facsimile, or the Internet.
5. Limiting Use, Disclosure and Retention
Personal Information may only be used or disclosed for the purpose for which it was collected unless you have otherwise consented, or when it is required or permitted by law. Personal Information will only be retained for the period of time required to fulfill the purpose for which we collected it or as may be required by law.
Data Retention Policy
| Data | Retention |
|---|---|
| Account details | Until your account is removed from the workspace and an erasure request is processed, or the workspace is closed |
| Prototype files, comments, annotations and walkthroughs | Until deleted by your team, or until the workspace is closed. Deleted feedback can be restored by your team until it is purged. |
| Audit history | For the life of the workspace. When your personal data is erased, your name and email are removed from audit events and replaced with an anonymous identifier; the events themselves are kept so the workspace's history stays intact. |
| Sign-in sessions | Up to 24 hours (app) or until they expire; expired sessions are swept automatically |
| Server logs | Up to 30 days |
| Backups | Storage snapshots are kept for 5 days; database backups follow our provider's retention window. Erased data leaves backups as they expire. |
We may retain specific data beyond the stated retention periods if required by applicable law, regulation, or for the establishment, exercise, or defense of legal claims.
6. Accuracy
Personal Information will be maintained in as accurate, complete and up-to-date form as is necessary to fulfill the purposes for which it is to be used.
7. Safeguarding Customer Information
Personal Information will be protected by security safeguards that are appropriate to the sensitivity level of the information. We take all reasonable precautions to protect your Personal Information from any loss or unauthorized use, access or disclosure.
We have implemented an offline mechanism to restrict access to user data. Only specifically authorized individuals can access user data, and all such access is logged and auditable. This ensures accountability and limits exposure of sensitive information. See Security for how Unveil protects your workspace.
8. Openness
We will make information available to you about our policies and practices with respect to the management of your Personal Information.
9. Customer Access
Upon request, you will be informed of the existence, use and disclosure of your Personal Information, and will be given access to it. You may verify the accuracy and completeness of your Personal Information, and may request that it be amended, if appropriate. However, in certain circumstances permitted by law, we will not disclose certain information to you. For example, we may not disclose information relating to you if other individuals are referenced or if there are legal, security or commercial proprietary restrictions.
Your Privacy Rights
- Update your details: change your name, language and time zone in Unveil under Settings
- Access and export: ask us for a copy of your Personal Information in a machine-readable format
- Erasure: ask us to erase your Personal Information. Your workspace administrator can also deactivate your account at any time.
GDPR Rights (European Union Residents)
Under the General Data Protection Regulation, you have the right to access, rectify, erase and port your personal data, to object to or restrict its processing, and to withdraw consent at any time. To exercise these rights, contact us at [email protected].
CCPA Rights (California Residents)
Under the California Consumer Privacy Act, you have the right to know what we collect (the categories listed above), to request deletion, and not to be discriminated against for exercising your rights. We do NOT sell your personal information. To exercise these rights, contact us at [email protected].
10. Cookies
A cookie is a small computer file or piece of information that may be stored in your computer's hard drive when you visit our websites. Unveil uses only essential cookies: a sign-in session cookie on app.unveilui.com and a project session cookie on proto.unveilui.com. They are required for the service to work and are never used for advertising or tracking. This website sets no cookies of its own.
11. Other Websites
Our website may contain links to other third party sites that are not governed by this privacy policy. Although we endeavour to only link to sites with high privacy standards, our privacy policy will no longer apply once you leave our website. Additionally, we are not responsible for the privacy practices employed by third party websites. Therefore, we suggest that you examine the privacy statements of those sites to learn how your information may be collected, used, shared and disclosed. Prototypes uploaded to Unveil are created by your team, and may load content from other sites chosen by their authors.
12. Handling Customer Complaints and Suggestions
You may direct any questions or enquiries with respect to our privacy policy or our practices by contacting us at [email protected], through the Unveil contact form, or via the contact form on the Aryabhatta Labs website.