THE SMALL PRINT

Privacy

Last updated: [launch date]

Draft for legal review — not yet in force. Replace the bracketed details before launch.

UnveilPage lets people (“customers”) upload web pages and send private links to their own clients and guests (“visitors”). This page explains what we store about each group, why, and for how long.

Who we are

UnveilPage is operated by [legal entity name, registered address]. For anything privacy-related, write to privacy@unveilpage.com.

Customers

• Account: your email address, your name, workspace names, and who is a member of which workspace.
• Sign-in: you sign in with your Google account (we receive your name and email address from Google), or with a one-time code we email you. We store only a hash of any code and of your session, and we have no passwords to leak.
• Connected AI apps: if you connect Claude, ChatGPT or another MCP client, we store the app’s name, when you approved it, and hashed access tokens. You can disconnect an app at any time.
• Content: the files you upload, the links you create, and the names and email addresses you add for the people you share with.
• Billing: payments are handled by Stripe. We store your Stripe customer and subscription IDs and your plan; we never see or store card numbers.

Visitors to shared pages

When someone opens a link, the customer who sent it can see that it was opened. For each visit we record:

• the time, the file opened, the approximate location (country and city, from our network provider), the device type and the referring site;
• a visitor identifier made by hashing the IP address and browser with a secret salt, so repeat visits can be grouped. We never store the raw IP address.
• on paid plans, how the page was read: active reading time, how far down it was scrolled, time spent per section heading, and which links were clicked;
• any comments, names and approval decisions a visitor chooses to submit.

We do not use cookies or identifiers to track visitors across different customers or websites, we do not build advertising profiles, and we never sell data. A short-lived cookie is set only when a customer previews their own page, and where the browser allows it the comment box remembers the name a visitor typed, in that visitor’s own browser only.

Why we use it

To run the service you signed up for (contract), to keep it secure and stop abuse such as phishing (legitimate interests), and to meet legal obligations such as tax records. Customers are the controllers of visitor data on their pages; UnveilPage processes it on their behalf. [Link to Data Processing Addendum.]

Who we share it with

• Cloudflare — hosting, storage, database and network (where files and records live).
• Stripe — payments and invoices.
• Resend — sending sign-in codes, invites and notification emails.
• Google — signing you in, if you choose Sign in with Google.

We may disclose information if required by law, or to deal with a report of fraud or abuse.

How long we keep it

• Visit records, comments and approvals are deleted when the customer deletes the link or the page.
• Sign-in codes expire after 10 minutes; sessions after 30 days of inactivity.
• Account data is deleted within [30] days of a workspace being closed, except records we must keep for tax and accounting.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how it is used. If you opened a page someone sent you, contact them first — they control that page — or write to us and we will pass the request on. You can also complain to your local data-protection authority.

Changes

If we change this policy in a meaningful way we will email workspace owners before it takes effect.