Privacy policy.

Who is responsible

Unblo, Inc. operates the service. Our correspondence address is 2810 North Church Street, STE 89705, Wilmington, DE 19802, United States. Antoni Gruca is our privacy contact at contact@unblo.com. Our team primarily operates in the United States and the European Union.

We are the controller of personal information used for our website, business communications, account administration, and our own product analytics: we decide why and how it is used. When we process personal information in customer materials or test environments on a customer's behalf, we act as that customer's processor. The customer is responsible for its instructions and the legal basis for supplying that information. Customer processing instructions belong in the service agreement and any applicable data processing agreement; this notice does not replace them.

Information we handle

Relevant public website content may also become test preparation material when we research a customer's product. Customer-configured tools can supply information from systems the customer authorizes us to query.

Google Drive files. Existing Drive imports may include a file's name, type, and contents, together with a stored copy and extracted text. The current app does not offer Google account sign-in or a connected Drive sync feature. Changing access to the original file does not remove a copy already imported into Unblo.

We need contact details to answer a request, account information to authenticate users, and relevant test materials to perform a test. Without them, the corresponding feature may be unavailable. We do not currently collect payment-card details, offer social login, or request your device's precise location.

What we use it for

We use information to answer requests, arrange tests and calls, manage accounts, run tests, prepare and explain reports, provide support, maintain security, and investigate failures. We also use business contact details for relevant prospect outreach. You can stop that outreach by replying to a message or emailing contact@unblo.com. We may still send messages needed to handle your request or provide your service.

For information we handle as controller, our legal bases under EU and UK data protection law are:

Submitting a test request does not provide consent for analytics or marketing where separate consent is required. Customer test content is processed under the customer's instructions; the table above does not supply the customer's legal basis.

AI processing and product improvement

AI models receive relevant instructions, source material, browser content, screenshots, and results to prepare tests, choose browser actions, and evaluate what happened. Outputs can be inaccurate and need human review. Unblo evaluates software; we do not use these outputs to make hiring, credit, or similarly significant decisions about people.

Model training. We do not train or fine-tune models on customer material. We use the paid Gemini Developer API. Google's paid-service terms say it does not use API prompts and responses to improve its products; limited logging and access for abuse prevention, security, and legal requirements can still occur. See Google's Gemini API terms.

Evaluation examples. We retain customer examples for internal evaluation and prompt development. This is separate from model training. Examples can include test instructions, outputs, and evidence. Any use of identifiable or confidential customer material for this purpose needs to fit the customer's instructions and permissions; this policy does not itself obtain that permission. Contact us to discuss or object to this use of your material.

We also use anonymous, aggregated statistics to understand and improve the product. We do not currently benchmark identifiable customer results against other customers. Public examples, customer quotes, demos, and case studies using customer material require that customer's agreement.

We also use OpenRouter to access additional AI models. The selected upstream provider receives the material needed for that model call. Our OpenRouter account uses zero data retention routing; this concerns eligible model inputs and outputs, not every usage record or copy Unblo keeps. Ask us which model routes apply to your tests. Provider settings and terms govern their handling; we do not promise that all providers hold no data.

Human access and customer data

Authorized Unblo personnel, including founders, employees, and contractors, may access customer material, including test credentials, as needed to provide and operate the service. Personnel with access are required to protect its confidentiality and use it only for their assigned responsibilities. Access may be needed for setup, walkthroughs, support, troubleshooting, and the evaluation work described above, subject to the customer's instructions and permissions. Service providers also process information as described in section 7.

Use dedicated test accounts and synthetic data where possible. The service is not intended for sensitive personal information, such as health records, payment details, identity documents, or information about children. Uploaded files and tested pages can nevertheless contain it; the service does not automatically detect or remove every sensitive item. Only provide information and access you are authorized to share, and discuss any sensitive-data requirements with us before a test.

Cookies, analytics, and your choice

To read our research report, you can request an access link by email or use a password or invitation supplied by us. We send email requests through Resend to our mailbox; requesting the report does not sign you up for a newsletter. A necessary cookie remembers report access for 30 days and contains no email address. Participant invitations let anyone holding the link access the report.

The app uses a sign-in cookie. The website may temporarily keep an email address in your browser to carry it from the first request step to the next. We also remember your analytics choice. These functions are separate from analytics and session replay.

Where configured, PostHog helps us understand navigation and usability through analytics and session replay. A replay reconstructs activity in the interface. It is separate from the browser recordings created as evidence during a customer test.

We ask for one explicit analytics choice covering unblo.com and the Unblo app in the same browser. Analytics and session replay start only after you accept.

Declining does not prevent you from requesting a test or using the service. Your choice is remembered for up to six months; different browsers or devices may need their own choice.

The website measures page activity. On the main landing page and the research report pages, session replay includes page text, links, and images so we can understand how visitors use them. This includes the full research report opened with an access link or password, including the names, quotes, and charts displayed in that report. Form values, including email addresses and passwords you enter, remain masked. Video, audio, browser frames, and areas marked private remain blocked.

App replay can be associated with your internal member identifier. In the app, replay remains configured to mask text and form values and to block embedded images, video, audio, and browser frames. We do not need passwords or customer documents for analytics.

Use Analytics settings in the website footer or app to change your choice at any time. Declining there stops future analytics and session replay collection; it does not by itself delete earlier records. You can request deletion by email. Global Privacy Control or Do Not Track signals disable analytics and session replay in the browser where the signal is present.

Providers and other recipients

The following services handle information according to the features you use. A listed storage region does not mean every support operation, network request, or related service stays there.

Agreement signing may use DocuSign when we send you an agreement. It handles the signer's business contact details, document, signature, and acceptance record. Customer-selected integrations receive information needed to carry out the customer's instructions.

Sharing you choose. Authorized users can share app reports and test reviews with selected people or anyone holding a link. Recipients can see the information included in that shared view. Revoking access cannot retrieve copies they already downloaded or otherwise retained.

We may disclose information where necessary to comply with law, protect people or legal rights, or respond to misuse. If a merger, acquisition, or transfer of our business occurs, relevant information may pass to the parties involved, subject to applicable law and confidentiality protections. We provide any notice required for that change. We do not sell personal information or share it for cross-context behavioral advertising.

International processing

Unblo does not offer EU-only processing. Information can be stored, processed, or accessed in the United States, France, Poland, and other countries where our providers operate. Local privacy protections may differ from those in your country.

Transfers subject to EEA, UK, or Swiss data protection rules require an applicable legal transfer mechanism. Depending on the recipient and service, this can include an adequacy decision or approved contractual safeguards with any required supplementary measures. A provider's location alone does not establish the applicable safeguard. Contact contact@unblo.com for details of the arrangements relevant to your service and how to obtain a copy of applicable safeguards.

Keeping and deleting information

We keep account information and customer test materials while the account remains open and the information is needed for the service, unless you request deletion earlier. This includes source files, instructions, credentials, test evidence, reports, and retained evaluation examples. Closing an account or requesting deletion starts a review of the data held for that relationship; it is not an automatic guarantee that every copy disappears immediately.

For information that is not tied to an account, and for copies held by providers, these criteria apply:

Moving an item to the Bin or removing a project does not establish complete erasure of related evidence. Email contact@unblo.com for account closure or deletion. We coordinate requests across the systems involved and explain any applicable limits or required retention.

Security

Account passwords are stored as salted hashes. Saved test credentials are encrypted. Project permissions restrict application access, and private source files and evidence use time-limited access links. These safeguards are designed to protect personal information against unauthorized access, loss, and misuse; no online service can guarantee complete security. Report security concerns to contact@unblo.com.

Your rights and complaints

Depending on the law that applies, you may have rights to access, correct, delete, or receive a portable copy of your personal information; restrict or object to processing; and withdraw consent. You can object to direct marketing at any time. Withdrawing consent does not change the lawfulness of processing before withdrawal. Rights can be subject to legal conditions and exceptions.

Send requests and complaints to contact@unblo.com. We may ask for proportionate information to check your identity or an authorized agent's authority. We will not discriminate against you for exercising applicable rights.

Our team aims to respond within 30 days and must meet any shorter applicable deadline. Under EU and UK data protection rules, the usual rights-request deadline is one month; if a lawful extension is needed, we explain it within that period. A response deadline is not a promise that every deletion across every provider will be completed within 30 days.

If your information appears in a customer's test, that customer usually handles the request. You may contact us so we can help identify the responsible customer and assist it. Removing an individual member does not necessarily remove records that the customer still lawfully needs.

Where applicable law provides an appeal, email us with the original request and the reasons for your appeal. We will review it and explain the outcome and any further complaint route. For UK data protection complaints, we acknowledge receipt within 30 days, investigate, and explain the outcome without undue delay.

You may also complain to your local data protection authority, including an EEA supervisory authority, the UK ICO, or the Swiss FDPIC.

Age limits and changes

Account holders and research participants must be at least 18. Customer test environments can contain information about other people, including children; an adult user's account does not make that information appropriate to submit. Contact us if you believe a child's information has been provided so we can investigate and take appropriate action.

We update the date above when this policy changes. We notify affected users of material changes as required by law, including by email where appropriate, and obtain consent where required. New wording does not retroactively authorize a new use of information or override an existing agreement.