Privacy Policy
This Privacy Notice for Sador Zekarias (doing business as Unpack) ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share your personal information when you use our services, including when you download and use our mobile application Unpack, or engage with us in other related ways. Questions? Contact us at support@letsunpack.app.
Table of Contents
- What Information Do We Collect?
- How Do We Process Your Information?
- What Legal Bases Do We Rely On?
- When and With Whom Do We Share?
- Do We Offer AI-Based Products?
- How Do We Handle Social Logins?
- Is Your Information Transferred Internationally?
- How Long Do We Keep Your Information?
- How Do We Keep Your Information Safe?
- Do We Collect Information From Minors?
- What Are Your Privacy Rights?
- Controls for Do-Not-Track Features
- Do United States Residents Have Specific Rights?
- Do We Make Updates to This Notice?
- How Can You Contact Us?
- How Can You Review, Update, or Delete Your Data?
1. What Information Do We Collect?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
The personal information we collect may include:
- Names
- Email addresses
- Dates of birth (used to derive zodiac sign for AI-driven personalization — see section 5)
- Contact or authentication data
- Journal entries, reflection answers, and conversational messages you create within the Services
- Voice recordings transcribed to text (not retained — see section 5)
Sensitive Information. We do not process sensitive information as defined by applicable law. Date of birth is collected solely to derive a generalized zodiac sign for AI personalization context; we do not infer or process any health, biometric, or other sensitive categories of personal data.
Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by RevenueCat. You may find their privacy notice at revenuecat.com/privacy.
Social Media Login Data. We may provide you with the option to register with us using your existing social media account details. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in section 6 below.
Application Data. If you use our application(s), we may also collect the following information if you choose to provide us with access or permission:
- Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile carrier, and Internet Protocol (IP) address.
- Push Notifications. We may request to send you push notifications regarding your account or certain features of the application. If you wish to opt out, you may turn them off in your device's settings.
Information automatically collected
In Short: Some information — such as your IP address and browser characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and other technical information.
The information we collect includes:
- Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services.
- Device Data. Information about your computer, phone, tablet, or other device you use to access the Services.
2. How Do We Process Your Information?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for the following purposes:
- To facilitate account creation and authentication and otherwise manage user accounts.
- To deliver and facilitate delivery of services to the user.
- To personalize AI-generated reflection prompts, insights, and conversational guidance using context derived from your date of birth (zodiac sign), prior session content, and topic history. See section 5 for details on AI processing and your right to opt out.
- To respond to user inquiries and offer support to users.
- To send administrative information to you, including details about our products and services and changes to our terms and policies.
- To save or protect an individual's vital interest, such as to prevent harm.
3. What Legal Bases Do We Rely On to Process Your Information?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.
If you are located in the EU or UK
The GDPR and UK GDPR require us to explain the valid legal bases we rely on to process your personal information:
- Consent. We may process your information if you have given us permission for a specific purpose. You can withdraw your consent at any time.
- Performance of a Contract. We may process your personal information when necessary to fulfil our contractual obligations to you.
- Legal Obligations. We may process your information where necessary for compliance with our legal obligations.
- Vital Interests. We may process your information where necessary to protect your vital interests or the vital interests of a third party.
If you are located in Canada
We may process your information if you have given us specific permission (express consent) or where your permission can be inferred (implied consent). You can withdraw your consent at any time. In some exceptional cases we may be legally permitted to process your information without your consent, including for fraud detection, business transactions, compliance with subpoenas, and other circumstances permitted under applicable law.
4. When and With Whom Do We Share Your Personal Information?
In Short: We may share information in specific situations and with specific third parties.
We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf. We have contracts in place with our third parties designed to safeguard your personal information.
The third parties we may share personal information with:
- AI Service Providers: Anthropic (text generation), OpenAI (voice transcription via Whisper), ElevenLabs (text-to-speech synthesis)
- Functionality and Infrastructure Optimisation: Supabase and Termly.io
- Invoice and Billing: RevenueCat
- Web and Mobile Analytics: MixPanel
- Website Performance Monitoring: Sentry
We may also need to share your personal information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
5. Do We Offer Artificial Intelligence-Based Products?
In Short: Yes. The Services include features powered by AI. Here we explain exactly what content is AI-generated, which providers process your data, and how automated personalization works.
As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). The terms in this Privacy Notice govern your use of the AI Products within our Services.
AI-Generated Content
The following content surfaces within the Services are generated by AI based on your input:
- Personalized reflection questions during guided sessions
- Bridge text and transitions between questions
- Insights and summaries presented after each completed session
- The "Deeper Look" expanded analysis available after a session
- Replies from the "Talk It Out" conversational reflection feature
- The Daily Feature theme and prompt shown on the home screen
- Topic labels extracted from your conversations
AI-generated content is presented within the Services for reflective purposes only. It is not professional advice and should not be relied upon for medical, legal, financial, or therapeutic decisions.
Third-Party AI Service Providers
We provide the AI Products through the following third-party service providers. Your input may be transmitted to and processed by these providers solely to generate the AI output you see in the Services:
- Anthropic (Claude API) — Receives the text of your journal entries and reflection responses to generate AI-powered insights, questions, and reflections. Your conversational messages, prior session context, and a generalized zodiac context (derived from your date of birth) may also be included. Anthropic processes this data per their privacy policy at anthropic.com/legal/privacy. We have a data processing agreement in place with Anthropic.
- OpenAI (Whisper API) — Receives voice recordings from your reflection sessions for transcription to text. Audio is processed in-memory and is not stored by OpenAI per their API data usage policy. See openai.com/policies/privacy-policy.
- ElevenLabs — Receives text from AI-generated responses to synthesize spoken audio playback. Only AI-generated text is sent; your direct journal entries and voice recordings are not. Processed in-memory and not stored. See elevenlabs.io/privacy.
Data sent to these services is transmitted via HTTPS. By using AI-powered features in Unpack, you consent to this data sharing. You can disable AI features at any time by skipping or revoking consent in the app.
You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider listed above.
Automated Profiling and Decision-Making
To personalize the AI output you see, we apply limited automated profiling: your date of birth is used to derive a generalized zodiac sign, which is included as background context in prompts sent to Anthropic. This influences the tone and framing of AI-generated questions and insights — for example, the AI may reference characteristics commonly associated with your zodiac sign as a soft framing device.
This profiling:
- Is not used to make any decision that produces legal effects concerning you or that similarly significantly affects you, as referenced in Article 22 of the General Data Protection Regulation (GDPR).
- Does not result in offers, pricing, eligibility decisions, or account restrictions of any kind.
- Is used purely to vary the conversational tone and contextual framing of reflective content presented within the Services.
If you do not wish to have your date of birth used for AI personalization, you may contact us at support@letsunpack.app to request removal of this data. Note that removing your date of birth will not prevent core use of the Services but will result in less personalized AI output.
Our AI Products
Our AI Products are designed for the following functions:
- Content generation (reflection questions, insights, conversational replies)
- Personalisation (varying tone, framing, and depth based on user context)
- Voice transcription (converting your spoken input to text within the Services)
How to Opt Out
To opt out of AI processing entirely, please contact us using the contact information provided in section 15. Opting out of AI processing will significantly limit Service functionality, as AI generation is core to the Unpack experience.
6. How Do We Handle Your Social Logins?
In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.
Our Services offer you the ability to register and log in using your third-party social media account details (like your Facebook or X logins). Where you choose to do this, we will receive certain profile information about you from your social media provider, which may include your name, email address, friends list, and profile picture. We will use this information only for the purposes described in this Privacy Notice. We recommend that you review the privacy notice of your social media provider to understand how they collect, use, and share your personal information.
7. Is Your Information Transferred Internationally?
In Short: We may transfer, store, and process your information in countries other than your own.
Our servers are located in the United States and European Union. If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, please be aware that these countries may not have data protection laws as comprehensive as those in your country. We will take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law.
European Commission's Standard Contractual Clauses
We have implemented the European Commission's Standard Contractual Clauses for transfers of personal information between our group companies and between us and our third-party providers. These clauses require all recipients to protect all personal information that they process originating from the EEA or UK in accordance with European data protection laws. Our Standard Contractual Clauses can be provided upon request.
8. How Long Do We Keep Your Information?
In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.
We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice will require us to keep your personal information for longer than the period of time in which users have an account with us.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. If deletion is not possible (for example, because your information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.
9. How Do We Keep Your Information Safe?
In Short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
10. Do We Collect Information From Minors?
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of such a minor and consent to the minor's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any data we may have collected from children under age 18, please contact us at support@letsunpack.app.
11. What Are Your Privacy Rights?
In Short: Depending on your location, you have certain rights that allow you greater access to and control over your personal information.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right to:
- Request access and obtain a copy of your personal information
- Request rectification or erasure
- Restrict the processing of your personal information
- Data portability (if applicable)
- Not be subject to automated decision-making (see section 5 for details on the limited automated profiling we perform for AI personalization)
- Object to the processing of your personal information
You can make such a request by contacting us using the contact details provided in section 15 below. We will consider and act upon any request in accordance with applicable data protection laws.
If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.
Withdrawing your consent
If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the contact details provided in section 15. Please note this will not affect the lawfulness of processing before its withdrawal.
Account Information
If you would at any time like to review or change the information in your account or terminate your account, you can contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. We may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.
If you have questions or comments about your privacy rights, you may email us at support@letsunpack.app.
12. Controls for Do-Not-Track Features
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.
13. Do United States Residents Have Specific Privacy Rights?
In Short: If you are a resident of certain US states, you may have the right to request access to, correct, or delete the personal information we hold about you.
Categories of Personal Information We Collect
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, IP address, email address, and account name | YES |
| B. Personal information (CA Customer Records statute) | Name, contact information, education, employment, employment history, and financial information | NO |
| C. Protected classification characteristics | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | YES |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | NO |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or network activity | Browsing history, search history, online behaviour, interest data, and interactions with our and other websites | NO |
| G. Geolocation data | Device location | NO |
| H. Audio, electronic, sensory information | Images and audio, video or call recordings created in connection with our business activities | NO |
| I. Professional or employment-related information | Business contact details, job title, work history, and professional qualifications | NO |
| J. Education information | Student records and directory information | NO |
| K. Inferences drawn from personal information | Inferences drawn from any of the collected personal information listed above to create a profile about an individual's preferences and characteristics | YES |
| L. Sensitive personal information | — | NO |
We will use and retain the collected personal information as needed to provide the Services or for:
- Category A — As long as the user has an account with us
- Category C — As long as the user has an account with us (date of birth retained for AI personalization context only)
- Category K — As long as the user has an account with us
Your Rights
You have rights under certain US state data protection laws, including the right to know whether we are processing your personal data, access your personal data, correct inaccuracies, request deletion, obtain a copy of previously shared data, and opt out of the processing of your personal data for targeted advertising, sale, or profiling.
How to Exercise Your Rights
To exercise these rights, you can contact us by emailing support@letsunpack.app or by referring to the contact details in section 15. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with applicable laws.
Request Verification
Upon receiving your request, we will need to verify your identity. We will only use personal information provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from the information already maintained by us, we may request additional information for verification and security purposes.
Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at support@letsunpack.app. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.
California "Shine The Light" Law
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please submit your request in writing using the contact details in section 15.
14. Do We Make Updates to This Notice?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
15. How Can You Contact Us About This Notice?
If you have questions or comments about this notice, you may email us at support@letsunpack.app or contact us by post at:
Sador Zekarias15308 Graan voor Visch
Hoofddorp, Noord-Holland 2132 EK
Netherlands
16. How Can You Review, Update, or Delete the Data We Collect From You?
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please contact us at support@letsunpack.app.