Privacy policy

The controller is Eckhardt Media Solutions S.R.L., Strada Harmanului 24h, Tarlungeni, Romania, fiscal code (CUI) 50306295, represented by Vincent Eckhardt, Managing Director. It operates Unfictive until Unfictive is incorporated.

For any privacy question or request, email info@unfictive.com.

Our website is hosted by Vercel. To deliver pages and protect the site from abuse, Vercel processes technical request data such as your IP address, browser user agent, the requested page and the time of the request. Vercel keeps these logs for the limited period its service provides. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

We measure visits with Vercel Web Analytics, which works without cookies. It records the page viewed, the referring page, and the country, browser, operating system and device type derived from the request. Visitors are distinguished only by a short-lived hash of the request that resets daily; nothing is stored on your device and no profile is built across sites. Legal basis: our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR).

Fonts, images and videos are served from our own site. The website sets no cookies and loads no advertising or social media trackers.

An early access request includes your name, work email, company, product category, sourcing stage and the help you need. We also record your consent and its timestamp, the language and source of your request and the version of this policy. Existing waitlist signups hold your name, email, company and an optional product description with the same consent record.

To limit abusive submissions, the service temporarily keeps a hashed network identifier. Your raw IP address is not added to your request.

We use these details to review your request and contact you about access, based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Requests are stored privately with Supabase in Frankfurt, Germany. Submitting a request does not create an account. We keep a request until you ask us to remove it or we close early access.

When we invite you, we create an account with your name and email address. Your company account holds your company and billing details and the teammates you invite. Signing in uses Supabase Auth.

In the workspace you share product information with us: briefs, messages to the assistant, uploaded specifications, images and drawings, supplier quotes you review, sample reviews, orders and records of payments you make to suppliers. This can include personal data, for example names in documents you upload. Unfictive does not process payments; payment records only describe payments you make outside the app.

We process this data to provide the service you signed up for (Art. 6(1)(b) GDPR). It is stored with Supabase in Frankfurt, Germany, and processed by our application on Vercel.

We keep project data while your account is active. Projects you delete are removed; archived projects remain in your account. After your account ends we delete project data unless we must keep records such as fee invoices under accounting and tax law, which we keep for the legally required period.

The assistant reads your messages, briefs and uploaded files to ask clarifying questions, build your brief and prepare supplier requests. Customer data is processed only by first-party model providers, reached through Vercel AI Gateway under data processing terms: Anthropic, for the assistant and translation, and OpenAI, for reading supplier replies, checking artwork and generating product images; both process data in the United States.

Supplier-side drafting and translation of messages to and from suppliers also run through the first-party model providers listed below. Separately, we use a model service for internal testing with synthetic data only; no customer or supplier data is sent to it.

Under their API terms, neither provider uses this data to train its models. They may keep it for up to 30 days to detect abuse and then delete it.

Unfictive sources from factories in China. When you submit a request, we send the supplier-facing version you reviewed to the factories we contact, through B2B marketplaces, email or WeChat. Fields you keep private, such as your target price, are withheld by default. Suppliers' replies, quotes and files are kept in your project.

China has no EU adequacy decision. We transfer only what you approve for release, and only because it is necessary to obtain quotes and carry out the service you asked for (Art. 49(1)(b) GDPR).

Members of the Unfictive team work from Shanghai, China. To run outreach and verification they access, from China, the projects you have submitted, including your brief and supplier conversations. Access is limited to authorised staff accounts and to projects with a submitted request.

Our team in China also processes personal data of supplier contacts: names, business email addresses, phone numbers, WeChat IDs and messages, collected from public business listings, marketplaces and the suppliers themselves. We use it to contact suppliers about customer requests, based on our legitimate interest in sourcing for our customers (Art. 6(1)(f) GDPR). Suppliers join our supplier network only after agreeing to be listed and contacted. Supplier contact data is stored with Supabase in Frankfurt, Germany, and kept while the supplier relationship is relevant to sourcing. Suppliers can ask us to remove their details at any time.

We send account emails and alerts only when a new quote arrives or an action is needed from you. Emails to and from suppliers sent through our sending domain are captured into the relevant supplier thread. Email delivery: Spaceship, Inc. (Spacemail), which also hosts our team's mailboxes.

To learn how the workspace is used, we keep a first-party event log on our own database. An event records what happened (for example, a project was created or a request was submitted), when, and the account, company and project it belongs to, plus counts such as the number of attached files. It never contains the content of your briefs, messages or files.

The log uses no cookies, device identifiers or third-party analytics. Only Unfictive founders can read it. Events are deleted after twelve months. Legal basis: our legitimate interest in improving the product (Art. 6(1)(f) GDPR).

The website sets no cookies. The workspace sets only the essential cookies that keep you signed in. It also keeps interface preferences and unsent draft text in your browser's storage; this stays on your device and is not sent to us. Because we use no advertising, tracking or session replay, we do not show a consent banner.

We use the service providers listed on our subprocessors page. They process data on our behalf under data processing terms. Vercel and Supabase are companies based in the United States; transfers to them are covered by the Standard Contractual Clauses in their data processing agreements and, where the provider is certified, the EU-US Data Privacy Framework. The same applies to the other US-based providers on our subprocessors page.

You can ask for access to your data, its correction or deletion, restriction of processing and a copy in a portable format, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Email info@unfictive.com.

You can also complain to a data protection supervisory authority, in particular the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or the authority where you live or work.

We update this policy when our processing changes. The date at the top shows the current version.