Privacy Policy
Last updated: October 24, 2026
This policy explains what personal data Unrote Assist Personal (the assistant at https://app.unrote.ai and its payment pages at https://pay.unrote.ai) keeps, why, where and who else processes it. The data controller is DENIS ILIN PR BEOGRAD, a sole proprietor (preduzetnik) registered in the Republic of Serbia, registration number (matični broj) 68549639, tax identification number (PIB) 115679445, registered seat Čika-Ljubina 12/3, 11102 Beograd, Serbia. Email: contact@unrote.ai.
We process personal data under the Serbian Law on Personal Data Protection and, where it applies, the EU General Data Protection Regulation (GDPR).
1. What we keep
- Your account: your email address, the name you give (you may leave it empty), a hash of your password (never the password itself) and your language.
- Your content: your chats, the files you upload and the files the assistant makes, and the memory and settings you keep in the assistant.
- Connected accounts: if you connect your mail, calendar or cloud files, the access tokens for them (stored encrypted on our server) and a search index of what you connected, so the assistant can find things for you.
- Payments: your top-ups, your balance and its history, and refunds. For card payments we keep Paddle's transaction ids and amounts; Paddle keeps your card details and we never see your card number. For crypto, your deposit address and the transactions to it, which are public on the blockchain.
- Security: IP addresses, to limit sign-ups and sign-in attempts from one address, and technical logs of requests to our servers, to find faults and stop abuse.
- Closed accounts: when an account is closed after a refund or a chargeback, we keep its email address on a list that stops it from being used to sign up again.
2. Why we use it
- To provide the Service you asked for (performance of a contract): your account, the assistant's work with your content and connected accounts, your balance, top-ups and refunds.
- To keep the Service safe (legitimate interests): limits on sign-ups and sign-in attempts, the bot check on sign-up, logs, and the list of closed accounts.
- To meet legal duties (legal obligation): financial and tax records.
We do not sell your data, do not use it to train AI models, and do not use it for advertising.
3. AI processing
To answer a request, the assistant sends its content (your message and the parts of your files, mail or memory it needs for that request) to the model you picked, through OpenRouter, which passes it to that model's provider. The provider handles the request under its own terms and may keep it for a limited time, for example to detect abuse. See OpenRouter's privacy policy.
4. Where your data is and who processes it
We keep your data on our own servers at Hetzner in Germany (EU). These companies process data for us:
- Hetzner Online (Germany): the servers that hold your data.
- OpenRouter (USA) and the model provider it passes each request to: the content of your requests to AI models.
- Paddle (United Kingdom): card payments. Paddle is the merchant of record and handles your payment details under its own privacy policy.
- Resend (USA): delivers the sign-up and password-reset emails (your email address and the letter).
- Cloudflare (USA): the DNS of our domains and the Turnstile check on sign-up and password reset, which looks at your IP address and browser to tell people from bots.
- Infura (USA) and other blockchain data providers: read public data of the networks, such as deposits to your address.
When you ask the assistant to research the web, your search queries go to a web search service. When you connect an account, data moves between that account and our servers as you ask; its provider handles it under its own terms. We share data with authorities only when the law requires it.
5. Transfers outside the EU
Some of the companies above are in the USA. For these transfers we rely on the European Commission's Standard Contractual Clauses, or on the company's certification under the EU-US Data Privacy Framework where it has one. Paddle is in the United Kingdom, which the EU recognizes as giving adequate protection. You can ask us for details of these safeguards.
6. How long we keep it
We keep your data while you have an account. You can ask us to delete your account at any time by writing to contact@unrote.ai from the account's email address. We then delete it and remove your data within 30 days, except financial records (payments, refunds and the history of your balance), which we keep as long as the law requires, and the email address of an account closed after a refund or a chargeback (section 1). Public blockchain data cannot be deleted by anyone.
7. Cookies
We use essential cookies only: to keep you signed in to the assistant and to your top-up page, and to remember your language. There are no advertising or tracking cookies.
8. Security
Connections are encrypted (TLS), passwords are stored only as hashes, the tokens of connected accounts are encrypted, and no other user can see your chats and files. No system is perfectly secure, but we work to protect your data and will tell you without undue delay if a breach puts it at risk.
9. Your rights
You can ask us for access to your data, to correct it, to delete it, to receive it in a portable format, to restrict its processing or to object to it. Write to contact@unrote.ai. You can also complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU or the UK, the authority where you live or work.
10. Age
The Service is not for anyone under 16. If we learn that a child under 16 has an account, we delete it.
11. Changes
We may update this policy. For a material change we tell you in advance by email or on this site.
12. Contact
DENIS ILIN PR BEOGRAD, a sole proprietor (preduzetnik) registered in the Republic of Serbia, registration number (matični broj) 68549639, tax identification number (PIB) 115679445, registered seat Čika-Ljubina 12/3, 11102 Beograd, Serbia.
Email: contact@unrote.ai