Legal

All policies effective 1 July 2026 · Unhide AI Ltd

DOCUMENT 1 — PRIVACY POLICY

Version: v1.0 Effective Date: 1 July 2026

Privacy Policy

Unhide AI Ltd, trading as Unhide Registered in England and Wales Company Number: 14771976 Registered Office: 204 Southcote Lane, Reading, Berkshire, England, RG30 3AU ICO Registration Number: (ICO registration pending)

1. Who We Are

Unhide AI Ltd, trading as Unhide ("we", "us", "our"), operates the web application available at unhide.co.uk (the "Platform"). We are the data controller in respect of personal data processed through the Platform, as defined under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018").

Our designated privacy contact can be reached at: ****

We are registered with the Information Commissioner's Office ("ICO") under registration number (ICO registration pending).

2. Scope of This Policy

This Privacy Policy explains what personal data we collect about you when you use the Unhide Platform, why we collect it, the legal basis on which we process it, how long we keep it, who we share it with, and what rights you have in relation to it.

This Policy applies to:

—Visitors to unhide.co.uk
—Registered users of the Unhide Platform
—Anyone who contacts us for support or enquiries

This Policy should be read alongside our:

—Terms of Service
—Cookie Policy
—Sensitive Data Use Policy
—Acceptable Use Policy

3. The Personal Data We Collect

3.1 Account Data

When you register for an account, we collect:

—Full name
—Email address
—Password (stored as a one-way bcrypt hash — we never store your password in plain text)
—Date of account creation
—Subscription tier and status
—Preferred notification settings

3.2 Tracker Entry Data

The core function of the Platform is allowing you to log personal data daily. Depending on the tracker template you select, we may collect the following types of entry data:

—Scale values — numerical ratings (e.g. mood out of 10, pain level)
—Numbers — discrete numerical values (e.g. hours of sleep, blood glucose reading in mmol/L)
—Booleans — yes/no or true/false responses
—Single-line text — short free-text entries
—Multi-line text — longer narrative entries or journal-style notes
—Time values — timestamps entered by you (e.g. sleep time, wake time)
—Dates — calendar dates relevant to your tracking
—Single-select responses — one option chosen from a predefined list
—Multi-select responses — multiple options chosen from a predefined list
—Photos — images uploaded by you in JPG or PNG format, up to 10MB per file
—PDFs — documents uploaded by you, up to 10MB per file

The nature and sensitivity of tracker entry data depends entirely on which tracker templates you choose to use. Some templates are designated as sensitive-category (see Section 5.3 below and our Sensitive Data Use Policy).

3.3 AI Analysis Data

When you request an AI analysis on a tracker, we transmit your logged entry data for that tracker (including any photos or PDFs you have uploaded to that tracker) to our AI provider, Anthropic PBC, via their API. Anthropic processes this data to generate a plain-English pattern analysis, which is then returned to us, stored in our database, and displayed to you in the Platform. Further details are set out in Section 7 below.

3.4 Subscription and Billing Data

We collect and process data relating to your subscription, including:

—Subscription plan and tier
—Billing cycle (monthly or annual)
—Subscription status (active, paused, cancelled)
—Add-on selections (extra trackers, AI analysis bundles)
—Transaction history (invoice references, dates, amounts)
—Stripe Customer ID and Subscription ID

We do not store your payment card details. All payment card data is processed and stored by Stripe Inc. directly. We receive only tokenised references and transaction confirmation data from Stripe.

3.5 Consent Records

Where we are required to obtain your explicit consent (for example, before you use a sensitive-category tracker template or before you upload a photo or PDF to such a template), we store a timestamped record of that consent. Consent records are retained in append-only form for 7 years in accordance with our legal obligations.

3.6 Communication and Reminder Preferences

We record:

—Whether you have opted in to daily reminder emails
—Your preferred reminder time (if applicable)
—Consent records for marketing communications (if any)

3.7 Usage and Technical Data

When you use the Platform, we automatically collect:

—Log data: IP address, browser type and version, operating system, referring URL, pages visited, features accessed, and timestamps of interactions
—Device type and screen resolution (for responsive display purposes)
—Session identifiers (managed via Supabase authentication)
—Error logs and diagnostic information

3.8 Cookie Data

We use cookies and similar tracking technologies. Please see our Cookie Policy for full details. In summary: we use strictly necessary cookies (which do not require consent) and optional analytics cookies (which require your opt-in consent).

3.9 Support and Communications Data

If you contact us for support, we collect:

—Your name and email address
—The content of your support request
—Any attachments you provide
—Our correspondence with you

4. How We Collect Your Data

We collect personal data:

—Directly from you — when you register, log tracker entries, upload photos or PDFs, change settings, or contact us
—Automatically — through your use of the Platform (log data, session data, cookie data)
—From Stripe — transaction and subscription status data via Stripe's API and webhooks
—From Supabase — authentication session data

5. Legal Bases for Processing

We process your personal data only where we have a valid legal basis to do so under UK GDPR Article 6. Where we process special category data (health, mental health, fertility, biometric data), we rely on UK GDPR Article 9(2)(a) explicit consent, supported by our Article 6 basis.

5.1 Contract (Article 6(1)(b))

We process your account data, subscription data, and core tracker entry data because processing is necessary to perform the contract we have with you (our Terms of Service). This includes:

—Creating and managing your account
—Delivering tracker functionality
—Processing your subscription and billing
—Providing AI analysis as part of your plan
—Delivering support

5.2 Explicit Consent (Article 6(1)(a) and Article 9(2)(a))

We process special category personal data (health data, mental health data, fertility and reproductive data, and biometric data) only where you have given us your explicit, informed, freely given consent by completing our double-checkbox consent flow before first use of a sensitive-category tracker template.

You also give consent for:

—Analytics cookies (where you opt in via the cookie banner)
—Marketing communications (where applicable)
—Photo and PDF uploads to sensitive-category templates (separate consent checkpoint)

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. See Section 12 for how to withdraw consent.

5.3 Legitimate Interests (Article 6(1)(f))

We process certain data on the basis of our legitimate interests (or those of a third party), where those interests are not overridden by your rights and interests:

—Platform security and fraud prevention — detecting and preventing unauthorised access, abuse, and fraud
—Service improvement — analysing aggregated, de-identified usage patterns to improve the Platform (no individual profiling)
—Audit logging — maintaining records of administrative actions and sensitive data access
—Communicating service updates — notifying you of material changes to the Platform or these policies (transactional, not marketing)

5.4 Legal Obligation (Article 6(1)(c))

We process certain data to comply with our legal obligations, including:

—Retaining financial and transaction records for the period required by UK tax law and accounting obligations
—Retaining audit logs for 7 years in accordance with UK GDPR accountability requirements
—Responding to lawful requests from law enforcement or regulatory authorities
—Complying with ICO enforcement notices

6. How We Use Your Data

6.1 Delivering the Service

We use your data to:

—Register and maintain your account
—Display your tracker entries and history to you
—Generate charts and visualisations of your data
—Enforce your plan limits (number of active trackers, AI analysis entitlements)
—Manage pauses, cancellations, and upgrades

6.2 AI Analysis

When you request an AI analysis, your tracker entry data (including uploaded photos and PDFs) is transmitted to Anthropic PBC's API. We use the returned analysis to populate the AI insights feature in your dashboard. See Section 7 for full detail.

6.3 Subscription and Billing

We use your data to process payments via Stripe, manage subscription lifecycle events, issue invoices, and send billing-related transactional emails.

6.4 Communications and Reminders

If you have opted in to daily reminder emails, we use your email address and reminder preferences to send you those reminders at your chosen time. We send transactional emails relating to your subscription (renewal reminders, payment confirmation, cancellation confirmation, milestone teasers) regardless of your reminder opt-in status, as these are necessary for the performance of our contract with you.

6.5 Security and Fraud Prevention

We use usage logs, IP data, and session data to detect suspicious activity, prevent unauthorised access, and maintain the security and integrity of the Platform.

6.6 Platform Improvement

We analyse aggregated and de-identified usage data to understand how features are used and to improve the Platform. This analysis does not profile individual users.

6.7 Legal Compliance

We use your data where necessary to comply with our legal obligations, including responding to regulatory enquiries and maintaining required records.

7. AI Analysis — How Your Data Is Used

This section explains specifically how your data is processed in connection with our AI analysis feature.

7.1 What Is Sent to Our AI Provider

When you request an AI analysis on a tracker, we compile all logged entries for that tracker (up to the point of the analysis request) into a structured data table. This includes:

—All field values you have entered (scale values, numbers, booleans, text, time entries, dates, select responses)
—Any photos you have uploaded to that tracker (transmitted as image data)
—Any PDFs you have uploaded to that tracker (transmitted as document data)

This data is transmitted to Anthropic PBC ("Anthropic") via their Application Programming Interface ("API").

7.2 Our AI Provider: Anthropic PBC

Anthropic is a US-based AI safety company. We use Anthropic's Claude Sonnet 4 model to perform the analysis.

Anthropic processes your data as a data processor acting on our behalf, under a Data Processing Agreement. The following applies to Anthropic's handling of your data:

—Anthropic does not use API input or output data to train its AI models. Your tracker data is not used to improve Anthropic's models.
—Anthropic retains API inputs and outputs for up to 30 days for safety monitoring, trust and safety purposes, and abuse prevention, after which it is deleted from Anthropic's systems. This retention is a term of Anthropic's API usage policy.
—Data is transmitted to Anthropic's servers in the United States. This constitutes an international data transfer — see Section 9 for how we ensure lawful transfers.
—Anthropic's privacy information is available at: https://www.anthropic.com/privacy

7.3 Storage of Analysis Results

The plain-English insight generated by Anthropic is returned to us via the API and stored in our database (hosted by Supabase). You can view your analysis results in your dashboard at any time.

7.4 Not Solely Automated Decision-Making

UK GDPR Article 22 provides rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects. Our AI analysis feature does not fall within Article 22 because:

—The analysis produces informational insights and identified patterns only
—No decision is made solely on the basis of the analysis — you always review the insight and decide what (if anything) to do with it
—The analysis has no legal or similarly significant effect on you

You are always in control of how you interpret and use AI-generated insights.

8. Sub-Processors

We use the following third-party sub-processors to deliver the Platform. Each sub-processor processes personal data on our behalf, under a written Data Processing Agreement.

Sub-Processor	Purpose	Country
Anthropic PBC	AI analysis — your tracker entry data (including photos and PDFs) is transmitted to Anthropic's API to generate pattern insights	United States
Stripe Inc	Payment processing and subscription management — processes payment card data and manages billing	United States
Supabase Inc	PostgreSQL database hosting, file storage (photos and PDFs), and user authentication	United States
Resend	Transactional email delivery — sends account, reminder, and subscription emails on our behalf	United States
Vercel Inc	Web application hosting and edge function delivery	United States

We do not sell your data to any third party. We do not share your data with advertisers. We do not disclose your data to any party not listed above except where required by law.

9. International Data Transfers

All five of our sub-processors are based in the United States. Transferring personal data from the UK to the USA constitutes a restricted transfer under UK GDPR.

We ensure that each such transfer is lawful by relying on one or more of the following mechanisms:

—International Data Transfer Agreement (IDTA) — the UK-specific transfer mechanism approved by the ICO under Section 119A of the DPA 2018
—UK Addendum to the EU Standard Contractual Clauses — where a sub-processor has adopted EU SCCs, we apply the UK Addendum to bring the transfer within UK GDPR requirements

Each of our sub-processors maintains a Data Processing Agreement that includes the applicable transfer mechanism. Where you wish to review the applicable transfer documentation, please contact us at .

10. Data Retention

Data Category	Retention Period
Account data and tracker entries	Retained for as long as your account is active
AI analysis results	Retained for as long as your account is active
Uploaded photos and PDFs	Retained for as long as your account is active
Consent records	Retained for 7 years from the date of consent (append-only)
Audit logs	Retained for 7 years from the date of the logged event
Stripe invoices and transaction records	Retained for the period required by applicable UK financial and tax legislation (minimum 6 years)
Support correspondence	Retained for 3 years from date of last correspondence, unless required longer for legal proceedings
Anthropic API data	Deleted from Anthropic's systems within 30 days of the API call

On account deletion: When you permanently delete your account, we cascade-delete all of your tracker entries, AI analysis results, uploaded photos and PDFs, tracker templates, and associated data immediately. Consent records and audit logs are retained for the periods stated above, as we are required to maintain these by law. Stripe invoices are retained per our financial and tax obligations.

11. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at ****.

We will respond to your request within one calendar month. We will not charge a fee for exercising your rights, unless your request is manifestly unfounded or excessive.

11.1 Right of Access (Article 15)

You have the right to request a copy of the personal data we hold about you and information about how we process it. You can request a full ZIP export of all your data via your account's Privacy Settings, or by emailing .

11.2 Right to Rectification (Article 16)

You have the right to request that we correct inaccurate personal data or complete incomplete personal data. You can update most of your account data directly via your account settings. For data you cannot update yourself, contact us at .

11.3 Right to Erasure (Article 17)

You have the right to request that we delete your personal data in certain circumstances (for example, where the data is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other legal basis for processing). You can delete your entire account (and all associated data) via Dashboard → Settings → Account → Delete Account. This triggers immediate cascade deletion of all your tracker data.

11.4 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller. You can request a full ZIP export of your data (including all entries, analyses, and metadata) via Privacy Settings or by contacting .

11.5 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data, or where processing is unlawful but you do not want erasure.

11.6 Right to Object (Article 21)

Where we process your data on the basis of legitimate interests, you have the right to object to that processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is for the establishment, exercise, or defence of legal claims.

11.7 Rights in Relation to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. As stated in Section 7.4, our AI analysis feature does not constitute solely automated decision-making under Article 22 — it provides informational insights; you always make the final decision. If you have concerns about how AI analysis is applied to your data, contact us at .

11.8 Right to Withdraw Consent

Where we process your data on the basis of consent (including explicit consent for sensitive-category data), you may withdraw that consent at any time. You can withdraw consent for a sensitive-category tracker via your tracker settings (choosing either to pause the template or to delete all data for it). Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.

12. Admin Access and Impersonation

Unhide support staff may access user accounts in a read-only impersonation mode for the purpose of providing technical support when requested by a user. All impersonation sessions are:

—Read-only — support staff cannot modify, add, or delete your data during an impersonation session
—Logged — every impersonation session is recorded in our audit trail with the staff member's identity, the user account accessed, the date and time, and the duration
—Limited — impersonation is only permitted in connection with a live support request

Payment information is never accessible via the impersonation mode, as payment data is stored exclusively by Stripe.

13. Cookies

We use cookies and similar technologies on the Platform. For full information about the cookies we use, the categories they fall into, and how to manage your preferences, please see our Cookie Policy.

In summary:

—Strictly necessary cookies are set automatically and do not require your consent
—Analytics cookies are optional and require your affirmative opt-in via our cookie consent banner

14. Children and Age Restrictions

The Unhide Platform is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are under 18, you must not use the Platform.

If we become aware that we have collected personal data from a person under the age of 18, we will delete that data immediately without notice. If you believe we hold data belonging to a child, please notify us immediately at .

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email to your registered email address and/or by displaying a prominent notice within the Platform, at least 14 days before the changes take effect.

The version number and effective date at the top of this document will always reflect the current version. Your continued use of the Platform after the effective date of any updated Policy constitutes your acknowledgement of the changes.

16. How to Contact Us

For any privacy-related queries, to exercise your rights, or to raise a concern:

Privacy Contact: Email: ****

General Support: Email: support@unhide.co.uk

Postal Address: Data Protection Contact Unhide AI Ltd 204 Southcote Lane, Reading, Berkshire, England, RG30 3AU

We aim to respond to all privacy requests within 5 working days and will resolve them within one calendar month (extendable by a further two months for complex requests, with notice to you).

17. Your Right to Complain to the ICO

If you are unhappy with how we have handled your personal data or responded to your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the UK.

Information Commissioner's Office Website: https://ico.org.uk Helpline: 0303 123 1113 Postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always prefer the opportunity to address your concern directly before you contact the ICO. Please contact us first at .