Privacy Policy

Draft dated 8 October 2026. Prepared for approval; this version has not yet taken effect.

1. Who is responsible for data

UnlimGPT is provided by Unlim-FZ LLC, United Arab Emirates. For account data, user communications, security and service accounting, the company determines the purposes of personal data processing within applicable law. Contact hello@unlimgpt.com with data questions and requests under this policy.

This policy covers our website, web chat and API. The Terms of Use separately govern access, payment and acceptable use. Where an organization submits its users' data through the API, the parties' roles and obligations may be specified in a separate data processing agreement. API use alone does not establish such an agreement or demonstrate compliance with particular industry requirements.

2. Data we process

Depending on the features used, we process:

• Account data: name, email, sign-in methods, security settings, sessions, authorized applications and organization membership.
• Request content: messages, history, instructions, files and information you include in a request. When supported features are used, this includes images, documents, audio and tool results.
• Outputs: model responses, available reasoning information, search results and other returned material, along with saved conversations.
• Service records: plan, credit balance and transactions, request and payment references, timing, status and usage. When a payment is arranged, necessary billing details and payment confirmation information.
• Technical information: IP address, browser and device information, cookies, language and theme settings, and limited error and access-event information.
• Communications: information you voluntarily send to support or in connection with data rights.

Third-party sign-in shares information you authorize as needed for login, such as a name, email and account identifier. It does not give us general access to your email messages or other data in that service.

Do not include passwords, API keys, payment credentials, excessive personal data or information that cannot lawfully be processed for your intended use. Medical, financial, biometric and other sensitive data require checking applicable requirements and agreeing on necessary terms first. You must have a legal basis and provide necessary notices for other people's data you submit.

3. Why we process data

We process data to:

• create accounts, verify email, provide sign-in and selected security methods;
• fulfill requests, run selected tools and save history where storage applies;
• account for usage, apply plans and limits, handle payments and related inquiries;
• prevent unauthorized access, abuse and security breaches;
• diagnose technical failures and maintain the Service;
• respond to requests, protect legal rights and meet applicable legal obligations.

Training models on your content is not included in these processing purposes for UnlimGPT. External processing terms are addressed separately below; this provision does not guarantee that every external service excludes storage or training.

Where applicable law requires consent, we must obtain it for the relevant processing; accepting terms does not replace that consent. In other permitted cases, processing is based on contractual performance, legal obligations and other grounds expressly allowed by law. Legitimate interests apply only where that basis is permitted by applicable legislation and individual rights are respected. Withdrawing consent does not invalidate prior lawful processing or independent lawful grounds for further processing.

4. Recipients of data

To answer a request, its content and necessary history are transmitted to external AI processing systems. Selected search or tools receive information necessary for their operation. Processing routes may change according to availability and capabilities. Do not submit material for which that transfer is unacceptable.

Other recipient categories include storage and delivery infrastructure, sign-in and anti-abuse services, email delivery, technical diagnostics and, where payment is used, payment institutions. Relevant features may involve Google for sign-in and reCAPTCHA, Resend for service emails and Sentry for technical diagnostics. A recipient's role as a processor or independent controller depends on its function and the applicable agreement.

Access by staff and authorized contractors is limited to what their duties require. We may disclose necessary information in response to a lawful request from a competent authority, to protect rights or in a business transfer subject to applicable notices and restrictions.

External AI services' retention and data-use practices depend on current agreements and selected capabilities. This policy does not promise universal Zero Data Retention, exclusion of training by all external processors or processing in only one country. Special guarantees apply only when separately confirmed for your use.

5. Processing in other countries

The company is based in the UAE; technical processing may occur in other countries where relevant systems and recipients operate. Their data laws may differ from those in your country.

Transfers must have the basis and safeguards required by applicable law. If your organization requires a particular region, processor list or transfer mechanism, agree on it before submitting data. General Service availability does not establish agreed data residency or compliance with every data protection regime.

6. Saved history and API requests

Web chat saves conversations and results so you can continue working. Responses API response storage is enabled by default. store: false limits response storage for later retrieval by identifier but does not mean no processing or no records: usage information is retained, and a conversation-bound request may be saved in its history.

With store: false and an Idempotency-Key, a result may be temporarily retained to support a safe retry without a second paid generation, for no longer than 24 hours from initial acceptance. This is a specific retry window, not the retention period for all data. API use does not override external processing systems' rules.

Some automatic retries also retain an encrypted result record with a short two-minute retry window, extended on an actual retry. When that window ends, the record becomes unavailable for retry but may remain archived; no separate retention period for that archive is currently established. The end of the retry window does not mean complete erasure of the result.

Message content, responses, passwords and API keys are excluded from intended technical logging and tracing; diagnostics use limited Service operation information. Saving a conversation in the product is different from logging: no text in a log does not mean no text in saved history.

7. Retention and archiving

Saved history remains in the Service while its storage applies. There is currently no automatic erasure period for saved content. Account, accounting, security and communication records may be needed after access ends for legal obligations and disputes. This draft does not specify a retention period for those categories or backups.

Archiving a conversation, message or saved response hides it from ordinary access but retains its record and content. Archiving is not complete erasure. Self-service erasure of an account and all related data is not currently provided in the interface. Revoking a session or API key ends access but does not erase history either.

Backups and mandatory accounting records are considered separately; archiving does not rewrite existing copies. When handling a data request, we must explain what was done, what continues to be retained and on what basis, and which requirements remain unfulfilled. The technical absence of an erasure operation does not remove statutory rights.

8. Your rights and requests

Depending on applicable law, you may request processing information and access, correction, a copy or portability, erasure, restriction, objection or withdrawal of consent. The scope and exceptions depend on the law, the data and retention obligations. You may complain to a competent data protection or other appropriate authority.

Email hello@unlimgpt.com, preferably from your account email, and describe your request. To protect data, we may verify identity and authority when you act for another person or organization. Do not send passwords, API keys or identity documents before safely agreeing on their necessity and transmission method.

We address requests within legally required timeframes and explain any refusal or limitation. This draft does not promise immediate erasure or a fixed Service response SLA that has not been established. Requests about data submitted by your organization may require involving its authorized representative.

9. Cookies and browser storage

Cookies and similar mechanisms support sign-in and security, language, theme and interface preferences. Local storage may retain reasoning level, tool choices, search depth, search domains and other preferences. A guest request draft, together with its selected model and settings, may temporarily remain in your tab's sessionStorage for transfer after registration; it is not sent for generation before an authorized action.

When reCAPTCHA runs, third-party protection may process technical data and use its own storage mechanisms. Its use is associated with the Google Privacy Policy and Google Terms. Third-party mechanisms are not all necessarily essential just because they relate to security: any legally required consent must be addressed separately.

Browser settings let you restrict or remove cookies and local data. This may sign you out, reset preferences or prevent protected operations. Temporary drafts and local preferences are not public disclosures, but may be accessible to people with access to your device. This policy does not replace separate consent for optional cookies where required.

10. Security

We use access controls, separation of account data, connection protection and restrictions on diagnostic information. No transmission or storage method guarantees absolute security. Use available sign-in protections and keep your credentials private.

If a key or password is exposed, revoke or change it and notify us without repeating the exposed value. Incident notifications to users and authorities are made where and within the timeframes required by applicable law. Do not send sensitive content in ordinary email to prove an incident.

11. Children

The Service is intended for people aged 18 or older. If you believe a child has provided data without a necessary lawful basis, contact us. We will assess the circumstances, restrict unlawful processing and determine necessary actions under applicable law; this is not a promise of immediate technical erasure.

12. Third-party links and public actions

Opening an external link, tool or service may cause that service to process data under its own policy. Sharing or publishing a result outside UnlimGPT at your choice does not make the external platform part of this policy. Check material before sharing and consider other people's personal data.

13. Changes and contacts

We publish the current version with its date and notify you of material changes where required by law or where they affect existing agreements. New consent is requested where necessary; using the website alone does not replace it.

Unlim-FZ LLC, United Arab Emirates. Data and security questions: hello@unlimgpt.com. The Russian and English versions are intended to have equivalent meaning; report any discrepancy to this address.