Privacy & cookies
Last updated: 2026-11-02
In short:voice notes are transcribed on the fly and the audio is discarded; every fact pulled from an answer carries the quote of whoever said it; and product analytics only switch on if you accept them. We don't sell data and we don't run ads.
1. Who is responsible
UnifyFlow is a product by CooWeb. For anything about your data, write to hola@unifyflow.app.
2. What we process and why
Your account
If you sign in, your email address, to send you the sign-in link and attach your panels and companies to you. Legal basis: providing the service you ask for.
What your team says in a capsule
Whoever answers a capsule records a voice note. The audio is not stored: it is transcribed on the spot and discarded. We keep the transcript, the steps extracted from it (what is done, with which tool, how long it takes, where it gets stuck) and whatever name or label the person chooses to give. That data belongs to the company or consultancy that created the capsule: they are the controller and we process it on their behalf, only to provide the service. Respondents own what they said until they hit “send”.
Org X-ray, follow-ups and rooms
For companies set up in UnifyFlow (people, interviews, goals, check-ins, VELA rooms), the client company is the controller of its people's data and we process it on its behalf. Live listening is a private pilot: there, audio is stored only with explicit consent and deleted after 90 days or when its owner deletes the session.
Product analytics (only if you accept)
With your consent we use PostHog to learn which pages are viewed and which steps are taken. Before leaving your browser, every URL is cleaned: no panel keys, no tokens and no client names. PostHog receives your IP address to infer your country. Legal basis: your consent, which you can withdraw at any time. Without it, PostHog is not even loaded.
Service usage metrics
On our server we count service actions —an MCP URL created, a tool used from an agent, an answer sent— under a pseudonymous ID of the panel or company. Never their content: not what anyone said, no names, no parameters, no IP addresses. Nothing touches your device. Legal basis: our legitimate interest in knowing whether the product works.
Aggregate statistics and security
Cloudflare, which hosts the site, gives us aggregate visit counts without cookies or identifiers, and keeps technical logs to protect the service from abuse. Legal basis: our legitimate interest in a working, secure site.
3. Who we share it with
Only with providers acting on our behalf, under a data processing agreement:
- Cloudflare — hosting, database, sign-in email, transcription and AI models (Workers AI and AI Gateway).
- Anthropic — the language model that extracts steps from transcripts, via Cloudflare AI Gateway.
- ElevenLabs, Google and OpenAI — synthetic voice for the VELA room narrator; they only receive the text to be read.
- Exa — public web search when you add a company; it receives the company name, not personal data.
- PostHog — product analytics, only with your consent.
Some are in the US. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
If your company runs UnifyFlow on its own infrastructure (self-hosted), the data stays there and the AI provider is whichever one your company configures with its own API key.
4. How long
- Voice-note audio: not kept.
- Account, panels and companies: while they exist; delete them or ask us and they are erased.
- Analytics: the cookie lasts 12 months; events are stored pseudonymously and reviewed yearly.
- Security logs: the minimum period set by Cloudflare.
5. Your rights
You can ask for access, rectification, erasure, objection, restriction and portability at hola@unifyflow.app. If your data sits in a client company's panel, we will pass your request on to them, as they are the controller. You can also complain to the Spanish Data Protection Agency (aepd.es) or your local authority.
6. Cookies
A cookie is a small file a site stores in your browser. We use the strictly necessary ones —those don't need your permission— and one analytics cookie that is only set if you accept it. No advertising or profiling cookies.
| Name | Owner | Type | Purpose | Lifetime |
|---|---|---|---|---|
| uf_session | First-party | Strictly necessary | Keep you signed in to your account. | 30 days |
| uf_volver | First-party | Strictly necessary | Bring you back to where you were after signing in. | 10 minutes |
| uf_yo | First-party | Strictly necessary | Open your personal profile on this device. | 12 months |
| lanzamiento · pulse_plan | First-party | Strictly necessary | Grant access to code-protected pages. | 30 days |
| uf.consentimiento (localStorage) | First-party | Strictly necessary | Remember your cookie choice. | 12 months |
| uf-tema, unifyflow.*, uf-*, vela-*, listening.* (localStorage) | First-party | Strictly necessary | Preferences you choose: theme, panels and rooms created from this browser, course or game progress. | Until you clear them |
| __cf_bm | Cloudflare (third party) | Strictly necessary | Security: telling humans from bots. | 30 minutes |
| ph_<proyecto>_posthog | PostHog (third party, on our behalf) | Analytics (consent) | Count visits and journeys pseudonymously to improve the product. Only if you accept it. | 12 months |
Changed your mind? and accept or reject analytics. If you withdraw, we stop measuring and delete the ph_* cookies from this browser. You can also delete them from your browser settings.
7. Legal notice
- Owner: CooWeb
- Contact: hola@unifyflow.app
UnifyFlow is proprietary software of CooWeb: its code, brand, logo and site content. Its use, whether in UnifyFlow's cloud or installed on the customer's own infrastructure (self-hosted), is governed by the terms of the plan purchased. AI-generated answers quote who said what and flag anything nobody said as a model inference; they support decisions, they don't replace judgment. Governed by Spanish law.