Privacy Policy

1. Who Operates the Service & Scope

UNRAVLER TECHNOLOGIES (registered under Udyam registration UDYAM-JH-20-0144275) operates Unravler Outreach from Om Niwas, Near Over Bridge, Anantpur Road, New Anantpur, Ranchi, Jharkhand 834002, India. For any privacy, data protection, or compliance inquiries, you can contact our privacy desk at [email protected] or via our Contact Us page.

This Privacy Policy applies to visitors of www.unravler.com, workspace owners and team members using app.unravler.com, connected sender accounts, and individuals who contact us. If you do not agree with the data practices described in this Privacy Policy, you should not use the Website or the Subscription Service. We periodically update this Privacy Policy and will post the updated version with a revised “Last updated” date at the top of this page.

2. Use of the Subscription Service by Our Customers

Our cloud Subscription Service enables B2B founders, sales teams, agencies, and recruiters to organize outbound prospecting across LinkedIn and email—including building lead lists, running visual multichannel sequences, warming up prospects through Engage Draft & Review, and managing replies in a Unified Outreach Inbox.

When a workspace member imports or creates prospect lists, campaign sequences, lead tags, or CRM webhook payloads within Unravler Outreach (“Customer Workspace Data”), that data is stored and processed on our infrastructure on behalf of the customer. Unravler does not independently control the composition of a customer’s prospect lists or the business outreach campaigns a customer chooses to run; our customers act as the data controller for the prospect lists they curate, and Unravler processes that information strictly as directed by the customer to provide, secure, and maintain the Subscription Service.

3. Types of Data We Collect

• Account, Identity & Contact Details: When you register for an account, accept a workspace invitation, or contact us via our Contact Us form, we collect your name, work email address, authentication identifiers, workspace membership, role permissions (Owner, Admin, Editor, Client, Viewer), and support message history.
• LinkedIn Session Cookies & Sender Connection Data: With your explicit authorization when connecting a sender seat, we process the LinkedIn session cookies that you deliberately provide—specifically li_at and JSESSIONID (and optional li_a)—together with your selected proxy country, sender display name, daily activity control limits, and connection health status. We never ask for or store your LinkedIn account password in this flow.
• Connected Email Mailboxes & Enrichment Keys: If you connect a Gmail or Microsoft 365 mailbox for multichannel sequences or configure an optional Hunter.io enrichment key, we store encrypted OAuth tokens or API credentials and process email headers, recipient addresses, thread identifiers, and message bodies needed to execute and track your sequences.
• Outreach, Campaign & Prospect Information: Lead lists (imported via CSV or LinkedIn search/post/group URLs), lead filtering rules, visual sequence DAG steps, message templates, A/B test variants, Engage warm-up drafts, recorded engagement timestamps, and Unified Inbox conversation histories.
• Billing & Pilot Operations Information: Requested sender seat counts (1–5 seats at $59/sender/month), requested proxy country, billing contact email, invoice and operator-verification records, paid-through dates, and cancellation state. We do not collect raw payment-card numbers on this site.
• Usage, Navigational & Technical Log Data: When you visit our Website or use our Web Application, we automatically collect IP address, browser type, operating system, referring URLs, feature interaction events, and security audit logs to maintain reliability, prevent abuse, and improve user experience.

4. How We Use Information We Collect

We Never Sell Personal Information: Unravler will never sell, rent, or trade your Personal Information, LinkedIn session credentials, or workspace prospect lists to any third party.

We use the information we collect for the following specific purposes:

• To Operate & Secure Unravler Outreach: Authenticating your session, enforcing workspace role-based access control (RBAC), verifying sender connections, leasing dedicated country-matched static residential (ISP) proxies, and executing the campaign sequences and inbox workflows you configure.
• To Provide AI-Assisted Drafting & Personalization: When a workspace member requests AI icebreakers, message improvements (“Improve with AI”), or Engage comment suggestions, relevant prospect context and prompt instructions are sent to our AI provider to generate a draft for human review.
• To Improve Product Reliability & Analytics: Analyzing aggregated feature adoption, sequence compiler diagnostics, and subscription quota usage so we can improve performance and user experience.
• To Provide Customer Support & Transactional Notices: Responding to inquiries sent to [email protected], sending password-reset links, workspace invitations, security alerts, and pilot billing updates.

5. LinkedIn Session Connections & Dedicated ISP Proxies

Unravler Outreach’s sender connection uses session cookies (li_at / JSESSIONID) rather than a LinkedIn password. All session cookies and tokens are encrypted using envelope encryption before database storage and are immediately scrubbed if a sender is disconnected or a paid pilot term expires. When a sender connection is verified or an authorized action runs, traffic is routed through a dedicated, country-matched static residential (ISP) proxy leased exclusively to that single sender seat.

Please note that Unravler Outreach is an invite-only pilot and live LinkedIn actions are disabled by default unless explicitly enabled for an active workspace. LinkedIn’s User Agreement restricts unauthorized automated access. Using a dedicated proxy, working-hours schedule, or daily rate limit reduces request volume but does not make unofficial session automation compliant with LinkedIn’s terms or eliminate the risk of account restriction or account suspension.

6. Google API & Connected Mailbox Data Compliance

Where you choose to connect a Google / Gmail account to Unravler Outreach, our use and transfer to any other app of information received from Google APIs strictly adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We only request the minimum necessary Google OAuth scopes required to send outreach emails and synchronize replies for the mailbox you explicitly connect.
• We never use Google user data (including Gmail message content or metadata) for advertising, ad targeting, or training generalized AI models, and we never sell Google user data to third parties.
• Human access to connected mailbox data is strictly prohibited unless we have your explicit consent to troubleshoot a specific support issue, it is required to investigate abuse or security incidents, or it is mandated by applicable law.
• All OAuth access and refresh tokens are stored encrypted at rest and can be revoked at any time from Settings → Email mailboxes or your Google Account security settings.

7. Third-Party Processors & How We Share Data

We share data only with vetted infrastructure and service providers (“Subprocessors”) strictly as needed to deliver the Subscription Service:

• Cloud Infrastructure & Hosting: Vercel (frontend hosting & edge delivery) and Amazon Web Services / MongoDB / Redis (encrypted application backend, database, and task queues).
• Authentication & Identity: Google Firebase Authentication (sign-in, password reset, and token verification) and Cloudflare Turnstile (bot protection).
• Dedicated Proxy Connectivity: IPRoyal and Webshare (country-matched static residential ISP proxy routing for connected sender seats).
• Product Analytics: PostHog US Cloud (workspace usage telemetry and product performance diagnostics).
• AI & Voice Synthesis (Optional Features): Google Gemini API (AI-assisted copy drafting and comment suggestions) and ElevenLabs (optional voice note synthesis when Voice Studio is enabled).
• Transactional Email: Amazon SES / Resend / Firebase Identity Toolkit (password reset links, workspace invites, and support notifications).

We may also disclose information where required by law, subpoena, or court order, or when reasonably necessary to protect the security, rights, and safety of Unravler, our users, or the public.

8. Cookies & Browser Storage

We use essential cookies and browser storage (such as session cookies and authentication tokens) to keep you signed in to app.unravler.com, protect against cross-site request forgery, and remember your interface preferences. Where configured, we also use PostHog analytics to understand product usage and improve workflows. You can disable non-essential cookies at your convenience, though blocking strictly necessary authentication storage will prevent sign-in to the web application. For a complete breakdown, please review our Cookie Policy.

9. Data Security, Retention & Workspace Lifecycle

We protect your information using physical, technical, and organizational safeguards—including TLS encryption in transit, envelope encryption at rest for sender session secrets and OAuth tokens, strict workspace isolation, and multi-factor authentication (TOTP MFA) support.

We retain Personal Information and workspace records for as long as your account is active or as needed to provide the Subscription Service, comply with legal and tax obligations, resolve disputes, and enforce our agreements. When a paid pilot period expires, active campaigns and background workers are automatically paused, queued live tasks are canceled, and stored sender session secrets are scrubbed, while your campaign configurations, lead lists, and invoices remain accessible for review unless you request deletion.

10. Your GDPR, DPDP & Global Data Protection Rights

Depending on your location (including under the EU/UK GDPR and India’s Digital Personal Data Protection Act, 2023), you have the following rights regarding your personal data:

• Right to Be Informed & Right of Access: Request confirmation of how we process your personal data and obtain a copy of the personal data we hold about you.
• Right to Rectification: Update or correct inaccurate or incomplete account information at any time via your workspace settings or by contacting us.
• Right to Erasure (Deletion): Request that we delete your account, connected sender credentials, or workspace data. You can also read our Data Deletion guide or email [email protected].
• Right to Restrict Processing & Right to Object: Ask us to pause or limit how we process your data, or object to processing conducted under legitimate interests or direct marketing.
• Right to Data Portability: Request an export of the data you have provided to us in a structured, commonly used machine-readable format (such as CSV/JSON).
• Right to Withdraw Consent & Unsubscribe: Withdraw consent at any time where processing is based on consent, or opt out of non-essential communications using the unsubscribe link in our emails or by messaging [email protected].

To exercise any of these rights or reach our Grievance Officer (Bindu Prasad, Proprietor, UNRAVLER TECHNOLOGIES), email [email protected] or submit a message on our Contact Us page. The Service is intended exclusively for business users aged 18 and older; we do not knowingly collect data from anyone under 18.