Privacy policy

Unit (the "Company", "we", "us") is a social-media management platform for small and medium-sized businesses, operated from Ghana. Unit helps businesses publish posts, manage comments and mentions, handle Messenger and Instagram direct messages, read analytics, and draft replies and captions with an AI assistant — all from a single dashboard for their connected Facebook Pages and Instagram accounts.

Throughout this policy:

• "Customer" means a business (and the people on its team) that has signed up for Unit and operates a workspace.
• "End user" means a person who interacts with a Customer's connected Facebook or Instagram account — for example by commenting on a post or sending a direct message — and whose interaction therefore flows through Unit.
• "You" refers to either a Customer or an End user, depending on context.

From Customers (signup + workspace)

• Name, email address, hashed password, and the workspace name + slug they choose.
• Optional: profile photo (avatar), workspace and brand details, knowledge-base entries you add for the AI assistant, and notification preferences.
• Connection details for the Facebook Pages and Instagram accounts you link, including the access tokens Meta issues. These tokens are stored encrypted and are never displayed back to you after they are saved.

From connected channels (Facebook & Instagram)

When you connect a Facebook Page or Instagram account through Meta, Unit accesses — on your behalf and within the permissions you grant — the data needed to run the product:

• Your published posts, reels, and stories, plus the posts you schedule and publish through Unit.
• Comments and mentions on your content, and the public profile name and ID of the people who leave them.
• Messenger and Instagram direct messages sent to your account — message content, attachments, sender display name and ID, and timestamps.
• Page and account insights / metrics (reach, impressions, engagement, audience snapshots) used to power Analytics.
• Media you upload to create posts (images, video).

Automatically

• Server logs (IP address, user agent, request paths, timestamps) for security, abuse detection, and basic operational telemetry.
• Append-only audit-log entries for sensitive actions (e.g. sign-in, connecting a channel), which retain a hashed reference rather than raw personal data, kept for a 90-day window.
• Aggregate, non-identifying usage statistics (e.g. how many posts a workspace published in a period).

• Provide the service: publish and schedule posts, reels, and stories; surface comments and mentions in Engage; deliver Messenger and Instagram DMs in the Inbox; and compute Analytics for your connected accounts.
• AI-assisted features: Unit AI drafts replies, captions, and suggestions, and powers the operator assistant, using your workspace content, knowledge-base entries, and the relevant conversation or comment context. You stay in control — AI output is meant to be reviewed before it is sent.
• Account management: authenticate logins, send teammate invites, password resets, email verification, and important product notices.
• Support: respond to your help requests at [email protected].
• Security & abuse prevention: detect fraud, throttle suspicious traffic, and comply with lawful requests.

We do not use your content or your End users' messages and comments to train any general-purpose AI model.

Unit connects to Facebook and Instagram through Meta's official Graph API, using Facebook Login for Business and Instagram Business Login. We request only the permissions needed to operate the features above — for example reading and publishing Page content, reading and replying to comments, sending and receiving Messenger and Instagram messages, and reading insights.

We access, store, and process Meta Platform data solely to provide the Unit features you use, in line with the permissions you grant. We comply with Meta's Platform Terms and Developer Policies, including their data-use, retention, and deletion requirements. We do not sell Platform data, share it with data brokers or advertising networks, or use it for any purpose beyond operating the service for the connected Customer. You can revoke Unit's access at any time by disconnecting a channel in the dashboard or from your Facebook or Instagram settings.

To generate captions, reply suggestions, and assistant responses, Unit sends the necessary context — such as the relevant comment or message thread, your knowledge-base snippets, and the brand details you provide — to third-party AI model providers (for example, OpenAI and Anthropic). This data is processed only to produce the requested output and, under our provider agreements, is not used to train their general models.

We use a small number of vetted service providers to run Unit. We share only the data each one needs to do its job and have data-processing terms in place where applicable.

• Meta Platforms: the Facebook and Instagram Graph APIs that deliver posts, comments, and messages between Customers and End users.
• AI model providers (for example, OpenAI and Anthropic): power caption drafting, reply suggestions, and the assistant. We send the prompt and the context needed to generate a response; this data is not used to train their general models.
• Resend: transactional email (account verification, teammate invites, password resets) sent on Unit's behalf.
• Cloud object storage (Contabo, S3-compatible): stores uploaded media, avatars, and workspace files, plus encrypted backups.
• Hosting provider (VPS): runs the Unit application and database.

We do not sell personal data, share it with advertising networks, or use it to train models outside the AI-assistance flow described above.

• Customer accounts: retained for the life of the account. Deleted accounts are anonymised immediately and removed; encrypted backups containing the data expire within 30 days. See our data-deletion guide for the full procedure.
• Workspace content (comments, messages, analytics, contacts): retained while the workspace exists. Deleting a workspace starts a 30-day recovery window, after which the data is purged.
• Uploaded media: to minimise the data we hold, media is purged from our storage shortly after a post is published and the post then references the copy hosted on Meta. Media kept in your library and media attached to drafts or scheduled posts are retained until you remove them.
• Audit logs: 90 days.
• Backups: encrypted snapshots retained for up to 30 days.

The dashboard stores your sign-in session and a small number of UI preferences in your browser. The marketing site stores only your dark/light theme choice. We do not use third-party tracking or advertising cookies.

The following are in place today:

• Workspaces are isolated from one another at the database level using Postgres row-level security, so one workspace cannot read another's data.
• Channel access tokens are encrypted at rest; the dashboard never shows raw credentials again after they are saved.
• Public traffic is served over HTTPS.
• Incoming platform webhook events are verified before they are accepted.
• Sensitive actions on a workspace are audit-logged.
• Uploaded files are stored privately and served only to authorised workspace users through short-lived signed links.

We have not yet pursued external compliance audits (SOC 2, ISO 27001). When we do, we'll update this page.

We do not sell personal data. We share data only with the sub-processors named above, and only as needed to run the service. We may disclose data where required by law or to protect the safety of users.

Under the Ghana Data Protection Act, 2012 (Act 843), and — depending on where you are — laws such as the EU/UK GDPR, you may have rights to access, correct, export, or delete the personal data we hold about you, and to object to certain processing or withdraw consent. To exercise any of these, use the data-deletion page or email [email protected]. We respond within 30 days.

If you are an End user (i.e. you commented on or messaged a Unit Customer's account), the Customer is the data controller for that interaction and Unit is the processor. We will forward your request to the relevant Customer and act on it on our side. In Ghana, the supervisory authority is the Data Protection Commission.

Unit operates from Ghana, and some sub-processors — including our AI, email, and Meta integrations — may process data in other regions such as the United States or Europe. Where required, we rely on standard contractual clauses and equivalent cross-border data-transfer mechanisms.

Unit is a business tool and is not directed at, or intended for, anyone under 18. We don't knowingly collect personal data from minors. If you believe we have, email [email protected] and we'll delete it.

If Unit is acquired, merged with another company, or sold, personal data may be transferred as part of the transaction, subject to the new owner agreeing to a privacy policy at least as protective as this one. We'll notify Customers in advance.

We may update this policy as the product evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced via in-app notice or email to Customers before they take effect.

Questions, requests, or concerns: [email protected].