Argilla Holding B.V. — Unico Privacy Policy

Version 1 · Effective November 9, 2026

Unico is an email app that runs on your computer. This policy explains what happens to your data. The short version:

Your mail, your Google sign-in tokens and your mail metadata stay on your device. Unico's servers never receive your mail, and we have no copy of it. The app sends mail data only to Google and to recipients you choose.
We do process a small amount of data to sell and license the app, deliver updates, and answer support requests. Each item is listed below with its purpose, legal basis and how long we keep it.
Crash reports are sent only with your consent: when you turn them on, or when you agree to send one after a crash. Automatic update checks are on by default, because they deliver security fixes; you can turn them off (section 10). One small safety check stays on (section 4).

1. Introduction

1.1 This Privacy Policy explains how Argilla Holding B.V. (“Unico”, “we”, “us”, “our”), a private limited company (besloten vennootschap) incorporated under the laws of the Netherlands, registered at the Chamber of Commerce (Kamer van Koophandel) under number 30263469, with its registered office at Wilhelminapark 42, 3581 NK Utrecht, the Netherlands, collects, uses, shares, and protects personal data.

1.2 This Privacy Policy applies when you:

use the Unico app for macOS (the “app”) and the license and update services it contacts;
buy a subscription through our reseller Paddle;
visit our website at https://unicomail.app;
communicate with us, including through support or security email.

1.3 Unico acts as a data controller for the personal data described in sections 4 and 5 (data we process for our own purposes, such as licensing, updates and support). For the mail the app handles on your computer, Unico is neither controller nor processor, because we never receive it (section 2).

1.4 We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming, “UAVG”).

1.5 If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at privacy@unicomail.app. We have not appointed a data protection officer because the law does not require one for our processing. Before we sell to customers in the United Kingdom, we will appoint a representative there under Article 27 of the UK GDPR and name them here.

2. Mail that stays on your device

With your permission, the app on your computer connects directly to your Gmail account and downloads your messages, attachments, labels and drafts. It uses this only to show, search, organize, draft and send your email in the app.

Where it is stored: in a database on your device, encrypted with SQLCipher; the key is kept in your operating system's keychain. Your Google sign-in token is also kept in the keychain.
Exceptions: an attachment you open is written unencrypted to a temporary folder, which Unico clears when it closes; the app you open it with may keep its own copies. Your operating system may keep notification previews (sender and subject) and backups (for example Time Machine) that include the encrypted database. If you share analytics with Apple in your macOS settings, macOS may send Apple a report when the app crashes.
How much is stored: when you add an account, the app downloads message text from the last 30 days, message details from the last 90 days, and the newest 1,000 threads in your Inbox and in Starred at any age. Mail you scroll to, mail found when you search Gmail from the app, and mail fetched if you turn on full backfill is also stored. Images you choose to load are cached with the message (up to 200 MB in total). Message text, and the images cached with it, is deleted from your device 30 days after the message arrived or was last downloaded, whichever is later, unless it is a draft, in a starred thread, or waiting on an action you took; opening it again downloads it fresh. Message details (sender, subject, date, labels) stay on your device until you remove the account or use “Remove all data”.
Our role: because we never receive this data, Unico is neither the controller nor the processor of it. You (or your employer, for a work account) decide what happens to it. This also means we cannot answer access or deletion requests for your mail: you control it in the app and in your Google account.

Deleting it

Settings → Accounts → Remove from this Mac deletes Unico's database records, caches and keychain entries for that account on this computer.
Remove and revoke access everywhere also withdraws Unico's access in your Google account (this signs Unico out on your other computers too). You can also revoke access at myaccount.google.com/permissions.
Settings → Remove all data removes every account, the database and the keychain entries. Run it before uninstalling: dragging the app to the Trash leaves the encrypted database and keychain entries behind.
Copies kept by your operating system or other apps (above) are not affected. Our support page explains how to remove them.

Remote images

Images that load from the internet are blocked by default. If you choose to load them for a message or a sender, your computer contacts the sender's servers. They receive the image addresses written into the message, your IP address, and so the fact that you opened it. Unico is not involved in that connection.

People from your Contacts

When you address an email, the app suggests people you have written to or who have written to you, from the mail on your device. If you allow it, it also suggests people from the Contacts app on your Mac: it reads their names and email addresses on your computer, keeps them in memory only while the app runs. They are never sent anywhere or shared with us, and never stored, with one exception: if you remove someone from suggestions, the app keeps that email address on your device so they stay removed. macOS asks you first; you can turn access off at any time in System Settings → Privacy & Security → Contacts.

One-click unsubscribe

If you choose Unsubscribe on a message that offers it, the app contacts the unsubscribe address the sender put in that message, after a 10-second hold in which you can undo. The sender's server receives your IP address and a code from the message that tells it which subscriber is leaving, so the sender learns that you unsubscribed. If the sender only offers unsubscribing by email, the app sends that email from your account to the address the sender gave. Unico is not involved in either.

3. Google user data

Unico's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

What we access: with the permission https://www.googleapis.com/auth/gmail.modify, and no other Google permission: message contents, attachments, headers, labels, drafts and change history.
Why this permission: the app reads your mail to show and search it, changes labels when you archive, snooze, mark as read or move mail, saves drafts, and sends mail. Narrower Gmail permissions cannot do all of these together. The app never deletes mail permanently; deleting moves mail to Gmail's Trash.
How it is used: only to provide the email features you use in the app.
Who it is shared with: Unico does not sell, share or use your Gmail data for advertising. Your mail goes from your device to Google and back. Apart from that, Gmail data leaves your device only in these cases:
- if you load remote images, the senders' servers receive the image addresses taken from the message and learn that it was opened (section 2);
- if you unsubscribe from a mailing, the sender receives the unsubscribe request (section 2);
- once AI features exist, if you turn one on, the AI provider you choose receives what that feature needs, directly from your device (section 7);
- if you send us a message, for example a support request, we receive what you put in it.
What we never do: use Google data for advertising, sell it, give it to data brokers or use it for credit decisions. Unico does not use Google user data, or data derived from it, to develop, improve or train generalized or non-personalized AI or machine-learning models, and does not transfer it to anyone for that purpose.
People reading your mail: Unico's servers never receive your mail, and we have no copy of it. If you choose to send us a message, for example in a support request, we use it only to answer you and delete it 90 days after the ticket closes.
Updates: app updates are signed and published with release notes. An update never adds a new place your mail is sent without this policy being updated first and, where Google requires it, your agreement.
Protection: see section 2 (encryption on your device) and section 11.

4. Data we process, why, and on what basis

We process personal data only where we have a valid legal basis under Article 6(1) GDPR. The table below sets out our processing purposes, the corresponding legal basis, and how long we keep the data.

What	Data	Purpose	Legal basis	Kept for
Purchase and license	Email address, license id, plan, expiry dates. Received from Paddle (see below)	Issue your license	Performing our license agreement with you (Art. 6(1)(b))	Not stored on our servers: the license is a signed file kept on your device. Server logs: deleted automatically after 14 days (removal can take up to a few further days at our provider)
License renewal (every 7 days for subscriptions)	IP address, your signed license (email, license id). We then ask Paddle whether the subscription is active	Keep your subscription working	Art. 6(1)(b); rate limiting per IP address on our legitimate interest in preventing abuse (Art. 6(1)(f))	Server logs, as above
Update check and downloads	IP address, platform, app version, app identifier, time	Deliver security updates (and tell the app about feature updates in the same answer); download updates	Our legitimate interest, and yours, in keeping the app on your computer secure (Art. 6(1)(f)). You can object (section 10)	Server logs, as above . Access logs of the download network: not collected
Safety check	IP address, app identifier, time	Tell the app whether its version or your system's web engine is unsafe, so it can switch to a safe mode	Art. 6(1)(f): security of your device and of the people who write to you	As above
Crash reports (only with your consent)	Error type, code locations, app version, operating system, processor type. Never message content, addresses or subjects. Your IP address reaches our crash-report provider when a report is sent but is not stored	Find and fix crashes	Your consent (Art. 6(1)(a)): turning crash reports on, which you withdraw any time in Settings, also deleting unsent reports, or agreeing to send one report after a crash	At most 90 days, at our provider
Support	Whatever you send us. Please don't send email content or screenshots of your mail; “Copy diagnostics” in the app gives us what we need without any mail	Answer you	Art. 6(1)(b) or our legitimate interest in helping users (Art. 6(1)(f))	90 days after the ticket closes
Support and account administration	Buyer details we look up in Paddle's dashboard (name, email, country, order and subscription status) and occasional exports	Answer license and billing questions; fix license problems	Art. 6(1)(b); our legitimate interest in supporting customers (Art. 6(1)(f))	Paddle keeps the records; our exports are deleted after use
Security reports	Your name or handle, email address and what you report to security@	Fix vulnerabilities, credit you if you want	Art. 6(1)(f); legal obligations for vulnerability handling (Art. 6(1)(c))	Until the issue is fixed and disclosed, then 2 years
Abuse monitoring of our Google sign-in client	Daily counts Google shows us for our app: requests, errors, grants and active users	Detect abuse of Unico's public sign-in client	Art. 6(1)(f)	Not exported; viewed in Google's console
Website	IP address, browser identifier, page, time	Serve and secure the website	Art. 6(1)(f)	None kept: our host keeps no access logs for us. The website sets no cookies and runs no analytics
Accounting	Payout reports from Paddle, which may include buyer details	Bookkeeping and tax	Legal obligation (Art. 6(1)(c)): Dutch tax law	7 years

Legitimate interest balancing: Where we rely on legitimate interest, we carry out a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may contact us to request details of these assessments.

Your crash-report choice: when you turn crash reports on, the app notes on your device when you did and which version of the description you agreed to. It is never sent, and turning crash reports off deletes it.

After a crash: if Unico crashes while it can't send a report (crash reports are off, or not yet started), the app keeps that one report on your device, with the same details as above and nothing else. If Unico keeps running, the report is deleted when you quit. If Unico quit unexpectedly, it asks at the next launch whether to send the report once, always (which turns crash reports on), or not at all. Nothing is sent before you answer, unless crash reports were already on when the crash happened. If you turn crash reports on in Settings instead of answering, the report is deleted, not sent. If you send it once, the app notes on your device when you agreed and which version of the description you saw, until you next send one or remove all data; it is never sent. The report is deleted when you answer, after 30 days without an answer, or when you remove all data.

Do you have to give us data? An email address is needed to issue a license (it comes from your purchase). The update check and safety check happen automatically unless you turn update checks off. Everything else happens only when you use a feature.

Data we receive from Paddle (Art. 14 GDPR): Paddle is the reseller and merchant of record for Unico. When you buy, Paddle sends us your email address, license or subscription id, plan and dates. To answer support and license questions we can also look up your purchase in Paddle's dashboard. Paddle's own handling of your payment and billing data is described in Paddle's privacy notice; Paddle is an independent controller, not our processor.

Why the app contacts our server at all: the license renewal, the update check and the safety check read information stored in the app on your device (your license, the app version) and send it to us. EU rules on access to your device allow this without separate consent only when it is strictly necessary for the service you asked for. We rely on that exemption for: license renewal (needed for your subscription); the update check, which is one request carrying only your platform and app version and exists to deliver security updates (whether to install feature updates is decided by the app on your device); and the safety check. You can turn automatic update checks off (section 10).

No marketing email. We don't send newsletters or marketing. If we ever do, it will only be after you tick an opt-in box. Emails about your license or purchase come from Paddle.

No automated decisions. We make no decisions about you based solely on automated processing (Art. 22 GDPR).

No special categories. We do not process special categories of personal data as defined in Article 9 GDPR (e.g., health data, biometric data, racial or ethnic origin, political opinions, religious beliefs) for our own purposes. Mail on your device may contain such data; we never receive it.

5. Who receives data

We share personal data only where necessary and with appropriate safeguards. We do not sell personal data.

5.1 Service providers (subprocessors)

Our processors act on our instructions under a data processing agreement: Amazon Web Services (license and update service, downloads, DNS, website), Sentry (crash reports, only if you opt in) and Google (Google Workspace, for our support, privacy and security mailboxes). The full list, with what each receives and where, is on our Subprocessors page.

5.2 Independent controllers

Paddle (purchase, payment, tax, invoices, fraud prevention). The tax authority, which receives our accounting records where tax law requires it.

5.3 Recipients you choose

Google (your mailbox); senders' servers, if you load remote images or unsubscribe from a mailing (section 2); an AI provider you choose, once AI features exist and only if you turn one on (section 7). We do not send them data; the app on your device does, on your instruction.

5.4 Other disclosures

We may also share personal data:

With your consent — where you have given explicit permission.
For legal compliance — to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
To protect rights and safety — to enforce our Terms of Service, protect against fraud, or protect the rights, property, or safety of Unico, our users, or the public.
In business transfers — in connection with a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the successor entity. We will notify you of any such change and any choices you may have regarding your data.

6. International data transfers

6.1 Our servers store data in the European Economic Area (“EEA”). Some processors are US companies or serve content worldwide:

Amazon Web Services: downloads and update files are delivered through a worldwide content network, so your IP address may be processed outside the EEA, including in the US. Safeguards: the EU Standard Contractual Clauses in AWS's data processing terms, and the EU–US Data Privacy Framework, under which Amazon Web Services, Inc. is certified.
Sentry: data is stored in the EU, and the US parent may access it. Safeguards: the EU–US Data Privacy Framework, under which Functional Software, Inc. (Sentry) is certified, and Standard Contractual Clauses.
Paddle: which Paddle company sells to you depends on where you are: Paddle.com Market Limited (UK) for buyers outside the US and Canada, Paddle.com Inc. in the US, and Paddle.com (Canada) Ltd. in Canada. Transfers to Paddle.com Market Limited rely on the EU adequacy decision for the UK; all rely on the clauses in Paddle's data sharing terms.
Google (Google Workspace): our support, privacy and security mail may be stored wherever Google or its subprocessors have facilities, including the US. Safeguards: the EU–US Data Privacy Framework, under which Google LLC is certified, and the Standard Contractual Clauses in Google's data processing terms.

6.2 Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place in accordance with Chapter V GDPR, including:

Standard Contractual Clauses (SCCs) — as adopted by the European Commission;
Adequacy decisions — where the European Commission has determined that the receiving country provides an adequate level of data protection;
Supplementary measures — where necessary, including encryption and access controls.

6.3 You may request a copy of the relevant transfer safeguards by contacting privacy@unicomail.app.

7. AI features

The app has no AI features yet; they are planned for an update before Google verifies the app. Until that update, the app sends nothing to any AI provider. This section describes them as they will work.

7.1 AI features will be optional and off by default. The planned features are rules and auto-labels (the app asks a model a yes-or-no or multiple-choice question about a new message), summaries of a thread, writing help in a draft, and Ask AI, an assistant that answers questions about your mail.

7.2 To use one, you will add your own API key for a provider you choose and agree once for each feature and each provider. Changing provider will ask again. The app will then send the data the feature needs directly from your device to that provider, using your key. No Unico server will be in between, and we will never see the content. What each feature will send:

Rules and auto-labels: only the fields the rule needs, cut to fixed lengths (for example sender, subject and the first 200 characters of the text). Addresses and phone numbers outside those fields, long numbers, links and codes will be masked.
Summaries: the sender, subject and full text of the thread you summarize.
Writing help: the draft you are writing, and the thread you reply to if you include it.
Ask AI: for each question, the full headers (including addresses) and text of up to 20 threads the assistant finds in the accounts you enabled, and the text of text attachments it opens. This will not be masked, because answers like "who emailed me about X" need addresses.

7.3 The consent screen for each feature will list exactly what that feature sends. One switch in Settings → AI will turn all AI features off at once; while it is off, the app will send nothing to any AI provider. You will be able to turn a single feature off or remove a key at any time. For a work account, your organization may restrict sending its mail to AI providers, and the app will remind you.

7.4 The providers you will be able to choose are Jev (TypeSafe, api.typesafe.ai) and OpenAI (api.openai.com) for rules and auto-labels, Anthropic (api.anthropic.com) and OpenAI for summaries, writing help and Ask AI (and for rules), or a model on your own computer (Ollama, LM Studio), which the app will check stays on your computer. We will offer as presets only providers whose standard API terms say API data is not used for training. Your own agreement and account settings with that provider govern what it does with the data. Don't use a key from an account where you have turned on data sharing or training.

7.5 Sending data to the provider you choose will be a transfer of Google user data that follows Google's Limited Use requirements (section 3): it will happen only to provide the feature you turned on, and neither we nor the app will use it to train generalized AI models.

7.6 AI output can be wrong. Nothing will be sent or changed without you: rules will start in a trial mode and then ask before acting, and Ask AI will only propose changes for you to confirm. AI summaries will be labeled as such in the app. Writing help will rewrite or proofread text you wrote; composing a whole message from a prompt will not be offered until the EU's guidelines on marking AI-generated text are final.

8. Cookies and similar technologies

The website sets no cookies, uses no local storage, and loads no analytics, scripts, fonts or other content from third parties, except Paddle's checkout script after you click “Buy”. If you click “Buy”, Paddle's checkout loads, and Paddle's privacy notice covers what it stores on your device.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The period for each item is in the “Kept for” column in section 4.

After the applicable retention period expires, we either delete or anonymize the data so that it can no longer be associated with you.

10. Your rights

As a data subject, you have the following rights under the GDPR and UAVG:

Right	Description
Access (Art. 15)	Request a copy of the personal data we hold about you.
Rectification (Art. 16)	Request correction of inaccurate or incomplete personal data.
Erasure (Art. 17)	Request deletion of your personal data, subject to legal exceptions.
Restriction of processing (Art. 18)	Request that we limit how we process your data in certain circumstances.
Data portability (Art. 20)	Receive your personal data in a structured, commonly used, machine-readable format.
Objection (Art. 21)	Object to processing based on legitimate interest or direct marketing.
Withdraw consent (Art. 7(3))	Withdraw any previously given consent at any time, without affecting the lawfulness of processing before withdrawal.
Not be subject to automated decision-making (Art. 22)	Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Unico does not currently make such automated decisions.

10.2 How to exercise your rights

You can ask in any way that reaches us; privacy@unicomail.app is the quickest. If we have reasonable doubts about who you are, we may ask you to confirm it, for example by replying from the email address on your license or giving your Paddle order number.

We will respond to your request within one (1) month. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. We will inform you of any extension within one month of receipt of the request.

We will not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive (in which case we may charge a reasonable fee or refuse the request, with reasons).

What we can actually do:

License and purchase data: your request covers what we can retrieve: server logs (deleted after 14 days), what we can look up about you in Paddle's dashboard, any exports we still hold, and payout reports that mention you. We give you that, and pass requests for data only Paddle holds to Paddle.
Support email: we search our support mailbox and delete what we find unless we must keep it.
Your mail: we hold none; use the deletion steps in section 2.
If someone else's email mentions you: we do not hold your messages; mail lives on the account holder's device. We check our support mailbox and delete what we find unless we must keep it. Crash reports contain no name or email, so we cannot link them to you (Art. 11 GDPR) unless you give us the event ID shown in the app.

10.3 Your right to object

You can object at any time to processing based on our legitimate interests (update checks, the safety check, website logs, rate limiting at license renewal).

Update checks: turn off Settings → Updates → Check automatically. You can also postpone an update, or choose not to install feature updates. If you turn update checks off, the app warns you that you may miss fixes for vulnerabilities in how mail is displayed.
Safety check: this stays on even when update checks are off, because it is the only way to protect you if a version turns out to be unsafe. If you object, write to us; we assess it case by case, and may continue where our grounds override yours (Art. 21(1) GDPR).
License renewal: renewal itself is needed to perform your subscription; you can stop it by ending the subscription. The rate limiting by IP address at renewal is based on our legitimate interests: if you object to it, we assess the objection case by case.

10.4 Right to lodge a complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In the Netherlands, the competent authority is:

Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30, 2594 AV Den Haag
https://www.autoriteitpersoonsgegevens.nl

You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence or place of work.

11. Security

11.1 We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. We limit what we collect, keep no customer database on our servers, delete server logs after 14 days, protect administrative accounts with passkeys or hardware keys, and keep signing keys in non-exportable or offline storage.

11.2 While we take reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

11.3 In the event of a personal data breach as defined in Article 4(12) GDPR that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.

11.4 To report a vulnerability, see our security and disclosure policy.

12. Children

The app is not intended for anyone under 16. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 16, please contact us at privacy@unicomail.app.

13. Changes to this Privacy Policy

13.1 We may update this Privacy Policy from time to time to reflect changes in our practices, the app, or applicable law. Every version is kept with its version number and effective date, and earlier versions remain available on this page.

13.2 If we make material changes, we will provide notice in the app at least fourteen (14) days before the changes take effect.

13.3 If a change affects how Google user data is used, we tell you in the app and ask for your agreement before the new use starts.

14. Contact details

If you have questions about this Privacy Policy, wish to exercise your rights, or want to make a complaint, please contact us at:

Argilla Holding B.V.
Attn: Privacy
Wilhelminapark 42
3581 NK Utrecht
The Netherlands

Email: privacy@unicomail.app