Privacy Policy

Last updated: 2026-07-07

Draft status: This policy is a working draft prepared for review by counsel. Questions: legal@theunnamed.dev.

1. Who we are

The Unnamed Corp ("Unnamed", "we", "us") is a custom software studio headquartered in Alberta, Canada. This policy covers the marketing site at theunnamed.dev, the Unnamed platform (the "Platform"), and data we handle while delivering engagements ("Services"). Where we process personal data inside a client's systems under a Statement of Work ("SOW"), we act as a processor on the client's instructions — that processing is governed by our Data Processing Agreement, not this policy.

2. What we collect

Information you provide directly: name, email address, company, and project details when you use the contact or start-a-project forms; account details (name, email) when you register for the Platform; billing details when you purchase Services — payments are handled by Stripe, and we never store full card numbers on our servers.

Information collected automatically: product analytics events via PostHog (configured to avoid capturing personal data in event payloads and to honor Do Not Track), error reports via Sentry (which may include IP address and device/browser metadata), server logs (IP address, user agent, timestamps), and the cookies described in our Cookie Policy.

Information from third parties: if you schedule a discovery call, Google Calendar/Meet shares scheduling details (name, email, meeting time) with us. If you email us, we receive and store your message and address.

We do not collect special-category (sensitive) data on our own behalf and ask that you not submit it through our forms.

3. How and why we use it

We use personal data to: respond to inquiries and proposals; authenticate accounts and operate the Platform; deliver Services under an SOW; invoice and collect payment; send transactional email (account, billing, and engagement notifications); monitor errors and improve reliability; understand aggregate product usage; and meet legal obligations. We do not sell personal information and we do not use it for third-party advertising.

4. Legal bases (EEA/UK visitors)

| Processing activity | Legal basis | |---|---| | Responding to contact/intake submissions | Legitimate interest (responding to your request) | | Account creation, authentication, Platform operation | Performance of contract | | Invoicing and payment via Stripe | Performance of contract; legal obligation | | Transactional email | Performance of contract | | Product analytics (PostHog, no PII in events) | Legitimate interest (improving the service) | | Error monitoring (Sentry) | Legitimate interest (reliability and security) | | Marketing communications | Consent (opt-in; withdraw anytime) |

We share personal data only with the subprocessors listed on our Security page (AWS, Stripe, Amazon Cognito, Google, PostHog, Sentry), each bound by its own data protection terms; with professional advisers under confidentiality; when required by law or valid legal process; or with your explicit consent. If Unnamed is involved in a merger, acquisition, or sale of assets, personal data may transfer as part of that transaction — we will notify you before your data becomes subject to a different privacy policy. We notify Platform customers of material subprocessor changes with at least 30 days notice.

6. Cookies and tracking

The Platform uses strictly necessary session cookies for authentication (Amazon Cognito). The marketing site uses PostHog analytics, which respects Do Not Track and is configured without third-party advertising cookies. Full details, including cookie names and lifetimes, are in the Cookie Policy.

7. Retention

| Data | Retention | |---|---| | Contact/intake form submissions | 12 months after last activity | | Inbound email (raw message archives) | 180 days | | Application logs | 90 days | | Account data | Life of the account, then deleted within 90 days of a deletion request | | Billing records | 7 years (tax and accounting obligations) | | Engagement data processed under an SOW | Per the SOW and DPA |

8. International transfers

We host on AWS in the United States (us-east-1 region), so personal data is stored and processed in the US regardless of where you access our services from. Where GDPR applies, we rely on the European Commission's 2021 Standard Contractual Clauses with our subprocessors (each of AWS, Stripe, Google, PostHog, and Sentry offers SCC-backed data-transfer terms), supplemented by the safeguards described on our Security page.

9. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data, restrict or object to processing, and withdraw consent. California residents additionally have the right to know, delete, and opt out of "sale" or "sharing" (we do neither), and the right to non-discrimination for exercising those rights. In Canada, you have rights of access and correction under PIPEDA (and Alberta's PIPA where it applies), and may complain to the Office of the Privacy Commissioner of Canada. To exercise any right, email legal@theunnamed.dev — we respond within 30 days. If you are in the EEA/UK you may also lodge a complaint with your supervisory authority.

10. Children's privacy

Our services are for businesses and are not directed to children under 16. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it.

11. Security

We encrypt data at rest (AES-256) and in transit (TLS 1.2+), enforce MFA on authentication, follow least-privilege access control, and keep immutable audit logs. Our full security practices, including breach handling, are on the Security page. If a breach affects your personal data, we will notify you and any required regulator without undue delay.

12. Changes to this policy

We will post updates here with a revised "last updated" date, and give at least 30 days notice of material changes by email (for account holders) or a site banner.

13. Contact

Privacy questions and rights requests: legal@theunnamed.dev · General: info@theunnamed.dev