Privacy policy

1. Who is responsible for your data

Unus Network is a service of Rexium AI, Lda, tax number (NIF) 519476239, registered at Tv. do Candal, 21, 4535-324 Paços de Brandão, Portugal. Rexium AI, Lda is the controller of the personal data described in this policy.

For any request about your data, or to contact us, write to hello@unus.network.

This policy covers the unus.network website, the reserved area, the Unus Network app and the public review, invitation and check-in pages.

2. What data we process

• Account: name, email, phone, language and sign-in data (email and password, or a Google or Apple account). Management roles also use a second authentication factor. At the start of the candidacy, we confirm your email address with a one-time code sent by email: we keep the email and an irreversible code (hash) of that code until it is confirmed, for at most 24 hours.
• Company: name, tax number (NIF), activity code (CAE), legal form (company or sole trader), country, municipality, city, the activity applied for and the company registry documents we ask for, such as the permanent certificate or the proof of start of activity.
• Identity verification: during the candidacy, after paying the candidacy fee, the person who represents the company completes a check with Didit: a photo of the identity document (Portuguese Citizen Card or passport), a selfie with a liveness test, a comparison of the face with the photo on the document, and device and IP address data from the check. Unus Network does not receive or keep the images or the document data: it keeps only the result (approved, in review or not confirmed), the date and the session identifier. A result that is not confirmed does not reject the candidacy: a person on the team reviews it.
• Candidacy and profile: pitch video (up to 60 seconds), profile photo, and the text about the ideal client and the “dream referral”. The candidacy also stores the applicant's name and phone, seen by whoever decides the candidacy. If you leave the candidacy unfinished, we send you a single reminder email.
• Network activity: group and seat, meeting attendance (including check-in time), asks, referrals, deals and their declared value, one-to-ones, wall posts and comments, messages, votes, merit, ranks and pins.
• Client reviews: the stars, the comment, how the client wants to be shown and the consent to publish. We do not receive the client's contact details, because the member shares the link. When a member gives a private client reference (name or tax number), we keep only an irreversible code (hash) to detect repeats.
• Visitors and waitlist: name, email, company and ask of someone who visits a meeting by invitation; email, city, country and activity of someone who joins the waitlist.
• Partner requests: name, email, phone (if you give it), country, city or area of interest, interest (country or region), profile, message and the consent choices of whoever fills in the form on the Partners page. We do not store the IP address or the browser.
• Payments: the payment type (candidacy or membership fee), the amount, the status and the payment reference. Payments and invoices are handled by Rexium through Stripe. Unus Network does not receive or store your card details.
• Security and device: technical data from the browser or the app used by Firebase App Check and Google reCAPTCHA Enterprise to confirm that requests come from our website or our app; logs of administrative actions; and, for reviews, an irreversible code (hash) of the IP address and the browser to detect fraud. For reviews we do not store the IP address or the browser in plain form.
• Notifications: if you turn on notifications in the app, we store the device identifier to send you notifications. Sala notifications may show the group name, the sender and the start of the message. You can turn that text off in Notifications, in the app or in the reserved area, and you will then see only a new message alert.

3. Why we use the data and on what legal basis

• Running the candidacy, the account and the membership, organising groups, meetings and attendance, and enabling referrals, deals, reviews and messages: performance of the contract (GDPR article 6(1)(b)).
• Charging the candidacy fee and the membership fee, issuing invoices and meeting tax and accounting duties: performance of the contract and compliance with legal obligations (points (b) and (c)).
• Confirming the identity of the person who represents the company and the company details (tax number, registry documents and, where applicable, the VAT number in the European Commission's VIES system): performance of the contract and our legitimate interest in a network of real businesses only (points (b) and (f)). When the identity check compares your face with the document, we ask for your explicit consent (article 9(2)(a)).
• Preventing fraud and abuse, protecting the website and the app, and keeping audit logs: legitimate interest (point (f)).
• Publishing a client review and joining the waitlist: consent (point (a)).
• Answering a partner request made on the Partners page: the consent you give in the form and steps taken at your request before a contract (points (a) and (b)). We only send you news about Unus if you ask for it in the form (consent, point (a)).
• Sending a single reminder email to someone who leaves a candidacy unfinished (two days after the last change), with the step where they stopped and a button to continue: steps taken at your request before a contract, because you started the candidacy (point (b)). We do not send this reminder again.
• The AI assistant and automatic content moderation, when they are enabled: performance of the contract and our legitimate interest in keeping the network's spaces safe.

Where the basis is consent, you can withdraw it at any time, without affecting what was done before.

We do not sell members' data or use it for advertising.

4. Who decides: people, not machines

Admissions, candidacy rejections, sanctions, suspensions and expulsions are always decided by people with the right role. Automated tools, including the AI assistant and Jev, our typed-decision system, only flag or suggest. We do not take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (GDPR article 22).

Some checks follow fixed rules: a Portuguese tax number is validated with its check-digit algorithm, and merit is calculated from verified actions, with an explanation of each point that the member can see. Signs of possible fraud always go to human review.

5. Who we share the data with

We use these providers, who process data on our behalf and under our instructions:

• Google Cloud and Firebase (Google): the database in use, files, server functions, and the website are in the European Union (region europe-west4, Netherlands). Sign-in uses Firebase Authentication. This includes Firebase App Check and reCAPTCHA Enterprise.
• Rexium.ai and Stripe: payments and invoicing of the candidacy fee and the membership fee. Stripe processes card payments.
• Expo (650 Industries): delivers the app's push notifications to Apple and Google. It receives the device identifier and the title and text of each notification, including, in Sala notifications, the sender's name and the start of the message, when you allow it.
• Didit: identity verification during the candidacy (document, selfie, liveness test, face comparison and device and IP data). We send it only the candidacy identifier; your name, email, phone and tax number are not sent.

When they are enabled, we will also use:

• A language model provider, for the AI assistant's drafts. The request to the model does not include your name, email, identifier or tax number.
• TypeSafe (Jev): typed questions to suggest and flag, with no personal data in the text.
• Sentry: logging of technical errors, with no personal data in the events.
• Cloudflare: abuse protection (Turnstile) on the public contact and partner forms, and sending emails.

Inside the network, other members see your profile (company, activity, pitch video, photo, merit and published reviews) and what you post in shared spaces.

You can hide your photo from the group's public page in Perfil (Profile); the page then shows your initials.

We may also disclose data to authorities when the law requires it.

6. Transfers outside the European Union

Our main services are hosted in the European Union. Some providers, such as Google, Stripe or Expo, may process data outside the European Economic Area. In that case, the transfer only takes place with the safeguards set out in the GDPR, such as a European Commission adequacy decision or standard contractual clauses.

7. How long we keep the data

We keep the data while the account and the membership are active. After that, we keep only what is needed, for the periods required by law, notably tax and accounting law, or for as long as needed to defend rights in a dispute.

Applications that were never paid are deleted, with their video, after 90 days without activity.

• Identity verification: Unus Network keeps only the result, the date and the session identifier, while the candidacy and the membership exist. The images and the document data stay with Didit, for the shortest period Didit lets us set, and are not copied to Unus Network.
• Visitor data (name, email, company and ask): deleted 12 months after the visit. The invite stops working 7 days after the meeting.
• Technical review data (codes of the IP address and the browser): 12 months.
• Partner requests: if the request does not go ahead, we delete the data after 24 months without contact. If it leads to a proposal or a contract, we keep the data for as long as that relationship lasts and for the periods the law requires. You can ask us to delete it sooner, or exercise the other rights in section 9, at hello@unus.network.
• Invoices and payment records: for the periods set by tax and accounting law.

8. Exporting your data and deleting your account

You can export your data and delete your account in the app (Profile) or in the reserved area.

When you delete your account, we delete the sign-in account, the profile (name and texts), the photo, the logo, the pitch video, the username, the social links and the connection code, and your seat in the group becomes free. We keep the tax number and the payment records, because they are needed for invoicing. Referrals, deals and messages exchanged with other members stay with those members, without your name.

To ask us to delete other data, write to hello@unus.network.

9. Your rights

• Access: know what data we hold about you and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data, unless the law requires us to keep it.
• Restriction: ask us to pause the processing in certain cases.
• Portability: receive the data you gave us in a commonly used format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent, where the processing is based on it.

To exercise any of these rights, write to hello@unus.network. We may ask you to confirm your identity. We reply within one month, which may be extended in the cases set out in the GDPR.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

10. Cookies and browser storage

We do not use advertising or analytics cookies. We use only what the service needs to work:

• unus-color-scheme (local storage): keeps your choice of light or dark theme.
• Firebase Authentication session (browser storage): keeps you signed in to the candidacy and the reserved area.
• Firebase App Check with reCAPTCHA Enterprise (Google): confirms that requests come from our website and protects against abuse. reCAPTCHA may use cookies and device data.
• sidebar_state (cookie, 7 days): in the reserved area, remembers whether the side menu is open or closed.

In the app, the theme choice is stored on the device itself.

11. Changes to this policy

We may update this policy. The current version is always on this page, with the date at the top.