Privacy Policy

Draft: under legal review. The commitments here are the ones we keep today; the wording may change.

Your organisation's records stay yours; UnityHelp holds them only to run the service for you. This policy covers the web platform at unityhelp.org and its country sites. The phone app has its own statement in the app stores. Last updated 30 October 2026.

Who is responsible

The organisation that recorded a record is its controller, and UnityHelp, Inc. is its processor, acting only on that organisation's instructions. For the details of your own account, UnityHelp, Inc. is the controller. If you are a person in an organisation's records, ask that organisation; we will help it answer. Contact: info@unityhelp.org.

What we hold about account holders

• Name, email address, phone number, language, organisation and role.
• For a field worker, also a phone number, encrypted, and the places the worker is assigned to.
• When the account last signed in, and the address it signed in from in the server's logs.
• A record of certain actions: closing a place, exporting or erasing personal data, security settings.

What organisations record, and how it is protected

Sites, facilities, activities, field reports with their position and any photo or voice note, household registers, payment lists and referrals. They belong to the organisation that recorded them.

• A referral case is sealed when it is sent. Opening it needs the receiving organisation's passphrase, which UnityHelp never stores, and a one-time token passed on by the referring worker, of which UnityHelp keeps only a fingerprint. A case already sealed cannot be read by UnityHelp's staff, even with full access to the server.
• Names and national ID numbers in a household register are encrypted. The ID number is also kept in a form that cannot be matched between two organisations' registers.
• Gender-based violence records hold no location and no date of birth. Every time an incident is opened, created or changed, a permanent record says who did it.
• Referrals carry no free-text notes, because a sentence about a case is where a case leaks.
• Nothing the platform shows outside the recording organisation is about a person. Shared figures are counts and places, and counts under a threshold are withheld.

Apart from sealed cases, the platform's records are stored so the service can run, and UnityHelp's technical staff can technically reach them; the server holds the key to the encrypted fields. Staff open an organisation's records only to keep the service running, fix a fault the organisation reports, or deal with a security incident.

The AI assistant and other AI features

These features send content to an AI model provider, currently OpenAI. None ever sends a sealed case.

• The assistant: your question, the conversation so far, and the records it reads to answer.
• Voice notes: the recording, to turn it into text.
• Report photos: the photo, to describe what it shows.
• Map summaries and report grouping: the text of field reports, including transcribed voice notes.
• Assessments: the questions and answers, to analyse them.

Nothing is removed from this content before it is sent, so do not record ID numbers or names of people at risk where a feature does not ask for them. Under its terms for business use, the provider does not train on this data and keeps it for at most 30 days to detect abuse. When the assistant searches the web (Tavily) or a humanitarian source (ReliefWeb, HDX), the service receives a search the assistant writes from your question, which can contain your words.

Where data is held, and who else processes it

The platform, its database, its files and their backups are on Amazon Web Services servers in Ireland. Nothing is held on a server in Sudan or in any other country where the platform is used. Data in Ireland is under Irish and European law. UnityHelp, Inc. and Amazon are US companies, so a US court can also order either of them to hand over data held in Ireland.

• Amazon Web Services, Ireland: hosting and backups.
• OpenAI, United States: the AI features above.
• Namecheap Private Email: sign-in codes and invitations.
• Mapbox, United States: map tiles. Your browser fetches them, so Mapbox sees your address and the area you view, not the records drawn on it.
• Google Fonts, United States: the platform's typeface. Your browser fetches it, so Google sees your address.
• Tavily, United States, and ReliefWeb and HDX (OCHA): the searches described above.

How long we keep data

• Your account: until it is closed, then 12 months, then anonymised.
• Organisation records: until the organisation deletes them, or 60 days after its account closes.
• Assistant conversations: until you delete them. The assistant's working notes: 7 days after each answer. The AI provider's copy: at most 30 days.
• A sealed referral case: until the referral expires or is withdrawn. Its dates and outcome, without the case, are kept to measure whether referrals are answered.
• Attempts to open a referral: 1 year. Who opened a gender-based violence incident: permanently, with no case content.
• Database backups: up to 120 days. A photo or voice note deleted from the platform can remain in our backups. If something must be removed sooner, write to info@unityhelp.org and we will remove it from the backups too.
• Server logs, including visitors' addresses: until overwritten, a few days to a few weeks.

Who can receive data

The organisation that recorded the data decides what leaves the platform. If an authority, donor or cluster wants its data, it asks that organisation. Others receive an organisation's records only if it shares them, and then counts and places, never names.

UnityHelp, Inc. complies with a valid order of a court with jurisdiction over it, including a US court. We check that the order is valid and proportionate, hand over only what it names, keep a record, and tell the organisation concerned unless the order forbids it. A sealed case cannot be handed over, because we cannot read it, and we will not build a way to read one. No system is perfectly secure, and no provider can guarantee that data will never be reached by a third party or a government, which is one more reason to record only what you need.

Your rights

Write to info@unityhelp.org to receive a copy of your account data, correct it or erase it. We answer within 14 days and never later than one month, and may first ask you to confirm who you are. Records an organisation holds about you belong to that organisation: ask it. Where European or UK law applies, you may also ask us to restrict processing, object to it or receive your data in a portable format, and you may complain to a data protection authority.

Security and breaches

Encryption of every connection and of identifying fields when stored; sealed referral cases; sign-ins that expire; limits on repeated sign-in attempts; a permanent record of access to gender-based violence incidents; small counts withheld from shared figures. If a breach affects an organisation's data, we tell it without undue delay and help it tell the people concerned.

Children

Accounts are for adults. Organisations may record information about children in their work and must take extra care when they do.

Cookies and browser storage

This website sets no cookies, loads nothing from anyone else and uses no analytics. The platform stores in your browser what it needs to work: your sign-in token, the country, theme and layout you chose, and the conversation last open. It sets two cookies, one for the session and one against forged requests. It uses no analytics and does not track you on other sites.

What we never do

Sell data, use it for advertising, use it to train any model, or track you across other sites. We improve UnityHelp using measurements of how the service runs, such as errors, speed and which features are used, and what users choose to tell us. We do not use the content of your records, conversations, photos or voice notes to train a model or improve the service.

Changes

We post changes here with the date they take effect. For a material change we email every organisation's administrator at least 30 days before.