Privacy Policy

Last updated · 18 September 2026

UnitNinety Pty Ltd (ACN 702 295 654, ABN 76 702 295 654), trading as UnitNinety (“U90”, “we”, “us”), is an Australian company based in Perth, Western Australia. It is the entity responsible for the personal information described here. This policy covers unitninety.com, the U90 platform at run.unitninety.com, our template catalogue, and the UnitNinety plugin and connected tools used through ChatGPT, Codex or another supported client. It explains what we collect, why we use it, who receives it, and your choices.

We handle personal information in accordance with applicable privacy law, including the Australian Privacy Principles where the Privacy Act 1988 (Cth) applies. Our Terms of Use explain the conditions for using the service.

This update names UnitNinety Pty Ltd as the entity that holds your personal information. What we collect, why, and who receives it are unchanged.

1. Information we collect

Account and connection information. Your name, email address, profile image if provided, account and workspace identifiers, memberships and roles. We also hold sign-in and connection records, including the connected application, permissions you approve, credential verification records, and creation, expiry, revocation and last-use times.
Optional web-app integrations.If you supply a service credential through U90’s designated web-app settings, such as a key for your own AI-provider account, we store it encrypted and use it to authenticate with that provider. This is separate from plugin tool inputs; do not send credentials through chat.
Projects and content you provide. Uploaded ZIPs, source code, filenames, configuration and content schemas, text, photographs, other media and metadata included in your project. These files may contain personal information about you or others. We also process the site names, domain names and template details you supply.
In-app AI conversations.If you use U90’s own AI editor, we save your messages, the assistant’s responses, attachment references and action history, along with conversation titles and organisation, to your account within that workspace. This is separate from your ChatGPT or Codex history.
Import and publishing records. File sizes and checksums, compatibility and validation results, warnings, import and release identifiers, action history, status, timestamps, and preview, download, workspace and deployment addresses.
Enquiries and support. Your email and any name, company, telephone number, website address, requirements, messages and attachments you submit. When you submit a website address in our homepage form, we receive that address and its submission time even if you do not complete the following enquiry form.
Billing information. If you subscribe through the U90 web app, we process contact and workspace details, plan, subscription and payment status, and billing-provider references. Stripe handles payment-card entry; our plugin does not ask for card details in chat or in a project upload.
Technical and usage information. IP addresses, browser and device information, pages and actions accessed, request times, errors and security logs. Website analytics may include clicks, scrolling, screen size, session replay and approximate location inferred from an IP address. Referral tags may identify the link or introduction that brought you to us.

2. Why we use information

to authenticate users and enforce account and workspace permissions;
to receive, inspect, validate and prepare site packages, create workspaces, and build, host and deploy sites you authorise;
to provide editable content, media, previews and the other platform features you use, including restoring your saved in-app AI conversations;
to prepare private template drafts and, when authorised by a platform super-admin, publish or withdraw catalogue releases;
to return relevant results to your connected client, such as validation findings, release details and deployment status;
to manage subscriptions, provide support and respond to enquiries;
to measure service usage, improve reliability and the website, prevent abuse, investigate faults and meet legal obligations.

We do not sell personal information or use project uploads to build advertising profiles.

3. ChatGPT, Codex and connected tools

Connecting grants the permissions you approve. It does not give U90 access to your entire chat history or your computer.

We receive the tool arguments, files and other resources your client sends for a request. This can include content selected from your conversation. Our import plugin does not retrieve or reconstruct your full ChatGPT or Codex conversation history, and it does not independently browse your local folders.

Tool results are returned to the connected client. Depending on the action, these include template information, import identifiers, validation results, warnings, preview or download links, and the status and addresses of a workspace or deployment. The client provider handles information it receives under its own policies. For ChatGPT and Codex, see OpenAI’s Privacy Policy.

Public template browsing and downloads do not require a U90 connection. Importing a site into a workspace requires appropriate account permissions. Reading private catalogue drafts, uploading templates to the catalogue, publishing and withdrawing releases require platform super-admin access and the relevant permissions. Uploading a site for your own workspace is not the same as publishing it as a public template.

Use the secure sign-in and consent screens to connect. Do not put passwords, API keys, verification codes, payment-card information, government identifiers or protected health information in a chat request or template ZIP. Only include other people’s personal information when you have the rights and permissions needed for the intended use, particularly photographs of children.

Access is limited to the people and services involved in providing the features you use, subject to applicable access controls:

Infrastructure providers: Vercel for hosting, builds, previews and analytics; Cloudflare R2 for file and media storage; Neon for our platform database; and GitHub for site source repositories and code workflows.
Communication and billing providers: Resend for enquiry and transactional email delivery, our support inbox provider for correspondence, and Stripe for subscriptions and billing in the U90 web app.
Analytics providers: Microsoft Clarity and Vercel for website usage information, as described below.
Connected clients: OpenAI or another client provider you choose receives the tool results needed for your request.
Optional platform AI:When you use U90’s in-app AI editing or SEO drafting, Anthropic processes the request, relevant site content or code, and any conversation context or attachments supplied for that feature. This is separate from connecting our import plugin to ChatGPT. See Anthropic’s Privacy Policy.
Workspace participants and support: Authorised workspace members and platform administrators can access information within their roles. Support may access information needed to resolve your request or investigate a security issue.

We may disclose information where required by law or reasonably necessary to protect users, prevent fraud or address a legal claim. Providers may process information outside Australia, including in the United States. Hosting, support and processing locations depend on the service involved; we do not promise Australian-only storage.

5. Public websites and templates

Deploying or publishing a public website makes its published content accessible to visitors. Publishing a catalogue template makes its listing, selected previews and downloadable package available to anyone, including people without a U90 account. Review the entire package for private information and asset permissions before authorising publication.

A private template draft is not a public listing. Withdrawing a published release removes its availability through the catalogue; it does not recall files already downloaded or delete sites someone has created from them. Public content may also have been cached or indexed by third parties.

Businesses using U90 to run their own websites decide what customer information they collect and publish. Their privacy notices apply to those decisions. Contact that business about information you supplied to its site, or contact us if you need help identifying the appropriate operator.

6. Cookies and analytics

The platform uses cookies and similar storage for sign-in, security and preferences. Blocking essential cookies can prevent sign-in or connection approval. Public website pages can be read without enabling optional analytics.

Our marketing website uses Microsoft Clarity for behavioural metrics, heatmaps and session replay, and Vercel Analytics for usage reporting. Clarity uses first- and third-party cookies and similar technology. This information is not necessarily anonymous. Microsoft’s handling is explained in its Privacy Statement. You can limit optional collection using your browser’s cookie controls or a content blocker. This does not delete information already collected; you can contact us about that information.

7. Storage, security and retention

We use HTTPS, authentication and role-based access controls to protect information. Connection credentials are handled by the authentication system, not included in ordinary tool results. No transmission or storage system is completely secure.

Temporary import storage is separate from a deployed site and from a saved catalogue release. The current import lifecycle is:

Upload tickets: expire after 10 minutes. Temporary upload objects are eligible for cleanup after expiry, once any active copy into an import has safely finished.
Unconfirmed prepared imports: expire after 24 hours. Their source ZIPs become eligible for deletion 24 hours after the import is marked expired, rather than immediately when the preparation expires.
Completed or stopped imports: source ZIPs are normally scheduled for deletion 24 hours after the import reaches a terminal state, including completion, failure or cancellation. Active work and cleanup retries can delay removal.
Cleanup: a scheduled maintenance process removes eligible source files. These are eligibility times, not a guarantee that every copy disappears at that exact instant. Import metadata and validation history are separate records and do not expire with the ZIP.

Account information is retained while the account exists. Workspace content, media, source repositories and deployments are retained while that workspace exists. Deleting your account does not automatically delete a workspace or its site, including a workspace used by other people. Workspace deletion is a separate action and initiates removal of associated external resources. Provider failures can require follow-up removal rather than immediate erasure. Import history associated with a surviving workspace may remain after the importing user’s account is removed.

Catalogue packages, previews and release history are retained to support the release. They have no automatic expiry, including when a release is a private draft or has been withdrawn. Contact us for a deletion request; withdrawal is not deletion.

Saved in-app AI conversations have no automatic expiry. They remain until you delete the conversation, its owning account or the associated workspace. Archiving a conversation only hides it from the main list; it does not delete it. Removing a conversation does not undo edits already made to your site or delete separately stored media and provider copies.

Revoking a connection prevents further authorised use of that connection but does not itself erase connection records. Expired credentials are not usable; expiry is distinct from deletion of the associated security record. Account deletion removes its account-level import authorisation records.

Support correspondence, billing records, security logs, analytics and provider backups have separate retention arrangements. Their periods depend on the provider configuration, the purpose of the record and any applicable legal retention obligation; they do not use the import ZIP cleanup schedule. Contact us for the arrangements applicable to your information or to request deletion. Where a record must be retained for a legal obligation or an active dispute, we will explain the reason when responding to your request.

8. Your choices and requests

Browse and download published templates without connecting an account. You can choose not to supply optional enquiry information.
Review permissions before connecting. Revoke the connection in U90’s connection settings, and disconnect it in your client as appropriate. This is separate from cancelling work already authorised or deleting a workspace.
Use available account settings to correct your profile or delete your account. An authorised workspace user can separately request workspace deletion using the workspace controls. Permissions and active operations can affect whether an action is available.
Delete an in-app AI conversation using its conversation menu. This removes it from your saved U90 history, not from another provider’s independent records or backups.
Ask us for access to, correction of, a copy of, or deletion of your personal information by emailing hello@unitninety.com. Identify the relevant account or workspace, but do not send passwords or other credentials. We may verify your identity and authority before acting and will respond within a reasonable time.

Removing data from U90 does not automatically remove copies held independently by your connected client, recipients or people who downloaded public content. Those copies are subject to their own controls and legal obligations.

9. Complaints and contact

Contact UnitNinety Pty Ltd in Perth, Western Australia, at hello@unitninety.com with a privacy question or complaint. We will investigate and respond. If you are not satisfied, you can contact the Office of the Australian Information Commissioner or the relevant privacy regulator in your jurisdiction.

10. Changes to this policy

The current policy will remain at this address with its last-updated date. We will identify material changes on this page and provide additional notice or obtain consent where required by law. New permissions are subject to the applicable connection consent flow.