Your data and our sub-processors
Where data is stored and processed, how long we keep it, how to erase or export it, and who processes it for us.
Last updated 31 October 2026.
Status: the facts on this page come from our Data Processing Agreement, draft v1 of 21 October 2026. It is being finalised with our lawyer and is not yet a binding document. Ask us for the current copy.
Who is responsible
You, the customer, are the controller of the personal data you put into Gauntlet. UnisonAI is the processor: we process it only on your documented instructions, which are the way you configure the service and our Terms.
| Item | Gauntlet |
|---|---|
| Purpose | AI agent assurance testing; customer-care inbox, CRM, AI drafting, reports |
| Data subjects | Customer's staff; customer's end-users who contact them |
| Categories of data | Names, contact details, conversation content, case notes, usage data |
| Duration | For the subscription term; deleted or returned within 30 days after termination unless law requires longer |
Where data is stored and processed
Service data (servers, storage and backups) is hosted in: India (Mumbai). Some sub-processors below work in other locations; each one's location is listed.
International transfers: where personal data from the EU or UK is processed in India or by sub-processors outside the EU or UK, we rely on the European Commission's Standard Contractual Clauses (Module 2, controller-to-processor) and the UK Addendum. India's DPDP Act obligations apply to processing in India.
Retention, erasure and return
- Retention: we keep your data for the subscription term. After it ends, we delete or return it within 30 days, unless the law requires us to keep it longer.
- Erasure: the CRM "Erase" function removes a person and all their linked records, so you can answer erasure requests yourself.
- Requests from people: we help you answer requests for access, correction and erasure.
- Return: at the end of the service we delete or return your personal data, as you choose.
Our commitments as processor
- Our staff and contractors are bound by confidentiality.
- We use only the sub-processors listed below and give you 30 days' notice of any change, so you can object.
- We tell you without undue delay after we become aware of a personal-data breach, with a target of 48 hours.
- We share the information you need to show compliance and allow audits on reasonable notice (or provide third-party audit reports once available).
- Personal data is never used to train our own AI model; that training uses only curated Q&A pairs that are filtered to remove personal data.
Sub-processors
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Hostinger International | VPS hosting of Gauntlet, FolioLyt and unisonai.com (servers, storage, backups) | India (Mumbai) | All service data |
| Google (Gmail SMTP) | Sending transactional email, alerts and newsletters | Global | Name, email address, message content |
| Hostinger Mail | Mailboxes hello@unisonai.com / hello@foliolyt.cloud | Global | Correspondence |
| Razorpay Software Pvt Ltd | Payments, subscriptions, invoices/receipts (card data handled only by Razorpay) | India | Name, email, phone, billing country, payment metadata |
| Groq, Inc. | AI inference (chat answers, drafting, triage) | USA | Conversation text sent for an answer |
| Mistral AI | AI inference (fallback) | EU (France) | Conversation text sent for an answer |
| Google (Gemini API) | AI inference (fallback) | Global | Conversation text sent for an answer |
| Cloudflare, Inc. (Workers AI) | AI inference (fallback) | Global | Conversation text sent for an answer |
| UnisonAI (own model on the same server) | AI inference on our own server — no third party | Same as hosting | Conversation text |
| Kaggle (Google) | Training our own model on curated, non-personal Q&A pairs | Global | No personal data (filtered before upload) |
| Let's Encrypt (ISRG) | TLS certificates | USA | Domain names only |
For the full DPA, or to be told about sub-processor changes, write to hello@unisonai.com.
Questions, questionnaires and reports
Send security questionnaires, data-protection questions, accessibility barriers or a suspected security issue to hello@unisonai.com. A person reads every message. Please do not send passwords or personal data you do not need to.