Privacy policy

Effective Date: October 10, 2026
Last Updated: October 10, 2026

1. Introduction

Welcome to UnAPI (“UnAPI,” “we,” “us,” or “our”), a technology infrastructure provider offering APIs, authentication management, browser-based integrations, and related developer services.

UnAPI is operated by Magillabs Technology Private Limited (“Company”).

This Privacy Policy explains how we collect, use, process, store, share, and protect information when you access our website at https://unapi.so, use our APIs, access developer documentation, connect third-party accounts, or otherwise interact with our services (collectively, the “Services”).

We are committed to protecting your privacy and handling information responsibly.

Our Services are primarily designed for developers, businesses, and organizations integrating third-party functionality into their applications.

Depending on the circumstances, UnAPI may act as a data controller or an independent data fiduciary for information collected directly from customers, and as a data processor or service provider when processing information on behalf of customers.

We aim to comply with applicable data protection regulations, including:

The European Union General Data Protection Regulation (GDPR).
The United Kingdom GDPR and Data Protection Act.
India’s Digital Personal Data Protection Act, 2023, and applicable rules.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).
Other applicable privacy and data protection laws.

Where applicable law provides additional protections, those legal requirements will prevail.

2. Information We Collect

We collect information necessary to operate, secure, maintain, and improve our Services.

2.1 Account and Registration Information

When you register or interact with UnAPI, we may collect:

Name and business contact details.
Email address and phone number.
Company name and organization information.
Account credentials and authentication information.
Subscription details and billing information.
Customer support requests and communications.

We collect only the information reasonably necessary for our business operations and the Services you request.

2.2 API and Technical Information

When customers interact with our infrastructure, we may automatically collect:

API keys and authentication identifiers.
API request and response metadata.
Request timestamps and execution status.
IP addresses and device information.
Browser information and user-agent details.
Connection identifiers and integration configurations.
Error logs and system performance metrics.
API consumption and resource utilization information.

This information is used to authenticate requests, monitor performance, prevent misuse, troubleshoot technical problems, and maintain infrastructure reliability.

API request and response bodies may also be processed when necessary to execute customer requests, deliver requested results, troubleshoot issues, or comply with legal obligations.

2.3 Connected Third-Party Accounts

UnAPI enables customers to connect supported third-party services through APIs and authentication mechanisms.

Depending on the integration, we may process:

Account identifiers and profile information.
Authentication tokens, cookies, and session credentials.
Login credentials when provided for supported authentication methods.
Connection status and account metadata.
Messages, conversations, and communication metadata.
Profile, connection, and activity information.
Content and instructions submitted through API requests.
Other information made available through the relevant integration.

Authentication information is processed to establish, maintain, and operate connections requested by customers.

We do not claim ownership of connected accounts or the information associated with them.

Customers are responsible for ensuring that they are authorized to connect and use any third-party accounts through our Services.

2.4 Website Usage and Cookies

We may use cookies and similar technologies to:

Maintain user sessions.
Remember preferences.
Analyze website performance.
Understand service usage.
Detect suspicious activities.
Improve the user experience.

Where legally required, we obtain consent before placing non-essential cookies.

Users may manage cookies through their browser settings and any cookie preference controls we provide.

2.5 Information From Third Parties

We may receive information from:

Payment processing providers.
Authentication providers.
Connected third-party applications.
Business partners and authorized resellers.
Security and fraud prevention services.
Publicly available business sources.

We process such information only where permitted by applicable law and our contractual obligations.

3. How We Use Information

We process information for legitimate operational purposes, including the following.

3.1 Providing API Infrastructure

We use information to:

Authenticate and execute API requests.
Establish and maintain third-party account connections.
Manage browser sessions and authentication.
Execute actions requested through supported integrations.
Return API responses and deliver webhook events.
Maintain account connectivity and service availability.

3.2 Infrastructure Security and Reliability

We may process technical information to:

Monitor system health.
Identify service interruptions.
Detect unauthorized access.
Prevent fraud and infrastructure abuse.
Investigate technical errors.
Maintain operational and security logs.

3.3 Billing and Account Administration

We process account and transaction information to:

Manage subscriptions.
Calculate usage-based charges.
Process payments.
Maintain invoices and billing records.
Communicate important account updates.

3.4 Service Improvement

We may analyze aggregated or appropriately de-identified usage information to improve:

API performance.
Infrastructure efficiency.
Connection stability.
Error handling.
Authentication workflows.
Developer experience.

We do not sell customer API payloads, authentication credentials, or connected-account information to data brokers.

3.5 Communication

We may contact users regarding:

Account security.
Maintenance and outages.
Product changes.
Billing notifications.
Customer support.
Relevant product updates and announcements.

Users can opt out of promotional communications, although essential service-related notifications may continue.

4. Our Role as a Technology Provider

UnAPI provides infrastructure that allows customers to interact programmatically with supported third-party services.

We do not determine the purpose of the applications developed by our customers or the specific actions they choose to perform through our APIs.

Where customers submit personal data for processing through our infrastructure, customers are generally responsible for:

Establishing a lawful basis for processing.
Providing legally required privacy notices.
Obtaining necessary permissions and consents.
Respecting individuals’ privacy and data protection rights.
Ensuring their applications comply with applicable laws.
Managing the information collected from their end users.

Where UnAPI acts as a processor, we process personal data on the customer’s documented instructions, subject to applicable law and contractual requirements.

Customers requiring contractual data processing protections may request a Data Processing Agreement (DPA), subject to availability and mutual agreement.

5. Authentication Credentials and Session Data

Certain integrations require authentication information such as access tokens, session cookies, or login credentials.

Such information may be processed and stored to maintain authenticated connections and execute authorized API operations.

Access to authentication information is restricted to personnel and systems that require it for legitimate operational purposes.

We implement appropriate security safeguards for credential handling and storage.

We do not intentionally disclose authentication credentials to unrelated third parties for marketing or advertising purposes.

Customers are responsible for obtaining authorization to use connected accounts, managing their API keys securely, and revoking access when an integration is no longer required.

6. Data Sharing and Subprocessors

We may disclose information to trusted service providers where necessary to operate our Services.

These may include:

Cloud infrastructure and hosting providers.
Data storage providers.
Network and connectivity providers.
Payment processors.
Authentication and security providers.
Monitoring and analytics services.
Customer support providers.
Third-party services selected by customers.

These providers may process information on our behalf under appropriate contractual and confidentiality obligations.

We may also disclose information when reasonably necessary to:

Comply with applicable laws.
Respond to valid legal requests.
Prevent fraud or security incidents.
Enforce our agreements.
Protect the rights and safety of customers, third parties, or our business.

In connection with a merger, acquisition, restructuring, or transfer of business assets, information may be transferred subject to applicable legal protections.

We do not sell personal information or customer authentication data to third parties.

7. International Data Transfers

UnAPI may operate infrastructure or use service providers located in different countries.

As a result, information may be processed outside the country in which it was originally collected.

Where required by applicable law, we implement appropriate safeguards for international transfers, which may include:

Contractual data protection commitments.
Standard Contractual Clauses.
Applicable adequacy decisions.
Other legally recognized transfer mechanisms.

We take reasonable steps to ensure that cross-border processing remains consistent with our privacy commitments and applicable law.

8. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary to provide our Services, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements.

Retention periods depend on the category of information and the purpose for which it is processed.

Generally:

Account information: Retained while an account remains active and for a reasonable period afterward where necessary for administration, legal compliance, or dispute resolution.

Authentication and session information: Retained while needed to maintain authorized connections, subject to operational requirements and applicable retention obligations.

API logs and diagnostic information: Retained for periods reasonably necessary for troubleshooting, monitoring, fraud prevention, and security.

Billing records: Retained for the period required by applicable financial, accounting, and tax laws.

Customer data: Retained in accordance with applicable service agreements, technical requirements, and customer instructions.

Upon account termination or receipt of a valid deletion request, we will delete or anonymize eligible information within a reasonable period, subject to legal obligations, backup cycles, and legitimate security requirements.

Customers may request the deletion of their account and associated information by contacting our support team.

9. Data Security

We implement reasonable technical and organizational safeguards designed to protect information from unauthorized access, disclosure, modification, and loss.

Depending on the relevant system, these measures may include:

Encryption in transit and appropriate encryption at rest.
Access restrictions and authentication controls.
Secure handling of API credentials.
Infrastructure monitoring.
Logging and suspicious activity detection.
Internal access management.
Incident response procedures.
Security updates and maintenance.

Although we take security seriously, no electronic transmission or storage system can be guaranteed to be completely secure.

Customers are responsible for securing their API keys, managing access to their applications, and promptly reporting suspected credential compromise.

Where required by applicable law, we will notify affected parties and relevant authorities of qualifying personal data breaches.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

Access personal information held about you.
Request correction of inaccurate information.
Request deletion of eligible personal information.
Withdraw consent where consent is the applicable processing basis.
Object to or restrict certain processing activities.
Request data portability where applicable.
Opt out of certain marketing communications.
Submit complaints to an appropriate supervisory authority.

Residents of the European Economic Area, United Kingdom, California, India, and other jurisdictions may have additional rights under applicable law.

Requests may be submitted using the contact details below.

We may request reasonable verification before fulfilling a privacy request.

Where UnAPI processes information exclusively on behalf of a customer, we may refer the request to that customer or assist the customer in fulfilling its obligations.

We will respond within the timeframes required by applicable law.

11. Third-Party Services

Our Services may interact with third-party websites, applications, or platforms, including professional networking services.

These third-party services maintain their own terms, privacy policies, and data processing practices.

UnAPI does not control their independent collection, use, storage, or disclosure of personal information.

Customers are responsible for reviewing and complying with applicable third-party terms.

UnAPI is not affiliated with, endorsed by, or officially partnered with LinkedIn unless expressly stated otherwise.

LinkedIn is a trademark of LinkedIn Corporation.

12. Children’s Privacy

UnAPI is intended for business and developer use.

Our Services are not directed toward individuals under 18 years of age.

We do not knowingly collect personal information directly from children for account registration or marketing purposes.

If we become aware that we have collected information from a child in violation of applicable law, we will take appropriate steps to delete or otherwise lawfully address that information.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our technology, infrastructure, business operations, or legal requirements.

When changes occur, we will update the “Last Updated” date.

If changes materially affect how we process personal information, we will provide additional notice where required by law.

We encourage users to review this Privacy Policy periodically.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy, please contact:

UnAPI
Legal Entity: Magillabs Technology Private Limited
Legal & Privacy Email: [email protected]
Jurisdiction: Bengaluru, Karnataka, India
Effective Date: October 10, 2026

Contact Email: [email protected]
Website: https://unapi.so