Privacy Policy

1. Who We Are

UnicoOS is a business operating platform provided by E1 Unico Corporation, a Texas corporation. Our platform helps business owners manage CRM, invoicing, scheduling, SMS campaigns, and more. Contact us at unico@e1unico.com or 1-833-318-6426.

2. Information We Collect

• Account information: Name, email, business name, phone number when you register.
• Customer data: Contact records, appointments, and communications you add to your account.
• Payment data: Billing info processed securely through Stripe — we never store card numbers.
• Usage data: How you interact with the platform (pages visited, features used).
• SMS consent: Phone numbers and opt-in records for customers who consent to receive text messages from your business.

3. SMS Messaging & Text Consent

UnicoOS enables businesses to send SMS messages to their customers. By providing a phone number through a UnicoOS-powered booking page, form, or checkout, customers consent to receive text messages from that business. Every message includes opt-out instructions (Reply STOP). We do not sell or share phone numbers with third parties. Message and data rates may apply.

4. How We Use Your Information

• To provide and improve the UnicoOS platform
• To process payments and send billing notifications
• To enable SMS, email, and voice features you configure
• To provide customer support
• To comply with legal obligations

5. Bank Account Connection (Plaid)

UnicoOS uses Plaid to allow users to securely connect their bank accounts. When you connect a bank account through Plaid:

• Your bank login credentials are entered directly into Plaid's secure interface — E1 Unico Corporation never sees or stores your bank username or password.
• Plaid provides us with a secure access token that allows us to retrieve account balances and transaction data on your behalf.
• All financial data retrieved from Plaid is encrypted at rest (AES-256) and in transit (TLS 1.3).
• We use your financial data solely to provide the Banking & Transactions features within UnicoOS — we do not sell, share, or use it for advertising.
• You can disconnect your bank account at any time from the Banking page in your UnicoOS dashboard. Upon disconnection, your Plaid access token is revoked.
• Plaid's own privacy policy is available at plaid.com/legal.

6. Identity Verification (Stripe Identity, Plaid Identity Verification)

Some features ask you to verify who you are with a government ID. The check runs inside the provider's own hosted flow; UnicoOS receives the result, not the documents.

Which providers, and for what

• Stripe Identity (Stripe, Inc.) — used for identity checks required before a UniLend application is routed to a lender partner, and other money features where the law requires us to know who you are. Privacy notice: stripe.com/privacy.
• Plaid Identity Verification (Plaid Inc.) — used for the optional ID check on Account → Age & Parent Verify, which confirms you are 18 or older and unlocks verified status. Privacy notice: plaid.com/legal/.

What is collected

• A photo of your government-issued ID (driver's license, passport or national ID card) and a selfie, captured inside the provider's own hosted flow. They go directly to Stripe or Plaid; they never pass through or land on UnicoOS servers.
• The details the provider reads from the document to run the check: name, date of birth, document type and number, and whether the selfie matches the photo on the document.
• The outcome the provider sends back to UnicoOS: pass, fail, needs review, or expired, plus the provider's session id, the date, and, for the age check, only whether the date of birth on the document is 18 or older.

Why we ask

• To confirm you are 18 or older before showing content marked 18+, where you choose the ID check instead of the written 18+ agreement (the agreement is enough on its own; the ID check is optional).
• To satisfy federal identity requirements (FCRA, ECOA, USA PATRIOT Act customer identification) before we route a UniLend application to a lender partner or enable other regulated money features.
• To show a verified badge on your profile once a check has passed, and to protect the platform from impersonation and fraud.

What we keep, and for how long

• UnicoOS does not retain the ID image, the selfie, the document number, or the date of birth read from the document. We store only the result (pass, fail, review, expired), the provider and its session id, the date, the reason the check was requested, and for age checks a single yes/no for 18 or older.
• Stripe and Plaid keep the images and extracted data under their own retention policies and privacy notices, linked below. We can ask the provider to delete your verification data on request.
• A passed check is kept while your account exists so you are not asked again; some checks expire and must be repeated, and you can see the status of every check on Account → Age & Parent Verify.

Your rights and choices

• ID verification is your choice. You can decline or cancel a check at any time. Declining never closes your account and never affects features that do not require it.
• You can ask us to delete the stored result and to forward a deletion request to the provider by emailing unico@e1unico.com. Deleting a passed result returns the account to unverified, and regulated features that require verification become unavailable until a new check passes.
• You can ask what we hold about a check at any time; we will answer within 30 days.

7. Google User Data (Gmail, Calendar, Drive, Sheets, Business Profile)

You can connect a Google account to UnicoOS from Settings → Integrations. When you do, Google asks you to approve specific permissions ("scopes"); we request only the ones needed for the features described here.

UnicoOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail (Guard Mail): if you turn on Guard Mail for a mailbox you connect, we read your most recent Inbox and Sent messages to detect phishing, business-email-compromise, and accidental exposure of sensitive data (such as Social Security, card, or bank account numbers). Message content is processed transiently; for flagged messages we store only the message ID, sender, subject, received time, and the rules that matched — never the message body. The only write action is your explicit "Quarantine" click, which applies a label and removes the message from your Inbox; nothing is ever deleted and the action is reversible in Gmail. We do not send mail, create drafts, or change your settings.
• Calendar, Sheets, Drive: used only by automations and actions you configure — for example, putting a booking on your calendar or appending a lead to a spreadsheet you choose.
• Business Profile: shows your own listing, reviews, and insights inside UnicoOS and lets you post updates or reply to reviews.
• We use Google user data only to provide and improve the features you turn on and to show them to you. We do not use it for advertising, do not sell it, and do not allow humans to read it except with your explicit consent for a specific message, for security purposes, to comply with law, or in aggregated or anonymized form. We do not transfer it to third parties except as needed to provide or improve those features, for security, or as required by law.
• You can disconnect Google at any time in Settings → Integrations, which deletes the stored access and refresh tokens. You can also revoke UnicoOS's access from your Google Account permissions page.

8. Data Sharing

We do not sell your data. We share information only with service providers necessary to operate the platform: Stripe (payments), Twilio (SMS/voice), Resend (email), Neon (database hosting), Plaid (bank account linking), Stripe Identity and Plaid Identity Verification (identity checks, only when you start one — see section 6), Google and Microsoft (only when you connect those accounts), and Vercel (application hosting). All providers are contractually obligated to protect your data and are prohibited from using it for their own purposes.

9. Data Security

We use industry-standard encryption — TLS 1.3 in transit and AES-256 at rest — for all data including financial data received from Plaid. Passwords are hashed using bcrypt. We never store plain-text passwords, full payment card numbers, or bank login credentials. All production systems are hosted on SOC 2 Type II certified infrastructure.

10. Your Rights

You may request access, correction, or deletion of your data at any time by emailing unico@e1unico.com. Business customers can also delete their account and associated data from the Settings page.

Section 16 and our Data deletion page explain exactly how deletion works.

11. Cookies

We use essential cookies to keep you logged in and maintain session security. We do not use advertising or tracking cookies.

12. Contact

Questions about this policy? Contact us:
E1 Unico Corporation
Email: unico@e1unico.com
Phone: 1-833-318-6426
Website: e1unico.com
LEI: 25490045C323WM1H6539

13. Facebook & Instagram (Meta) Data

A business can connect its Facebook Page and Instagram professional account to UnicoOS from Settings → Integrations. Facebook asks you to approve each permission first; we ask only for the ones these features need.

What we access

• The name and ID of the Facebook Page and Instagram account you connect, and an ID Facebook gives us for you, so we know which connection is yours.
• Posts you publish to your Page or Instagram through UnicoOS.
• Messages and comments people send your Page or Instagram account, so you can read and reply to them inside UnicoOS.
• If you connect ads: your ad sets (to run or pause them) and the answers people submit in your ad lead forms, so they can arrive in your contacts.

How we use it

• Only to provide the features you turn on: posting, replying to messages and comments, and bringing ad leads into your account.
• We do not sell it, we do not use it for advertising, and we do not share it except with the service providers in section 8 that help us run UnicoOS.
• We follow the Meta Platform Terms and Developer Policies.

How long we keep it, and how to remove it

• The access keys Facebook gives us are encrypted and kept only while the connection is active.
• Disconnect at any time in Settings → Integrations. Disconnecting deletes the stored keys.
• You can also remove UnicoOS in your Facebook or Instagram settings (Business integrations). Facebook tells us, and we delete the keys we kept for you.
• If you ask Facebook to delete your data, Facebook sends us the request. We delete that connection and the keys we kept to reach it, and give you a confirmation code you can check on our Data deletion page. Messages, comments and leads that already came in through that connection stay with the business that received them.

14. TikTok Data

A business can connect a TikTok account from Settings → Integrations to publish videos.

• What we access: your basic TikTok profile (name and account ID) and permission to upload and publish the videos you choose.
• How we use it: only to publish what you ask us to. We do not sell it or use it for advertising.
• How to remove it: disconnect in Settings → Integrations (this deletes the stored keys), or remove UnicoOS from the apps you've given access to in TikTok's settings.

15. Mobile Apps

This policy also covers the UnicoOS phone apps (such as UniBarber and our other apps).

• Signing in: you sign in with your UnicoOS account. The app keeps its sign-in key in your phone's secure storage, and signing out removes it.
• Notifications: if you allow notifications, the app sends us a notification token for your phone so we can tell you about things like new bookings. You can turn notifications off at any time in your phone's settings.
• No tracking or ads: our apps do not include advertising or tracking tools and do not follow you across other apps or websites.
• Camera and photos: used only when you choose to add a photo, and only with your permission.
• Deleting your account: you can start it from the app or website, as described in section 16.

16. Deleting Your Account and Data

You can delete your account at any time in Settings → Account → Delete my account, or by emailing unico@e1unico.com from the email address on your account. Step-by-step instructions are on our Data deletion page.

What happens and when

• Your account is locked right away and you are signed out on every device.
• We email you a confirmation code and a link to keep your account if you change your mind.
• Your data is removed within 30 days.
• If you own a business that still has team members, you will be asked to hand it over to someone on your team (or remove the team) first.

What we remove

• Your profile: name, email address, photo, birthday and sign-in details (password, two-step codes, linked Google or Microsoft sign-ins)
• Phone and browser notification registrations
• Apps you connected (Facebook, Instagram, TikTok, Google and others), including the keys we kept to reach them
• Your PowUni posts, comments, reactions and saved posts; your persona cards are turned off and emptied
• Your personal budget, saved competitors, recommendations and personal document vault

What we keep

• Invoices, payments, payouts, receipts and tax records, for as long as the law requires. Your name is removed from your account, so they show as “Deleted user”.
• A business’s own records about its customers and staff (for example a message you sent while working for a business). Those belong to that business.
• A short record that the deletion happened (the confirmation code, the dates and the result), so we can prove it was done.

Customers of businesses that use UnicoOS

Each business decides what it keeps about its own customers. To have your details removed, ask that business. If you can't reach them, email us and we'll help.

Facebook users

When Facebook sends us a deletion request for you, we delete the connection data we stored and give you a confirmation code. Enter it on the Data deletion page to see the status.

17. UnicoOS Business Account and UniCash (Column N.A.)

When you open a UnicoOS Business Account, the account is held at Column N.A., Member FDIC. To open and run it, the bank must know who the business is and who stands behind it — that is federal law (the Bank Secrecy Act, the USA PATRIOT Act customer identification rules and FinCEN's customer due diligence rule), not a UnicoOS choice.

What we collect and send to the bank

• About the business: legal name, "doing business as" name, EIN or registration number, physical address, type of entity, state and year of formation, website and industry. UnicoOS already keeps the EIN and address for your tax forms (1099s, W-2s); the rest is kept so the account status can be shown to you.
• About the people behind it: the name, title and ownership percentage of each person who owns 25% or more and of the person who controls the business. If a feature asks for an owner's date of birth, home address, Social Security number or government ID, that information goes to the bank for its legal checks; UnicoOS keeps the bank's result and reference ids, not the number or the document.
• Your agreement records: which agreements you accepted, their version, the date and time, and the IP address and browser the acceptance came from. We keep this as proof of your electronic signature and share it with the bank as evidence on your account file.
• Account activity: balances, transfers and their status, which the bank sends us so we can show them to you and keep your books.
• Documents you upload for the bank (for example formation papers or an EIN letter) are passed to the bank and kept with the account file.

Why

• To open the account and keep it open: identity and ownership verification, sanctions and fraud screening, and the bank's ongoing monitoring.
• To move money you ask us to move, show you what happened, and keep your accounting right.
• To meet the record-keeping and reporting duties the law puts on banks and the platforms that work with them.

Who sees it

• Column N.A., the bank, which runs its own checks and keeps its own records under its own privacy notice (available from column.com).
• Plaid, only to link an outside bank account you choose for top-ups, withdrawals or direct deposit (section 5 explains how Plaid works).
• Government agencies or courts when the law requires it. We do not sell this information and do not use it for advertising.

How long

Banking law requires account-opening and transaction records to be kept for years after an account closes — typically at least five. Those records are among the "records we must keep by law" in section 16: deleting your UnicoOS account closes your access, but these records stay for the required period and are then deleted.

Sandbox

While a Business Account shows Sandbox, it lives on the bank's test system. The business information you enter is still real and is handled as described here; the money is simulated.

18. Payroll and 401(k) Data

If you run payroll in UnicoOS, you give us information about the people you pay so we can figure their pay correctly. They are your employees or contractors; you decide what to enter, and this section describes how UnicoOS handles it.

What is collected

• Name, address, date of birth, Social Security number or ITIN, filing status and withholding choices, pay rate and hours, time-off and time-clock records.
• For direct deposit: the employee's bank account, linked by the employee through Plaid, and your business bank account. We show only the last four digits; full account numbers are stored encrypted.
• For 401(k): each person's election (pre-tax or Roth, amount or percentage), 401(k) loan repayments, your employer match and contribution settings, and year-to-date totals.
• Pay stubs, W-2s, 1099s, the per-payroll 401(k) contribution file and the year-end census, which UnicoOS generates from the above.

How it is used and shared

• Only to run your payroll, produce your forms and files, and keep your books. UnicoOS does not use payroll data for advertising and does not sell it.
• The 401(k) contribution file and census are created for your 401(k) provider. They leave UnicoOS only when you download or send them; UnicoOS does not send them to any provider on its own.
• Direct deposits you approve are sent through Plaid Transfer; Plaid's privacy policy (section 5) covers what Plaid keeps.
• Tax forms go to the people you pay and to the tax agencies, when you file them.

Who can see it, and for how long

• Only the owners and admins of your business whom you give payroll access, and each employee for their own stubs and forms.
• Social Security numbers, account numbers and other sensitive fields are stored encrypted and masked everywhere they are shown.
• Payroll and tax records are kept for the period tax law requires (generally at least four years after the tax is due or paid), then deleted. They are among the "records we must keep by law" in section 16.

19. Email Hosting (UniMail), Phone Line, Voice and AI

• UniMail mailboxes are hosted by Migadu on a domain you own in UnicoOS. Your mail is stored by Migadu on your behalf; UnicoOS keeps the mailbox address, plan and status, and writes the DNS records that make the mailbox work. You set your own mailbox password; UnicoOS never sees it. Canceling pauses the mailbox and keeps its contents.
• Sending email from your domain runs on Resend (section 8). We keep the sending records (recipient, subject, status) so you can see what went out.
• UnicoOS phone line and texting run on Twilio. We keep call and text logs (numbers, times, status) and message content you send or receive through UnicoOS. Calls are recorded only if you turn recording on.
• Voice and video sessions use a real-time media provider to carry the audio and video between the people on the call. Sessions are not recorded unless the feature says so.
• AI features (UnicoAI, UniRo, Guard Mail's detection and every AI-assisted tool) send the text or content you give them to our AI model providers — Google (Gemini), OpenAI and Anthropic — to produce a response, under business API terms that do not allow them to use your content to train their models. We keep the conversation or result inside your account so you can see it again, and delete it with your account (section 16).

20. Additional Service Providers

In addition to the providers listed in section 8, we share information with these providers for the features described in sections 17–19, each only for the purpose shown and each under terms that prohibit using it for their own purposes: Column N.A. (banking), Plaid (bank account linking and payroll direct deposit), Migadu (UniMail mailboxes), Twilio (phone and SMS), Google, OpenAI and Anthropic (AI responses), and the real-time media provider used for voice and video sessions.

21. How This Policy Changes

When we update this policy we add new sections with their own "added" date and move the "Last updated" line at the top. The sections already here stay as written, so you can always see what applied to you and when. If a change affects how we use information we already have, we tell you before it takes effect.

22. Church Giving and Donor Data (UnicoChurch)

When you give to a church through UnicoChurch, or run a church on it, this section describes what we keep and who sees it.

• What a gift records. The amount, date, fund, payment method, the church, the service it was given during (if any), your name and email as you entered them (or from your UnicoOS account), any note you wrote, and the receipt we sent. Card details never touch UnicoOS: Stripe collects them on its own checkout page. Bank gifts move through Column N.A. and Plaid (section 17).
• Who at the church sees your name. Giving is private by default. Only the church's lead pastor, its admins and the people it marks as treasurer see donor names and emails; campus pastors see totals for their campus; staff see no gifts. If you tick "keep my name private", the church sees "Anonymous" and your receipt still comes to you.
• Receipts and annual statements are emailed to the address on the gift and kept in your account (and the church's) for at least four years, the period tax law expects, then deleted with the other "records we must keep by law" (section 16). A refund replaces the receipt with a credit memo.
• Recurring gifts keep the amount, cadence, fund, your payment method's reference (a Stripe subscription id or your UniCash wallet) and each run's result, so you can pause or stop them any time.
• Prayer requests you send from a watch page are private to that church's pastoral team by default and are never used for advertising or shared with anyone else.
• Watching a live stream stores an anonymous viewer id in a cookie so the church can count attendance and peak viewers. It is tied to you only if you are signed in. The stream itself runs on our real-time media provider (section 19) and is not recorded unless the church turns recording on and says so.
• The church's own data — its legal name, EIN, address, tax-status declaration and the proof it uploads — is kept so receipts are correct and so the church can show it to the IRS, a donor or its bank if asked. Proof documents are filed with the church's bank partner as evidence and kept in the church's own Documents. The result of each review, and who reviewed it, is kept as an audit record.
• Denominations. A denomination a church links to sees the church's totals, donor counts and service schedule — never donor names, emails or individual gifts.
• No advertising. Nothing from church giving, prayer requests or watch pages is used to target or sell advertising, and no sponsored placements appear on church pages.
• Your choices. Pause or stop recurring gifts from the giving page; ask the church to correct a receipt; ask us at the address in section 15 to see or delete the data we hold about your gifts, subject to the records we must keep by law.