Privacy Policy

1A. Buying a node licence is a separate relationship

Two different companies are involved in Unetwork, and it matters which one holds what.

Separate systems. The two companies run separate account systems. You register with us to use the App, and separately with them to buy a licence. Neither can sign you into the other, neither holds the other’s account records, and neither has access to the other’s systems.

What passes between us. We send them only two things, and none of the other data in this policy: a payment instruction when you withdraw rewards, containing only the amount, the destination (a wallet address, or a bank account and account holder name) and a reference; and a licence flag, containing only the licence identifier and a reason category, in the limited cases described in §13. They send us none of their purchase records. Neither of us is permitted to match its records against the other’s, beyond what acting on a payment instruction or a licence flag requires, and neither does — that is a contractual obligation between the two companies, not merely a practice.

One thing you should know, because the possibility exists even though it does not happen. Most people use the same email address for both companies. Where that happens, the same identifier sits in two separate sets of records. Neither company may combine them. But if you would rather keep the two as far apart as possible, you can use a different email address with them than with us. Nothing requires them to be the same. Bear in mind that when you withdraw rewards, the destination you give us — a wallet address, or a bank account and account holder name — goes to them in the payment instruction.

And wallet addresses sit on a public blockchain. They carry no name, but they are pseudonymous rather than anonymous — anyone can see the transactions associated with one.

2. Who and what this policy covers

This policy covers everyone who uses the App, anywhere in the world, and anyone who contacts us through the business pages of the Unetwork website (unetwork.io/business). It is written against the UK GDPR and the Data Protection Act 2018, because we are established in the United Kingdom. The rest of the Unetwork website, including buying a node licence, is covered by Unity Network Limited (Hong Kong)’s Privacy Notice at unetwork.io/privacy-notice.

If you are in one of the following places, an annex adds rights and information that apply to you specifically. Where an annex differs from the main body, the annex prevails.

Where the App is not available. We do not make the App available, and do not knowingly collect personal data through it, in mainland China, Hong Kong, Macau or Russia. In Vietnam, Egypt and Bangladesh the App runs in a reduced mode described in §15.

Our App Terms (unetwork.io/terms) separately restrict availability in other countries for sanctions and telecoms-regulatory reasons. Those restrictions are not about data protection and are set out there rather than here.

3. The two kinds of data we hold

It helps to understand the App before reading the rest.

Your account. When you register, we hold an account: your login identity, your support history, and the record of your one-time identity verification (§4.3). If you buy a node licence, the records of that purchase, including its identity check, are held by Unity Network Limited (Hong Kong), not by us — see §1A.

Your device’s network measurements. When the App runs a verification task, your device measures the network it is connected to and reports the result. These measurements are about the network, not about you or your communications. We do not read your messages, your call history or your contacts for this purpose.

Both are personal data, because both are linked to your account. We say so plainly because earlier public statements of ours described the App as collecting no personal data. That was wrong, and correcting it is one reason this version exists.

4. The personal data we collect

4.1 Data you give us

4.2 Data your device reports automatically

Your precise location never leaves your phone. The App rounds your position to a cell of about 11 km on the device, before anything is sent. We never receive, store or transmit a precise coordinate, and we could not tell you which street you are on.

4.3 Verifying your identity when you register

You verify your identity once, when you create your account — before you run any tasks or earn anything. You will not be asked again.

We ask at the start rather than at the end deliberately: nobody should do weeks of work and then discover they cannot be paid. If you would rather not verify, you can decide that before you have invested any time, and nothing is lost.

Our verification provider, Sumsub, collects:

• your name, date of birth and address;
• an identity document — passport, national identity card or driving licence; and
• a photograph of your face and a short liveness check, compared against the photograph on your document to confirm you are the person it describes.

Why we ask. The main way this network is abused is one person running many accounts to use the App. Our other defences — device attestation, network analysis, device intelligence — identify devices and connections, not people, so they cannot stop someone using separate phones and separate networks. Verifying identity once, and allowing each verified person no more than two accounts, is what makes the system work for everyone else.

What the facial check is and is not. The comparison produces biometric data — information about your physical characteristics used to confirm you are who your document says. We use it for one purpose only: confirming that the document belongs to the person presenting it. We do not compare your face against other users, and we do not build a database of faces. It is a one-to-one check against your own document, nothing more.

How long it is kept. The facial image and the liveness recording are deleted as soon as the check completes, and in any event within 30 days. Sumsub keeps the record of the check — that it happened, when, and the identity details it confirmed — for five years. We never hold the image at all.

We may process biometric data as part of the user verification process, such processing is limited in scope and volume and does not constitute large-scale processing of special categories of personal data within the meaning of Article 37(1)(c) of the EU GDPR and the UK GDPR. The processing of biometric data is limited to what is necessary for user verification and is ancillary to our core business activities. Accordingly, we are not required to appoint a Data Protection Officer under the EU GDPR or the UK GDPR.

4.4 Verification task records

When your device performs a verification task, we record the technical result: timestamps, quality scores, routing outcomes, and a cryptographic hash of the result.

4.5 Device permissions

If you decline the optional permissions the App still works, but measurements may be less complete and you may earn less.

Permissions we do not request, despite what earlier versions of this policy said: we do not request access to your contacts, your microphone, your phone state, or permission to send SMS. The App cannot read your contacts and cannot send messages from your SIM.

4.6 What we never collect

The App does not have access to:

• the content of your personal calls, messages or communications;
• your web browsing history;
• your photos, files or media; or
• your precise location — your device rounds it to a cell of roughly 11 km before anything is sent, so we never receive it and could not tell you which street you are on.

We collect an identity document and a facial check only once, when you register, as described in §4.3. The App does not collect either in ordinary use, we never compare your face against other users, and neither ever appears in any licensed statistic.

4.7 Business enquiries through the Unetwork website

If you contact us through the business pages of the Unetwork website (unetwork.io/business), we collect your name, work email address, company, the market or carrier you are interested in, and your message. We use them to respond to you and to manage any business relationship that follows. Our lawful basis is legitimate interests — responding to enquiries about our services and managing our business relationships. Your enquiry reaches us through our email provider, SendGrid. We keep it for 24 months from our last contact.

We also use Google Analytics, under our own account, to understand how the business pages are used. It receives your IP address, information about your device and browser, and the pages you visit. Where the law requires consent for analytics cookies, including in the UK and the EEA, we set them only if you agree through the Website’s cookie banner. The rest of the Unetwork website is the responsibility of Unity Network Limited (Hong Kong) under its Privacy Notice.

5. Why we use your data, and our lawful basis

Where we rely on legitimate interests, we have assessed our interest against your rights and recorded the assessment. You can ask us for it, and you can object at any time (§12).

Where we rely on consent, you may withdraw at any time, and withdrawing is as easy as giving it. Withdrawal does not affect anything we did lawfully beforehand.

6. Consent

6.1 What we ask you to consent to

We ask separately for each of the following. They are independent: accepting one does not accept another, none is pre-ticked, and you can change any of them at any time in Settings → Privacy.

1. Approximate location — so measurements can be attributed to a region.
2. Background location — so measurements continue when the App is not open.
3. Optional SDKs — named individually at the point we ask, including Fingerprint.
4. Licensing — permission to include your device’s measurements in the aggregated statistics we license to third parties, described in §7.
5. AI-assisted support — see §8.4.
6. Biometric data — see §4.3.

6.2 Our record of your choices

We keep an append-only record of every consent you give or withdraw, including the date, the version of this policy then in force, and the exact wording you were shown. We keep it so that we can prove what you agreed to, and so that you can find out.

7. Aggregated statistics we license to third parties

This is the part of our business that this policy exists to explain properly. We license aggregated, de-identified statistics derived from network measurements to third parties.

Who we license to. Telecommunications operators, network-security vendors, IP-intelligence vendors, and research organisations.

What is in the statistics. Counts, medians and distributions describing networks — for example, how many devices observed a given network operator in a given country in a given month, or the typical connection quality on a given network. Every figure covers a group of at least 20 devices; figures that would describe a smaller group are merged into a larger one or withheld.

What is never in them, and never leaves our secure environment:

• any row describing a single device or a single person;
• your email address, phone number, wallet address, name, identity document or any other identifier;
• your raw or hashed IP address, or your device identifier;
• your precise location;
• the content of any message, or any destination number;
• any attestation token; and
• any data we receive from a verification or intelligence vendor.

Whose data is included. Only devices whose owners have given the separate licensing permission described in §6.1. If you have not given it, your device’s measurements are not included — and measurements taken before you gave it are not included either.

We do not sell personal data. No product we license contains personal data, and we do not sell, rent or trade the personal data described in §4 to anyone.

Anonymisation. Before any statistic leaves our secure environment, we remove every identifier listed above, aggregate measurements into groups of at least 20 devices, and merge or withhold any figure that would describe a smaller group.

No re-identification. Everyone we license to is contractually forbidden from attempting to re-identify any individual or device, from combining our statistics with other data to do so, and from passing the statistics on. We publish our de-identification method separately.

8. Who we share your data with

8.1 Service providers

Each processes personal data only on our written instructions.

8.2 Others

We share personal data with public authorities where legally required, and with professional advisers under a duty of confidence. If our business is sold or reorganised, data may transfer to the acquiring entity under the same protections.

Unity Network Limited (Hong Kong). When you withdraw rewards, we send it a payment instruction so that it can pay you, and in the limited cases described in §13 we notify it that a licence is flagged. §1A sets out exactly what each contains. It uses them as a separate controller, under its own Privacy Notice (unetwork.io/privacy-notice).

8.3 What we do not share

We do not share any of the data described in this policy with Unity Network Limited (Hong Kong), other than the payment instructions and licence flags described in §1A. Nor do we share it with any company in a country subject to relevant restrictions. If you have also bought a node licence from that company, we do not join your purchase record to anything here — see §1A. We do not share personal data with advertisers, and we do not track you across other companies’ apps or websites.

8.4 Artificial intelligence

Our support desk uses AI-assisted triage to categorise and route support requests. Where your support correspondence is processed this way, we ask your explicit permission first, and you can decline without losing access to support — a person will handle your request instead.

We do not use AI to make decisions about you, and we do not permit any AI provider to train its models on your data.

9. Where your data is stored and sent

Your data is held in the United Kingdom and the European Union. Our own staff work remotely from Ukraine, but they reach our systems through a controlled access point in Europe — the data stays in Europe and is not copied to their devices.

Every processor listed in §8.1 processes your data in the United Kingdom or the European Union.

Where a provider processes data outside the UK, we use the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with encryption and access controls, unless the country has a UK adequacy decision.

Where your data reaches us from outside the UK, we put in place whatever that country’s law requires. The annexes say what that is for each country listed.

We do not transfer personal data to Hong Kong, mainland China or Macau, except the payment instructions and licence flags we send Unity Network Limited (Hong Kong), described in §1A. Hong Kong does not have a UK adequacy decision, so we make those transfers under the UK International Data Transfer Agreement.

10. How long we keep your data

Aggregated statistics already licensed cannot be recalled, because they contain no personal data and no one can tell which devices contributed to them. Withdrawing consent stops your device contributing to future statistics.

11. How we protect your data

Encryption in transit and at rest; role-based access control with multi-factor authentication; logging and monitoring of access; vendor due diligence; and periodic security testing.

The systems holding aggregated statistics are built so that they cannot link measurements back to an account. That is a property of how they are built, not a rule someone has to remember.

12. Your rights

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data;
• restrict or object to how we use it, including any use based on legitimate interests;
• give you your data in a portable form, or send it to someone else; and
• withdraw any consent you have given.

Write to us at the address in §1. We answer within one month. We do not charge, and you do not have to give a reason.

If you are unhappy with our answer you can complain to the Information Commissioner’s Office (ico.org.uk), or to the supervisory authority where you live — see the annexes.

13. Automated decisions

We use automated checks to decide whether a verification result is genuine. These look at whether a device is attested, how many devices share an IP address, whether traffic comes from a data centre or VPN, and whether a licence is flagged.

We also screen the destination — a wallet address, or a bank account and account holder name — against sanctions lists before we send a payment instruction (§1A). If a withdrawal is blocked for that reason we will tell you, unless the law prevents us from saying so. As the payer, Unity Network Limited (Hong Kong) may also refuse or delay a payment where the law requires it.

Licence flags. If you hold a node licence and we confirm a serious breach by your own App account — fraud, running more than two accounts, automation, or breaking the rules on authorised devices and network access — we may notify Unity Network Limited (Hong Kong) that the licence is flagged. We send only the licence identifier and a reason category (§1A). We do so only after any review by a person that you have asked for (below) is complete, and never because of something done by someone leasing your licence. Before that company takes any action on the licence, which can include forfeiting it, it will give you written notice and 14 days to respond, and any decision it takes is made by a person. It does not tell us the outcome.

You can ask a person to review any such decision. Write to us at the address in §1, tell us what happened, and a member of staff — not a system — will look at it and tell you the outcome. You can also contest the decision and give us information you think we missed.

14. Children

The App is for adults. You must be 18 or over to register, and we check age at registration and again at identity verification. We do not knowingly collect data from anyone under 18, and no person under 18 is included in any licensed statistic. If you think a child is using the App, tell us and we will delete the account.

15. Countries where the App works differently

In Vietnam, Egypt and Bangladesh, the App runs in a reduced mode: measurements are aggregated on your device before they are sent, no per-device record is created, and your device is never included in any per-device dataset. You can still use the App.

In mainland China, Hong Kong, Macau and Russia, the App is not available and we do not collect data through it.

16. SDKs and similar technologies

The App uses software development kits for functionality, security and diagnostics. Those necessary for the App to work at all, and those strictly necessary for security and fraud prevention, run without consent because the law permits it. Everything else runs only if you agree, and we name each one when we ask.

You can change your choices at any time in Settings → Privacy, or in your device’s own app permission settings.

17. Changes to this policy

If we change this policy in a way that affects you, we will tell you in the App before the change takes effect. We keep every previous version and will give you any of them on request.

18. How to contact us

Unity Network Tech Limited

128 City Road, London, EC1V 2NX, United Kingdom

privacy@unetwork.io

Annex A — European Economic Area

Our EU representative (Article 27 EU GDPR): VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland.

If you are in the EEA, the EU GDPR applies and everything in the main body applies with the same meaning. In addition:

• You may complain to the supervisory authority in your country of residence or workplace, or bring a claim in your own courts.
• Where we read information from, or store information on, your device, we ask your consent first, except where the reading is strictly necessary to provide the service you requested.
• Our assessment that the licensed statistics in §7 are anonymous, and therefore outside the GDPR once produced, is documented and available on request.

Annex B — California

We do not sell or share your personal information as those terms are defined by the California Consumer Privacy Act, and we never have. We do not offer financial incentives in exchange for personal information.

You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. Use the contact details in §1.