Privacy Policy
Last updated:
1. Who we are
UNIALL is a neutral discovery and data layer for tokenized real-world assets. We do not issue, custody, trade or match assets.
UNIALL is operated by Andreas Heidenblad, a private individual based in Sweden, who is the data controller for the personal data described in this policy. Contact: privacy@uniall.co. When UNIALL is incorporated, this policy will be updated to name the company as controller.
2. Scope
This policy covers uniall.co and its subdomains, user accounts, the Data API, the Agent API and the MCP server at https://api.uniall.co/v1/agent/mcp.
3. Data we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Category: Account data | Examples: Email, hashed password, account settings | Purpose: To provide accounts | Legal basis: Contract |
| Category: Wallet addresses | Examples: Wallet address, only if you connect a wallet | Purpose: To show public on-chain holdings | Legal basis: Contract / user request |
| Category: Identity data submitted in verification forms | Examples: Name, date of birth, country, company details | Purpose: To process verification and asset-holder applications | Legal basis: Contract / legal obligation |
| Category: Contact and access-request form data | Examples: Name, email, organization, role, message | Purpose: To respond to requests | Legal basis: Legitimate interest |
| Category: API and MCP usage data | Examples: API key ID, endpoint, timestamps, request counts; IP address for rate limiting of anonymous MCP access | Purpose: To operate, secure and meter the service | Legal basis: Legitimate interest |
| Category: Technical data | Examples: Browser type, device, error logs | Purpose: Security and reliability | Legal basis: Legitimate interest |
Where we rely on legitimate interests, these interests are responding to requests and keeping the service secure and reliable. A legal obligation applies only where an applicable law requires the processing.
4. What we do NOT collect via the MCP server and Agent API
We do not receive or store users’ AI conversations, prompts, chat history, memory or files through the MCP server or Agent API. We only receive the tool parameters sent to our endpoints (for example, a category or asset ID) and standard request metadata.
5. Public data
Asset, issuer and chain information in the index comes from public blockchains and public issuer sources. This index information is not personal data about our users. Wallet addresses that you connect are handled separately as described above.
6. Processors and third parties
| Provider | Purpose | Location |
|---|---|---|
| Provider: Render | Purpose: API hosting and database | Location: EU — Frankfurt |
| Provider: Cloudflare | Purpose: DNS, security, email routing | Location: Global infrastructure; processing may occur outside the EU/EEA |
| Provider: Resend | Purpose: Transactional email | Location: Processing may occur outside the EU/EEA |
| Provider: Lovable | Purpose: Website hosting | Location: Processing may occur outside the EU/EEA |
| Provider: Alchemy | Purpose: Blockchain data access | Location: Processing may occur outside the EU/EEA |
| Provider: CoinGecko | Purpose: Public price data | Location: Processing may occur outside the EU/EEA |
We use providers as needed to operate the service and share personal data only where necessary for their purpose. Not every provider receives account or identity data. We do not sell personal data.
7. International transfers
Where a provider processes personal data outside the EU/EEA, transfers rely on EU Standard Contractual Clauses or an adequacy decision. You can contact privacy@uniall.co for information about the safeguards applicable to your data.
8. Retention
| Data | Retention period |
|---|---|
| Data: Account data | Retention period: Until account deletion plus 30 days |
| Data: Verification data | Retention period: As long as required by law; otherwise deleted when no longer needed |
| Data: Form submissions | Retention period: 24 months |
| Data: API usage logs | Retention period: 13 months |
| Data: IP addresses used for anonymous MCP rate limiting | Retention period: Up to 24 hours |
| Data: Error logs | Retention period: 90 days |
9. Your rights under GDPR
Subject to the conditions in the GDPR, you have the right to:
- Access your personal data and receive a copy
- Rectify inaccurate or incomplete data
- Request erasure of your data
- Request restriction of processing
- Receive eligible data in a portable format
- Object to processing based on legitimate interests
- Withdraw consent where processing relies on consent, without affecting the lawfulness of earlier processing
To exercise your rights, email privacy@uniall.co. We respond within one month. If a request is complex or numerous requests require more time, the GDPR allows an extension of up to two further months; we will inform you within the first month. We may need to verify your identity before fulfilling a request.
You also have the right to complain to the Swedish Authority for Privacy Protection (IMY): imy.se.
10. Security
We use encryption in transit (TLS), hashed passwords and access controls to protect personal data. API keys are stored securely. No system can guarantee absolute security.
12. Children
The service is not directed to children under 16. If you believe a child under 16 has provided personal data to us, please contact privacy@uniall.co.
13. Changes
Material changes to this policy are announced on this page with a new “Last updated” date.
14. Contact
Questions or requests about your personal data: privacy@uniall.co.