Operational draft — not legal advice. Working draft for early, founder-led use; requires review by a qualified lawyer before regulated / public-sector / enterprise use. Last updated 5 July 2026.

Privacy Policy

This policy explains how UnionFold handles personal data. It covers two roles: data we hold about our customers (where we are the controller), and data we process on behalf of customers about their site visitors (where we are a processor).

Controller details to be completed. The registered legal entity, address, country of establishment, and (if appointed) Data Protection Officer / EU representative contact are to be confirmed with counsel and inserted here. For any privacy request, contact info@unionfold.com.

1. Data we hold about customers (controller)

Account data: name, email, company, password hash, plan/billing metadata.
Usage data: sites, scans, settings, and product activity you generate.
Support/communications: messages you send us.

We use this to provide and support the service, bill you, secure accounts, and communicate. Legal bases include contract performance and legitimate interests.

2. Data we process for customers (processor)

When you use FoldCMP, we may process data relating to your site visitors on your behalf — most notably consent-log records (a record that a choice was made, with associated metadata). For this data you are the controller and UnionFold is the processor; we process it only to provide the service and per your instructions. See the Data Processing Addendum.

Our scanner analyses page source and response data to produce diagnostic findings; it is designed not to store raw sensitive evidence (for example, raw cookie values). Deep Scan (runtime) is a separate, limited capability.

3. Sub-processors

We use a small number of infrastructure sub-processors (hosting, CDN, payments, email). See the current Sub-processor list.

4. Retention

Account data is kept while your account is active and for a reasonable period afterwards. Consent-log retention follows your plan's configured window; you can request deletion.

5. Your rights

Subject to applicable law, you may request access, correction, deletion, or export of your personal data. For visitor data we process on a customer's behalf, requests should be directed to that customer (the controller); we will assist them as processor.

6. Security

We use access controls, encryption in transit, hashed credentials, and audit logging. No system is perfectly secure; we work to protect data and to respond to incidents.

7. International processing

Our primary hosting is in the EU. Where data is processed by sub-processors, we rely on appropriate safeguards (such as EU Standard Contractual Clauses) where required.

8. Cookies on this website

This marketing website (unionfold.com) uses a tag manager and loads UnionFold's own consent and accessibility widgets — the same tools we provide to customers. Non-essential tracking is governed by the consent choices you make in the banner on this site. You can change your choices at any time from the preference control.

9. Contact

Privacy questions: info@unionfold.com.

Official resources

Data Processing Addendum · Sub-processors · ← Back to unionfold.com