Unit Oncall logo markUnit Oncall
Back to Home

Privacy Policy

v1.0.0

Effective Date: January 4, 2026

This Privacy Policy describes how G Y UNIT LIMITED LIABILITY COMPANY ("we", "us", or "our"), a company located in Tokyo, Japan, collects, uses, and shares your personal information when you use the Unit Oncall service (the "Service").

1. INFORMATION WE COLLECT

We collect only the minimum information necessary to provide the Service:

Account Information

Email address and display name.

Technical Identifiers

Device tokens (for push notifications) and IP addresses.

Alert Data

Information contained in alerts sent from your integrated monitoring tools.

NO PHONE NUMBERS

We do not collect or store your physical phone numbers. VoIP communications are handled via data-based protocols (WebSocket/Push).

Sandboxed Execution Environment Inputs (AI-Operated Terminal Sessions)

If you enable AI-operated terminal sessions and configure the Service to access your own infrastructure or third-party systems, we collect and process the credentials, API keys, access tokens, and similar secrets that you supply for that purpose. In addition, where audit logging is included in your plan (see §3 and §6), we collect the commands executed during each session, their outputs, and associated metadata (such as timestamps, the requesting user, and the session identifier); on plans that do not include audit logging, the corresponding records are not created. For the categories of personal information that we disclose to California consumers under the CCPA/CPRA, these inputs fall under the "Internet or other electronic network activity information" category. To the extent that any credentials you supply allow access to an account, such items may additionally constitute sensitive personal information under CPRA §1798.140(ae)(1)(L), and the rights described in §7-1 (including the Right to Limit Use of Sensitive Personal Information) apply accordingly. See the "Sandboxed Execution Environment for AI-Operated Terminal Sessions" subsection of §3 (Data Processing and AI Safety) for how these inputs are processed, retained, and (where applicable) discarded, and refer to §6 — Data Retention for the retention periods that apply to operational audit logs.

Social Login Information (OAuth)

When you choose to sign in using Google or GitHub, we receive:

  • Your email address
  • Your display name
  • Your profile picture URL

We do not receive or store your Google or GitHub password. Your social login credentials are handled entirely by Google or GitHub.

2. HOW WE USE YOUR INFORMATION

We use your information to:

  • Provide and maintain the Service.
  • Process transactions and fulfill orders through our third-party processors.
  • Detect, prevent, and address fraud, unauthorized access, or security issues.
  • Comply with legal and regulatory obligations.
  • Create and manage your account.
  • Deliver notifications to your devices via VoIP and push notifications.
  • AI Summarization: Utilize Google Cloud Vertex AI to summarize and reformat alert data to provide more understandable notifications.
  • Analyze and improve the performance and security of the Service.

We do not process your personal information for purposes that are incompatible with the original purpose of collection without providing you with direct notice and obtaining your consent.

3. DATA PROCESSING AND AI SAFETY

We utilize enterprise-grade AI infrastructure to ensure your data is handled securely:

Vertex AI Processing

We use Google Cloud Vertex AI to process alert data.

No Training

In accordance with Google Cloud's data governance policies, your data is NOT used to train Google's foundational AI models. Your information remains your own.

AI Responsibility

While AI helps clarify alerts, it may occasionally generate inaccurate information. You are responsible for verifying the original alert data before taking any action.

Sandboxed Execution Environment for AI-Operated Terminal Sessions

When you use AI-operated terminal sessions offered by the Service, command execution takes place inside a managed, sandboxed runtime environment hosted on Google Cloud Platform. Any customer credentials, API keys, or other secrets that you configure for use in such sessions are stored at rest in Google Cloud Secret Manager, retrieved at session start, and injected into the runtime environment as environment variables for the duration of the session, without being intentionally written to any additional persistent storage.

The runtime environment is ephemeral. At the end of each session the environment is destroyed, and the injected credentials, environment variables, and any other in-session state are discarded together with it; we do not intentionally persist the injected credential values outside of Secret Manager, and where audit logging is included in your plan, we apply best-effort scrubbing of known credential patterns before storage. However, if a command executed during a session outputs or directly references a credential value in its text (for example, by echoing the value to standard output, or by embedding the literal value in a command argument), that value may appear in the audit log entry for that command. Credentials and secrets stored in Google Cloud Secret Manager are retained for as long as the AI-operated terminal sessions feature remains configured in your account, and are deleted within 30 days following account deletion or your removal of the configuration from the Service, whichever occurs first. Where audit logging is included in your plan, commands executed by the AI agent, their outputs, and associated metadata (such as timestamps, the requesting user, and the session identifier) are recorded in our internal audit logs in order to support security monitoring, incident response, abuse prevention, and compliance with applicable laws and our security obligations to you; these logs are retained as described in §6 — Data Retention. On plans that do not include audit logging, the corresponding records are not created.

4. DATA STORAGE AND CROSS-BORDER TRANSFER

Storage Location

Your personal data is stored and processed in the United States using Google Cloud Platform infrastructure.

Transfer to Japan

As we are a Japanese company, your data may be accessed by our personnel in Japan solely for maintenance and support purposes.

Consent

By using the Service, you expressly consent to the transfer and processing of your personal data in the United States and Japan.

For Residents of Canada: Your personal information may be subject to the laws of the United States, and may be subject to disclosure to the governments, courts, or law enforcement or regulatory agencies of the United States, pursuant to its laws.

5. REGIONAL RESTRICTIONS (GDPR)

The Service is intended for residents of the United States, Canada, and Japan. It is NOT intended for residents of the European Union (EU) or the European Economic Area (EEA).

6. DATA RETENTION

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Upon account deletion, your personal data will be removed within 30 days, except (i) where retention is required by applicable law, and (ii) as otherwise provided in the subsection below for operational audit logs.

Operational Audit Logs (AI-Operated Terminal Sessions)

For organizations on plans where audit logging is included, we retain operational audit logs — specifically, records of commands executed by the AI agent during sandboxed terminal sessions, their outputs, and associated metadata (see §3) — for up to five (5) years from the date the record is created, after which the records are deleted from active systems; any copies retained in backup or archival systems are purged in the ordinary course of our backup rotation schedule and are accessed only for disaster recovery or the security monitoring, incident response, abuse prevention, and compliance purposes described in this subsection. This retention period applies as an exception to the general 30-day post-deletion period stated above; these logs are retained for security monitoring, incident response, abuse prevention, and compliance with our legal and contractual security obligations. Logs may be retained for a longer period only where required by applicable law (for example, in response to a legal hold). Audit logging is not available on plans that do not include the feature; in that case the corresponding records are not created.

To the extent that credential values constitute sensitive personal information under CPRA §1798.140(ae)(1)(L) and are captured in an audit log entry despite our best-effort scrubbing (as described in §3), those values are retained as part of the audit log record for the period described in this subsection. To exercise your Right to Limit Use of Sensitive Personal Information (described in §7-1) with respect to such content, please contact us using the information in §14 Contact Us.

7. YOUR RIGHTS

7-1. General Rights Regarding Your Personal Data

Depending on your location, you may have certain rights regarding your personal data:

  • Right to Know and Access: You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months, including the categories of information collected, the sources, and the third parties with whom we share it.
  • Right to Delete: You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.
  • Right to Correct: You have the right to request the correction of any inaccurate personal information that we maintain about you.
  • Right to Limit Use of Sensitive Personal Information: You have the right to limit the use and disclosure of your sensitive personal information to only those services necessary to perform our business.

7-2. Privacy Notice for California Residents

This section applies solely to residents of the State of California ("consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 ("CCPA") and the California Privacy Rights Act of 2020 ("CPRA").

The CCPA/CPRA provides California residents with specific rights:

  • Right to Opt-Out of Sale or Sharing: You have the right to direct us to not "sell" your personal information for monetary value or "share" your personal information for cross-context behavioral advertising. (Note: We do not currently sell or share personal information as defined by these laws.)

  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

  • Authorized Agent: Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information for California residents.

7-3. Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by:

We will verify your identity before responding to your request.

7-4. Record Keeping and Retention

To ensure compliance with legal requirements, the Company maintains a record of all consumer requests and our responses thereto. We will retain these records for a minimum of 24 months, as required by CCPA/CPRA.

7-5. Children’s Privacy and Sale of Minors’ Personal Information

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect or maintain personal information from individuals under the age of 16. Furthermore, the Company does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

8. SECURITY

We implement industry-standard security measures to protect your personal data, including encryption in transit (TLS) and at rest. However, no method of transmission over the Internet is 100% secure.

9. THIRD-PARTY SERVICES

The Service integrates with third-party services:

  • Google Cloud Platform: For hosting, AI processing, and infrastructure. This includes Google Kubernetes Engine (GKE) Autopilot as the managed runtime that hosts sandboxed terminal sessions for AI-operated terminal features, and Google Cloud Secret Manager as the store of record for customer-supplied credentials used by those sessions. Google Privacy Policy
  • Google reCAPTCHA: To protect our contact form from spam and automated abuse. When you use our contact form, reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. We act as the data controller for this information. Google Privacy Policy
  • Google OAuth: For optional social login authentication. Google's privacy policy applies to data processed by Google. Google Privacy Policy
  • GitHub OAuth: For optional social login authentication. GitHub's privacy policy applies to data processed by GitHub. GitHub Privacy Statement
  • Stripe Managed Payments (Stripe, Inc.): Acts as our Merchant of Record (MoR) in the jurisdictions where Stripe Managed Payments is offered, handling payment processing, invoicing, chargeback handling, and tax compliance—calculating, collecting, and remitting applicable sales taxes, VAT, and GST (Stripe Tax provides the underlying calculation engine). Stripe Privacy Center
  • Postmark (ActiveCampaign, LLC): For transactional email delivery (e.g., password resets, email verification, system alerts). Postmark Privacy Policy
  • Apple Push Notification Service (APNs): For iOS push notifications. Apple Privacy Policy
  • Firebase Cloud Messaging (FCM): For Android push notifications. Google Privacy Policy

Each third-party service has its own privacy policy governing the use of your data.

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies on unit-oncall.com to operate our service and understand usage patterns. You can manage your preferences via the Cookie Banner displayed on first visit, or by clearing your browser storage for unit-oncall.com to reset your choices.

10-1. Categories

| Category | Purpose | Cookies | Local Storage | Opt-out | |---|---|---|---|---| | Necessary | Essential for site operation (security, session) | — | unit-oncall-cookie-consent (records your cookie preferences; technically a Local Storage item, not a cookie) | Cannot be disabled | | Analytics | Anonymous usage measurement to improve our product | Firebase Analytics (GA4) _ga, _ga_* | — | Toggle "Analytics" off in the Cookie Banner | | Marketing | Currently not used (toggle reserved for future advertising features) | — | — | Toggle "Marketing" off in the Cookie Banner |

10-2. Consent Mode v2

We implement Google Consent Mode v2. When you visit unit-oncall.com for the first time, the following Consent Mode categories are set to denied by default: analytics_storage, ad_storage, ad_user_data, and ad_personalization. Other Consent Mode categories not used by this site (such as functionality_storage and security_storage) remain at their browser defaults. Analytics scripts (GA4) only fire after you explicitly grant consent via the Cookie Banner. This ensures no analytics or advertising cookies are placed on your device without your explicit opt-in.

10-3. Withdrawing Consent

You can change your cookie preferences at any time by clearing your browser storage for unit-oncall.com. The Cookie Banner will reappear on your next visit, allowing you to make a new selection.

10-4. Third-Party Sub-Processors

Firebase Analytics is provided by Google LLC. Their data handling is governed by Google's Privacy Policy and the Google Analytics Data Processing Terms. See §9 (Third-Party Services) for the full list of sub-processors.

11. GOVERNING LAW AND JURISDICTION

This Privacy Policy shall be governed by the laws of Japan. Any disputes shall be subject to the exclusive jurisdiction of the Tokyo District Court.

12. CONTROLLING LANGUAGE

This Privacy Policy is drafted in English. In the event of any discrepancy between the English version and any translation, the English version shall prevail.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective Date" above.

14. CONTACT US

If you have any questions about this Privacy Policy, please contact us at:

Contact Form: https://unit-oncall.com/contact/

Email: legal@unit-oncall.com

Address:
G Y UNIT LIMITED LIABILITY COMPANY
N&E BLD. 6F., 1-12-4, GINZA, CHUO-KU, TOKYO, JAPAN

Questions about this policy? Contact us