How unrigid handles data

Draft, for review by a lawyer. Written from the platform's code as of 4 November 2026 (branch plan-8, commit 38248ef). Every retention period below is enforced in code (the hourly retention sweeps of the billing and export plan, 5 November 2026); the one item still marked [decide] is open. Meant to satisfy both India's DPDP Act and the EU GDPR; the lawful basis for each use is in the Privacy Policy.

This page lists, plainly, what unrigid stores, where, for how long, and who can see it. Our Privacy Policy explains your rights; this page is the detail behind it.

unrigid is run by Thothica Private Limited ("Thothica", "we"). Two kinds of people have data on unrigid:

• Customers: people with an unrigid account who build, edit or own websites. For their data, Thothica decides how it is used (in the DPDP Act's words, Thothica is the Data Fiduciary).
• Visitors to customers' websites, including people who fill in a site's forms. For their data, the website's owner decides; Thothica stores and processes it on the owner's behalf (Thothica is the owner's Data Processor). Questions about a site's visitors' data go to that site's owner first.

Where data is kept

Everything runs on Cloudflare. Databases (Cloudflare D1) are placed in Cloudflare's Asia-Pacific region; files (Cloudflare R2) are stored by Cloudflare in the location it chooses for the bucket; websites are served from Cloudflare's network around the world, from the location nearest each visitor.

What we store

1. Your account

2. Signing in

• Sign-in codes are emailed to you and stored only as a keyed hash: valid 10 minutes, 5 attempts, then deleted within the hour.
• Sessions are stored as a hash of the session id: they last 30 days from your last use and never more than 90 days from sign-in. We do not store your IP address or browser details with a session.
• Devices you signed in on are remembered as a hash for 90 days after their last use, to warn about unusual sign-ins.
• Rate limits against abuse use keyed hashes of the IP address, network, email or device, never the raw IP, and are deleted after 2 days.
• Claude connector (MCP): when you connect Claude, we keep the grant (your user and account ids, the client's name and address). Access tokens last 1 hour, refresh grants 30 days. A connector session is deleted after 24 hours idle.

Cookies on app.unrigid.ai (all strictly necessary, secure, not readable by scripts):

mcp.unrigid.ai sets similar short-lived cookies while you connect Claude. The app also keeps unsaved edits and drafts in your browser's own storage; they are cleared when you sign out.

3. Websites

When a site is deleted it goes offline at once and is removed 30 days later: its database, code, published copies and addresses are deleted, and its media files are moved to a bin that is emptied after a further 30 days. A copy is exported to our backups first (see "Backups"). When the site is removed, the records that still name people (people's roles on the site, invites, form recipients, file uploaders and file names) are deleted with it.

4. Content

Each site has its own database holding its content (pages, collections, items), drafts and the full history of every change, including who made it and whether it came from the CMS or from Claude. History is kept for the life of the site so changes can be undone; deleting an item keeps its history until the site is deleted.

The site's activity log (who changed what) is kept for 400 days. Account-level records (people added or removed, roles changed, connected apps, sites deleted) are kept for 7 years.

5. Media

Images and files uploaded to a site are stored as uploaded, with their original file name, alt text, size and who uploaded them. Once published they are public on the site. Deleted files go to a bin and are removed after 30 days.

Note for uploaders: photos keep any location and camera data they contain. Remove it before uploading if it matters. [decide: strip location data on upload]

6. Form submissions (visitors' data, processed for the site owner)

To stop spam, forms use Cloudflare Turnstile, which receives the visitor's IP address. When a form is submitted, the answers are emailed to the recipients the site owner confirmed. Anyone with access to the site (viewer or above) can read submissions; every read is recorded in the activity log.

7. Analytics and cookies on customers' websites

• Thothica Analytics: visit counts [Thothica Analytics: built, not yet live] (every visitor, no banner). For each page a visitor opens, we count it. We keep the website, the page address (without anything after a "?"), the website the visitor came from (its name only, such as google.com), whether they arrived from outside the site, and a count. We never keep the visitor's IP address, browser description, location, cookies or anything that tells one visitor from another. We read the IP address and browser description only to deliver the page and to leave out known bots, and we keep neither. Parts of a page address that could identify someone (an email address, a long number, a code) are replaced before anything is kept. Nothing is stored on the visitor's device and no script is used. If the visitor's browser sends a Global Privacy Control or Do Not Track signal, the visit is not counted at all. On for every new website; the site's owner can switch it off in Settings › Analytics.
• Thothica Analytics: details [Thothica Analytics: built, not yet live] (only visitors who agree). If the site's owner turns details on, the site shows a short consent banner. Only if the visitor agrees, a small script on the site's own address reports, once per page, the visitor's country, the kind of device and browser, and how fast the page loaded. No cookie is set; the visitor's choice is kept only in their own browser. They can change their mind at any time from the Cookie settings button, and the script stops on the next page.
• When a banner appears: a site whose owner turns on Thothica Analytics details or Google Analytics shows a consent banner; a site with only visit counts shows none, because nothing is stored on or read from the visitor's device.
• How long we keep it, and deletion [Thothica Analytics: built, not yet live]: daily summaries (what the owner's dashboard shows) are kept for as long as the website exists; raw records at most 3 months, then deleted automatically. When an owner deletes past visit numbers, or the website is deleted, we delete all of that site's Thothica Analytics numbers: the dashboard at once, and every total we hold for the site within hours. The only exception is the raw records, which our provider does not let us delete early: they hold page addresses and referring websites, nothing that identifies a visitor, are never shown again, and expire within 3 months.
• Cloudflare: Cloudflare is our host and runs every part of the service, so every request to a website passes through Cloudflare's network. Thothica Analytics' data is processed and stored by Cloudflare as our sub-processor: the raw records in Cloudflare's analytics store, the daily summaries in Cloudflare R2. Cloudflare also offers its own website analytics, which it can add to pages on the domains we host; every page we serve blocks it, so it collects nothing from visitors, and we do not use it.
• Our legal position: visit counts need no consent under either law. Nothing is stored on or read from the visitor's device beyond the request their browser sends to get the page, so the EU cookie rule (ePrivacy Directive Art. 5(3)) does not apply. What we keep identifies no one, so it is not personal data under the GDPR or the DPDP Act. The brief use of the IP address and browser description to deliver the page and filter bots rests on the site owner's legitimate interest under GDPR Art. 6(1)(f), and under the DPDP Act on the visitor's own request for the page (s.7(a)); nothing from it is kept. Visitors can object at any time with Global Privacy Control or Do Not Track (GDPR Art. 21(5)). Details and Google Analytics need consent (GDPR Art. 6(1)(a) and the EU cookie rule; DPDP s.6). The site's owner decides whether Thothica Analytics runs on their site; Thothica processes the data for them under the Data Processing Addendum.
• Running the service: for each request to a site we also record counts and timings (site, status, cache, location of the serving data centre, timing), never an IP address, browser description, cookie or query string. Error records carry a cleaned page path. These are kept 3 months; daily totals per site are kept for capacity planning.
• Google Analytics runs only on sites whose owner turns it on, and only after the visitor clicks Accept in the site's consent banner. Its cookies last up to 395 days and are deleted if the visitor withdraws. The visitor's choice is stored only in their own browser (183 days); nothing about it is sent to us. "Global Privacy Control" is honoured as a refusal. The site owner, not Thothica, is responsible for their use of Google Analytics.
• On preview addresses only, a cookie __Host-unrigid_preview lets the site's team see unpublished versions.
• Sites may load fonts from Google Fonts, Bunny Fonts, Adobe Fonts, Fontshare, cdnjs or jsDelivr, which the visitor's browser then contacts directly.

8. Logs

Our services write operational logs to Cloudflare Workers Logs. Request logs are switched off on the services that handle people's requests (the app, sign-in, websites, forms and the Claude connector); our log lines are designed not to contain email addresses or content, and Cloudflare keeps them for a few days. Automatic alerts about faults go to our staff; the alert records (what went wrong, when, and how staff handled it) are kept for 1 year, then deleted. The records of who did what on a site or an account are kept longer (see "Content" and "What we must keep").

9. Backups

• Cloudflare keeps a 30-day point-in-time history of every database.
• Each site's database is exported weekly when it has changed; our own databases are exported nightly.
• Exports are kept for 90 days, then deleted by a storage rule that our code checks every day.

Deleted data can survive in backups until they expire.

10. Support

When you ask for help we keep your request: your name and email, the subject, your messages and ours, attachments (up to 10 MB each), and the page, browser and screen size you were using when you asked. If you allow it, our staff may view your site; each viewing is recorded with its reason. Email to support@unrigid.ai from addresses we cannot confirm is deleted after 90 days if unanswered. A request that waits 14 days for your reply is closed as solved. Solved requests are deleted 2 years after they were solved, and their attachments 1 year after.

11. Email we send

We send email through Resend: sign-in codes, form notifications (containing the visitor's answers), invites and site offers, support replies, status updates, billing emails and invoices. We keep delivery records (state and message ids, not addresses or contents) for 90 days. Open and click tracking is off.

12. Invites, transfers and reports

Invites expire after 14 days and offers of a site after 7 days. Reports made through "Didn't expect this? Report it", and requests not to be sent such emails again, are kept so we can act on them. Decided offers and reports are deleted 1 year after the decision; "don't send me these" requests are kept until withdrawn.

13. Data exports you ask for

When you export your data we build a zip of machine-readable files (JSON and CSV, plus your media files as they are) and keep it for 7 days for you to download, then delete it. It includes your websites' current published source files, and for each site a visits.csv of its Thothica Analytics daily totals and breakdowns [Thothica Analytics: built, not yet live]. This is how we meet GDPR's right to data portability. A short record of each export (when it was asked for and whether it finished, not its contents) is kept for 1 year.

Who receives data (our processors)

We give at least 30 days' notice on this page, and by email to site owners, before adding or replacing one.

We do not sell data, and we do not use customers' content or their visitors' data for advertising or to train AI models.

What we must keep

Some records outlive an account because the law requires them:

• invoices, credit notes and payment records: 8 years (GST);
• account-level activity records: 7 years;
• information about content we removed after a complaint or order, and an account's registration details after it is closed: at least 180 days (IT Rules, 2021);
• records of activity and of faults (who did what on a site or account; alert records): at least 1 year (DPDP Rules, 2025). Raw operational log lines are kept by Cloudflare for only a few days.

Contact

Siraj Ahmad Abbasi, Grievance Officer, Thothica Private Limited, C-29 F/F, Mayur Vihar Phase-1, Acharya Niketan, Opposite Pocket-1, East Delhi, Delhi 110091, India. siraj@thothica.com, +91 83184 39450. General questions: hello@thothica.com.