Your data

Privacy
policy

Last updated: 8 October 2026

Ultra Apps is a platform operated by Unthinkable Solutions LLP, Gurgaon, Haryana, India. We build AI-native business apps and the connectors those apps use — including our Meta (Facebook and Instagram) integrations for advertising and messaging.

This policy explains what we collect, why, who we share it with, how long we keep it, and how you get it deleted. It covers ultraapps.ai, app.ultraapps.ai, our mobile app Ultra Apps for iOS and Android, and the apps we run for our customers.

1. Who this policy is about

Two groups of people appear below, and they have different rights.

  • Our customers and their teams — the businesses and people who sign in to Ultra Apps and connect their own accounts. For their data we are the controller.
  • Their end customers — people whose details reach us through a customer's connected account, such as someone who fills in a lead form on that customer's ad or messages their WhatsApp number. For that data our customer is the controller and we act as their processor.

2. What we collect

Account and workspace data

Your name, work email, profile picture, the organisation you belong to, your roles and permissions, and the apps, records and workspaces you create. You sign in with Google, with Apple, or with an email address and password — we never receive your Google or Apple password. If you sign in with Apple and choose to hide your email, we receive only the relay address Apple provides.

Data from a connected Meta account

When you connect a Meta account, and only within the permissions you grant at that moment, we read and store:

  • Business, ad account, Page and Instagram account names and identifiers
  • Campaigns, ad sets, ads, creatives, audiences and budgets
  • Delivery and performance metrics — spend, impressions, clicks, conversions and the figures we derive from them
  • Product catalogue metadata, where you run catalogue ads
  • Leads submitted through Meta Lead Ads on your Pages. These contain the fields your form asks for, which normally include personal information such as a name, email address and phone number
  • The access token that authorises the above, stored encrypted on our servers and never exposed to a browser

Data from a connected Google (Gmail) account

When you connect your Gmail account, and only within the permissions you grant at that moment, we access:

  • Your Gmail address, so we can show which account is connected
  • Permission to send email from your address (gmail.send) — used only to send the emails you write and send from inside Ultra Apps
  • Where you turn on inbox reading (gmail.readonly): for your recent messages, the sender, recipients, subject, date, a short preview (snippet) and Gmail labels such as unread or sent, so they appear in your app
  • The access and refresh tokens that authorise the above, stored encrypted on our servers and never exposed to a browser

WhatsApp and in-app messages

Where you run a WhatsApp assistant, we receive and store the phone number that messaged you, the message content, and the thread it belongs to — whether the number is connected through Meta's WhatsApp Business Cloud API or through our messaging partner. The same applies to conversations held with an assistant inside the app.

Content you give us

Creative copy and images, brand assets, prompts you send to our AI assistants, files you upload, and the business records inside the apps you run on Ultra Apps. In the mobile app, when you pick a logo or icon for a project we receive only the image you choose from your photo library, never the library itself.

Website enquiries

If you fill in a form on ultraapps.ai we store what you entered — typically your name, email address, phone number and message — and email it to our team so someone can reply.

Technical data

Server and error logs needed to keep the service running, and a record of which page was viewed and when. Our website analytics store the page address, the site and a timestamp — no IP address, no device fingerprint, and no third-party trackers of any kind.

In the Ultra Apps mobile app we also record which screen you opened and when, tied to your account, so we can see which parts of the product are used and improve them. These events go only to our own servers — there is no third-party analytics SDK, no advertising identifier, and no tracking of you across other companies' apps or websites. You can ask us to stop recording them by writing to hello@ultraapps.ai, and once you delete your account they are no longer tied to a name or email address.

3. What we do not collect

  • We never ask for or store your Facebook, Google or Shopify password.
  • We do not store payment card numbers. Card details go directly to our payment provider, Razorpay; we only see whether a payment succeeded and which invoice it settled.
  • We run no advertising cookies, no analytics SDKs and no session-recording tools on our website or in our apps.
  • We do not buy personal data from data brokers, and we take Meta data only through the official APIs, under the permissions you granted.

4. How we use it

  • To run the service you asked for — connect your accounts, build and launch campaigns, allocate budgets and report results
  • To generate recommendations, drafts and insights inside your own workspace
  • To deliver leads and messages to you and to the app you route them into
  • To provide support, diagnose faults, and keep the platform secure and available
  • To bill you and to tell you about changes to the service
  • To meet our legal obligations

We never sell, rent or trade your data. We do not use one customer's data to benefit another, and we do not build cross-customer advertising profiles.

5. AI processing

Ultra Apps uses AI models from Anthropic and OpenAI to draft copy, generate images and produce insights. When a feature needs it, the relevant content is sent to those providers through their business APIs, which do not use it to train their models. We do not train models on your data either, and we send only what a feature requires.

6. Who we share it with

  • Meta Platforms, Inc. — to read and write the campaign objects and messages you ask us to manage
  • Supabase and Amazon Web Services — our database, storage and application hosting, in the Mumbai (ap-south-1) region
  • Cloudflare — edge delivery of our websites and applications
  • Razorpay — payment processing
  • SendGrid — transactional and notification email
  • Anthropic and OpenAI — the AI features described above
  • Our WhatsApp messaging partner, where your number is connected through a business solution provider rather than directly to Meta
  • Google LLC — to send and read Gmail on your behalf, when you connect your Gmail account
  • Other platforms you connect yourself — at your instruction and under your control
  • Advisers and authorities — where the law requires disclosure

Each provider is bound to confidentiality and may use the data only to provide their service to us. Write to us for the current list.

7. Meta platform data — our specific commitments

  • We use it only to provide the features you connected it for.
  • We keep it only while we need it, and delete it when you disconnect or ask us to.
  • We never transfer it to an ad network, data broker or monetisation service.
  • We handle it in line with the Meta Platform Terms and Developer Policies, including their data-use limitations.

8. Google user data — our specific commitments

  • We use Gmail data only to provide the features you connected it for: sending the emails you send from Ultra Apps and showing your own messages to you inside the app.
  • Only you, and people you deliberately give access to inside your workspace, can see your Gmail data in Ultra Apps.
  • We do not sell Google user data, do not use it for advertising, and do not transfer it to ad networks, data brokers or information resellers.
  • We do not use Google user data to develop, improve or train generalised AI or machine-learning models, and we do not send it to our AI providers.
  • No person at Ultra Apps reads your Gmail data unless you ask us to (for example, for support), it is needed for security or abuse investigations, or the law requires it.
  • You can remove Ultra Apps' access to your Gmail at any time from your Google account at myaccount.google.com/permissions. Removing it stops all access at once; you can ask us to delete the messages we stored, as described in section 11.
  • Ultra Apps' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. How long we keep it

We keep your account and workspace data for as long as your account is open, and data synced from a connected account for as long as that connection is live. Disconnecting a Meta account deletes its access token immediately. When you close your account or ask us to delete your data, we remove it from our production systems; copies may persist for a short period in the encrypted backups our hosting provider takes, until those roll over. We keep the billing records Indian tax law requires us to keep, and statistics that can no longer identify anyone.

10. How we protect it

  • Every connection to our services is encrypted with TLS 1.2 or above.
  • Our database and file storage are encrypted at rest by our hosting provider.
  • Access tokens and provider secrets are held server-side, encrypted, and are never sent to a browser.
  • Access to customer data is governed by per-organisation roles and grants, and production access is limited to the engineers who need it.
  • Inbound webhooks from Meta, WhatsApp and Razorpay are verified by signature before we accept them.
  • If a breach affects you, we revoke the affected credentials, tell you, and notify regulators where the law requires it.

11. Your rights

You can ask us for a copy of your data, for a correction, for deletion, for a restriction on a particular use, or to withdraw a consent you gave earlier. Write to hello@ultraapps.ai and we will respond within 30 days.

You can also delete your account yourself. In the Ultra Apps mobile app open Settings, then Personal, then Account, and choose Delete account. This is immediate: your name, email address and profile picture are removed, your organisation and app memberships are revoked, and you are signed out. Records you created inside an organisation's workspace belong to that organisation and stay with it.

If you responded to an ad or messaged a WhatsApp number that we operate for one of our customers, see Data Deletion Request — we will act on your request and pass it to that customer, who is the controller of your data.

Depending on where you live, you may also have the right to complain to your data protection authority.

12. Where your data lives

Our primary database and file storage are hosted in the Mumbai (ap-south-1) region. Some providers named in section 6 process data outside India; where that happens we rely on their standard contractual clauses or equivalent safeguards.

13. Cookies

We set only the cookies the service needs: one that keeps you signed in, and one that lets a site owner preview unpublished pages. There are no advertising or tracking cookies on ultraapps.ai.

14. Children

Ultra Apps is a business product and is not directed at anyone under 18. We do not knowingly collect data from children.

15. Changes to this policy

We may update this policy. The current version always lives on this page, and we will tell customers about material changes before they take effect.

16. Contact us

Ultra Apps Support
Email: hello@ultraapps.ai