Privacy Policy

Last updated: 10 August 2026 · Controller: Andreas Fleschurz (Imprint) · Contact: hello@unmask.tools

Short version: The extension reads page text locally on your device to detect phrases. No page content is sent to our servers unless you explicitly enable global data sharing (off by default). We collect only what is necessary to run the service and never sell your data.

1. Who we are

unmask.tools is an independent language analysis tool operated by Andreas Fleschurz, Rebengasse 1-7/25, 2700 Wiener Neustadt, Austria. References to "we", "us", or "our" in this policy refer to the operator. For data protection enquiries, contact hello@unmask.tools.

The protection of your personal data is important to us. This Privacy Policy explains which personal data we process, for which purposes and on which legal bases, how long we retain the data, which recipients may receive it and which rights you have under applicable data protection law.

The short summary at the beginning of this Privacy Policy is provided for convenience only and does not replace the complete information below.

2. What data we collect and why

Data Purpose Legal basis (GDPR) Stored where
Email address Account creation, key delivery, transactional emails Contract performance (Art. 6(1)(b)) Supabase (EU region)
Name (optional) Personalising emails Contract performance (Art. 6(1)(b)) Supabase (EU region)
API key usage count Enforcing daily limits per tier Contract performance (Art. 6(1)(b)) Supabase (EU region)
Stripe billing data Payment processing Contract performance (Art. 6(1)(b)) Stripe (see Stripe's privacy policy)
Detection events (phrase, domain, country, sector) Global detection dataset — only if you opt in Consent (Art. 6(1)(a)) Supabase (EU region)
Confirmation / dismissal events Improving phrase accuracy — only if you opt in Consent (Art. 6(1)(a)) Supabase (EU region)

3. What we do NOT collect

4. The browser extension — local processing

The unmask.shield extension analyses page text entirely within your browser using a locally bundled phrase library. No page content leaves your device unless:

Extension settings (API key, Ollama configuration, toggle state, custom phrases) are stored exclusively in chrome.storage.local on your device and are never transmitted to our servers.

5. Data sharing and third parties

We use the following service providers and recipients of personal data where necessary for the provision of the Service:

We do not sell, rent, or share your personal data with any other third parties. Where you have voluntarily enabled the global data sharing feature described in section 4, anonymised detection events submitted by you may be incorporated into this aggregated dataset. Only anonymised information is included; no personal data is incorporated into the dataset. Anonymised aggregate data (which contains no personal data) may be commercially licensed — see section 5a below.

5a. Commercial dataset licensing

unmask.tools may make the anonymised aggregate phrase dataset available to research institutions, data analytics companies, and similar organisations under a commercial data licence. This dataset consists exclusively of:

The dataset contains only anonymised information that cannot be linked back to individual users. No email addresses, API keys, account identifiers, or any data that could be used to identify you is ever part of these exports. The legal basis for this processing is our legitimate interest in funding the research mission of unmask.tools (Article 6(1)(f) GDPR), balanced against the minimal privacy impact given the fully anonymised nature of the data.

You can learn more, view a sample dataset, and submit a licensing inquiry on our Data Room page.

6. Data retention

7. Your rights under GDPR

If you are located in the European Union or EEA, you have the following rights:

To exercise any of these rights, email hello@unmask.tools. We will respond within one month of receipt. For complex or numerous requests we may extend this by a further two months; in that case we will inform you within the first month.

Please note: as submitted detection events are fully anonymised and cannot be linked back to you, they cannot be individually deleted once contributed to the dataset. Future contributions can be stopped at any time by disabling global data sharing in the extension settings.

The competent supervisory authority for Austria is the Datenschutzbehörde (DSB), dsb.gv.at. You have the right to lodge a complaint with the DSB if you believe your data has been processed unlawfully.

8. International transfers

Some sub-processors are based in or transfer data to the United States. Where this occurs, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism in accordance with GDPR Art. 46(2)(c). The applicable mechanism per sub-processor is:

9. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted connections (TLS), access controls, and row-level security on our database. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Children

unmask.tools is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to registered users. The "last updated" date at the top of this page will always reflect the current version.

12. Contact

For any privacy-related questions or requests: hello@unmask.tools