Undernap Privacy Notice

Version 2026-10-20

1. Controller

The controller for the processing of personal data described here is:

Alondra Butuc
Bismarckstr. 104
63065 Offenbach am Main
Germany
Email for data protection matters: datenschutz@undernap.com
General contact: support@undernap.com

"Undernap" is the name of the product, not a separate company. We have not appointed a data protection officer; to our knowledge we are not required to.

2. The essentials

• Your work stays on your Mac. The Undernap app stores your projects, Missions, Tasks, Results and project knowledge on your Mac. We do not receive them.
• You connect AI providers yourself. Undernap coordinates multiple AI models, tools and specialist runtimes behind one product experience. When Undernap uses AI, your Mac sends the necessary data directly to the AI providers you have connected with your own accounts. These providers are not our service providers (section 8).
• The account holds administrative data. In the Undernap account we store your email address, your workspace, its members, your plan, your licence and the names of your devices, not your projects, prompts, files or AI provider credentials.
• No advertising, no tracking. We do not sell personal data, do not use it for advertising and use no analytics or tracking tools.

3. Overview

4. The website undernap.com

4.1 Hosting and logs

Our website is hosted by Vercel Inc. (USA). Vercel delivers the pages from locations near you; the website's functions run in Vercel's Frankfurt region. When you visit, Vercel processes the technical data your browser sends: IP address, date and time, the page requested including parameters in the address, response status and data volume, browser and operating system.

We use this data to deliver the pages and to keep them running and secure (Article 6(1)(f) GDPR). We do not combine it with other data and do not analyse it on a personal level. Vercel keeps these logs only briefly, under its own retention periods.

4.2 No cookies, no analytics; one language setting

The pages of undernap.com set no cookies. They use no web analytics, no tracking and no advertising pixels, and they load no fonts, scripts or media from third parties.

If you switch the language with the DE/EN switch, your browser stores the value de or en in its local storage under the key undernap.language, so that the home page opens in your language next time. The value does not leave your browser. It is stored only because you expressly chose a language (section 25(2) no. 2 TDDDG). You can delete it by clearing the website data in your browser.

4.3 Founder Beta waiting list

What we process. When you ask for access to the Founder Beta, we process your email address, your consent and the language of the form. A field invisible to humans detects programs; if a program fills it in, we discard the request. To protect against abuse, your IP address is held briefly in memory but not stored.

Double opt-in. We send you an email with a confirmation link that is valid for 72 hours. Until you confirm, we create no entry. When you confirm, we store with your address the time of confirmation, the version of the consent text and privacy notice you agreed to, and the language. This lets us prove your consent (Article 7(1) GDPR).

Purpose and legal basis. We use your address only to inform you about access to the Founder Beta. The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with effect for the future: through the unsubscribe link in our emails, through your email program's unsubscribe function or by writing to us. Withdrawing deletes your entry.

Service providers and retention. We store the address and send the emails with Resend (Plus Five Five, Inc., USA); the form's functions run on Vercel in Frankfurt. Your entry stays stored until you unsubscribe; when the waiting list ends, we delete it.

5. Contacting us by email

When you write to us, we use your message and your address to reply. The legal basis is Article 6(1)(b) GDPR where a contract is concerned, Article 6(1)(c) GDPR for requests about your data protection rights, and otherwise Article 6(1)(f) GDPR. Emails to support@undernap.com and datenschutz@undernap.com are received for our domain by IONOS SE (Germany) and forwarded unchanged to the provider's email account at Google (Gmail); IONOS does not store them. Your message and your address are stored and answered in that account. For the European Economic Area, Gmail is provided by Google Ireland Limited (Ireland); Google LLC (USA) may process the data (section 11). We send our replies from that account through Resend (section 10), with support@undernap.com or datenschutz@undernap.com as the sender.

We delete the correspondence once your request is dealt with. We keep it longer only where the law requires, for example business letters (up to 6 years), or as long as we need it to resolve a legal claim.

6. The Undernap account (account.undernap.com)

6.1 Registration and sign-in

For the account we process your email address and whether it is confirmed. You sign in with your email address and a password. Sign-in, email confirmation and password reset run through the sign-in service of our service provider Supabase; our account service does not store your password.

6.2 Session cookie

After you sign in, the account sets a session cookie. It is technically necessary, sent only over HTTPS, not accessible to scripts (HttpOnly) and limited to the account. A session ends after one hour at the latest or when you sign out. The cookie serves only to sign you in and keep your account secure (section 25(2) no. 2 TDDDG). The account sets no other cookies.

6.3 Workspace, members and seats

In the account we keep your workspace with its name, its members, their roles and seats. Depending on their role, members of a workspace see the names and email addresses of other members, their roles and seats, their devices with device name, platform, app version and last connection, and the latest activity in the workspace. Only the roles responsible for billing see invoices.

If you invite someone, the account creates a one-time invitation code. If you wish, we send the code by email to the address you enter. The code expires after 7 days at the latest.

6.4 Devices and licence

To connect a Mac, the app sends a signed request to our account service. It contains:

• a random installation ID that the app generates;
• the public part of a key that the app generates itself; it is not a hardware identifier;
• the device name, by default your Mac's computer name;
• platform, processor type and app version.

The app shows you a short code that you confirm in the account. The code is valid for ten minutes; we store it only as a checksum. The account service then issues a signed licence. The app refreshes it about once a day while you are online and sends its installation ID and app version with a signed proof. Without a connection, the licence works for up to 14 days.

We store this information with the time of connection and of the last refresh. This lets us enforce your plan's device limit, show you your devices and prevent licence misuse.

6.5 Order, payment and invoices

Payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland, with Stripe, LLC, USA). You enter full card or account details on Stripe's payment page; we do not receive them — Stripe processes them directly. For the invoice, Stripe also collects your billing address, the name of the person ordering and, if you enter it, the name of your business there (Article 6(1)(b) and (c) GDPR). Stripe keeps these details with your customer record and prints them on every invoice; our account service does not store them. We receive and store Stripe's identifiers and the status of your subscription, invoices, payments, refunds and chargebacks. Stripe processes part of the data on our behalf and part as a controller in its own right, for example for fraud prevention and to meet its own legal obligations, under its privacy policy (https://stripe.com/privacy).

Country, tax number and tax treatment. Before you pay, the account asks for the country of your billing address, where needed the state or province and, depending on the country, your business's tax or VAT identification number. We use these details to determine the tax treatment, to state it on the invoice and to decline orders from countries we may not or cannot supply (Article 6(1)(b) and (c) GDPR; sections 14 and 14a UStG). We pass the number to Stripe, which stores it with your customer record and prints it on the invoice. Our account service stores only the country, the region, the kind of number, a checksum of the number and the tax treatment, and — only if you give an EU VAT identification number — that and when you did so. If an EU VAT identification number has to be checked, we query the European Commission's VAT Information Exchange System (VIES) and store only the result, the time and the reference number of the query. These details are part of the billing records (section 12).

When you order, we store which version of the Terms and the Privacy Notice you confirmed and that you order as a business, with time, context and language, but without an IP address. After completion we send you a contract confirmation by email. We do not send advertising emails.

6.6 Log and support access

We keep a tamper-evident log of events in the account, for example sign-ins, role changes, connected devices and subscription changes, for accountability and security (Article 6(1)(f) GDPR).

Our support can view a workspace only through time-limited access with a stated reason, which the workspace sees in its account. The exception is a search that shows which workspace an email address or identifier belongs to, with its name and status. Every change made by support is logged. Support cannot see your projects or AI provider credentials, because the account does not receive them.

6.7 Help summary

On the account's help page you can create a summary for support. It is created in your browser and contains your workspace ID, the status of plan and payment and, only if you select them, device details and recent activity. We receive it only if you send it to us.

6.8 Legal bases in the account

If you are our contracting party yourself, we process the account data to perform the contract (Article 6(1)(b) GDPR). If you order or work for a business, for example as a member of a workspace, we base the processing on our legitimate interest and that of your business in providing the account (Article 6(1)(f) GDPR). We keep billing records because the law requires it (Article 6(1)(c) GDPR).

7. The app on your Mac

7.1 What stays on your Mac

The app stores its data in a folder in your macOS user library ("AI Orchestrator Owner Cockpit"; the name comes from the product's earlier development). This includes your projects and settings, Missions, Tasks and approved plans, Results with their evidence, project knowledge, the app's history and logs, backup and recovery copies, working copies of your projects (Git worktrees) and your licence. Your project folders stay where you keep them.

None of this is sent to us. The app has no usage analytics, no crash reporting and no telemetry. It talks to our servers only for the licence (section 6.4). It does not check for new versions by itself; you download and install new versions yourself.

7.2 Credentials

API keys you enter in the app are kept in your macOS Keychain; the app's files contain only a reference. If you connect an AI provider through its own command-line tool, the tool stores the sign-in, for additional accounts in the app's folder.

7.3 What you should know

• Deleting. The end of a subscription deletes nothing on your Mac. To remove local data, delete the app's data folder or use the uninstall command in the app package with the option to remove data. You have to remove separately: API keys in the Keychain, backups in the neighbouring "… Backups" folder, working-copy branches in your repositories and the histories of the AI providers' tools.
• No automatic clean-up. The app does not automatically delete its history, logs, backups or the content of analysed websites. It keeps the output of AI tools as the tools produced it.
• Backup and encryption. The app backs nothing up to a cloud and does not encrypt its files itself. Use your own backup and FileVault.
• Permissions. The app does not run in a macOS sandbox. AI providers' tools that it starts run with your user account's rights, can, depending on the tool, read files outside your project and access the internet, and some run commands without asking at every step.
• Local interface. The app has no password of its own. Its local interface accepts connections only from the same Mac, and only with a proof that the app creates anew at every start. Programs running under your macOS user account that can access your files can, however, read and change the app's data directly.

8. AI providers and other services you connect

Your accounts, your contract. Undernap does not provide an AI model of its own. It coordinates models and tools of AI providers that you connect with your own account or key, for example Anthropic (Claude Code), OpenAI (Codex), xAI (Grok), MiniMax, Moonshot AI (Kimi), OpenRouter and Perplexity for research. Further providers such as Alibaba Cloud (Qwen Code) and Z.ai can be connected but are not used for AI work.

What is sent. When a Mission you have approved runs, your Mac sends the provider the text of the Mission and its Tasks, context from your project (for example accepted earlier Results and project knowledge) and access to the files of your project; the provider's tool decides which files it reads. To review a Result, Undernap may use a second account or a second provider from the selection you allowed for the Mission. To show whether a connection is ready, the app sends short, fixed test requests; for OpenRouter it checks the remaining quota. If a research Result cites sources, the app fetches those public pages from your Mac.

Who is responsible. You decide which providers you connect and which a Mission may use. The data goes from your Mac directly to the provider, based on your contract with it. We do not receive it and cannot see it. Whether a provider stores your data, for how long, whether it uses it for training and where it processes it are governed by its terms; this can differ between personal and business plans. Check the settings with your provider.

Two settings. With OpenRouter, Undernap asks by default to use only providers that do not collect data; only if you expressly allow data collection for a connection does this not apply to that connection. For Perplexity research, Undernap asks Perplexity to store the research run, and Perplexity may keep and use search queries under its own terms.

Tool histories. The providers' command-line tools may create their own session records on your Mac. Undernap does not delete them.

Website analysis. If you have a website analysed, the app fetches its public pages from your Mac and stores the content locally. This can include names or contact details published on those pages.

We do not train AI models. We do not use your content to train models. This concerns only us; what an AI provider does with data it receives through your account is governed by its terms.

9. Support

When you ask for help, we process what you send us. There is no remote access to your Mac.

The app can create a support file on your Mac. We receive it only if you send it to us. It contains versions and update history, system type, number of processor cores and memory size, your installation ID, the status of licence and connections, IDs and status of your Missions, and the latest activity messages, which may contain the titles of your Tasks or projects. Values that look like credentials, email addresses or absolute file paths are removed. In Support Mode, which only you switch on and which ends by itself after the duration you choose, the file may contain additional diagnostic data; it is cleaned in the same way.

The legal basis is Article 6(1)(b) or (f) GDPR. Send us only the third-party personal data your request needs. We delete support material once your request is dealt with, unless a statutory retention obligation applies.

10. Recipients

We pass personal data only to these service providers, and only for the purposes stated:

We pass data to authorities only where the law requires it. AI providers and other services you connect are your providers, not our recipients (section 8).

11. Transfers outside the EU

Vercel, Supabase, Stripe, Resend and Google are companies based in the USA or with group links there; access from the USA is possible even where the data is stored in Frankfurt or Ireland. Transfers are based on the EU adequacy decision for the EU-US Data Privacy Framework where the recipient participates in it, and otherwise on the EU Standard Contractual Clauses in the service providers' data processing agreements.

The AI providers you connect may, depending on the provider, process data in the USA, Singapore or China. This happens on the basis of your contract with the respective provider.

12. How long we keep data

13. Security

Connections to our website, the account and the AI providers use HTTPS. The website uses a strict Content Security Policy and no third-party code. We store codes and session identifiers only as checksums. The app asks for your approval before sensitive steps and does not switch on paid extra usage with your providers by itself. No system is free of risk; we describe what we do, and this is not a guarantee.

14. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21). You can withdraw consent at any time with effect for the future (Article 7(3)).

Write to datenschutz@undernap.com. We answer your request without undue delay and at the latest within one month. Only where necessary because of the complexity or number of requests may this period be extended by at most two further months; we tell you so within the first month, with the reasons (Article 12(3) GDPR). We may ask you to confirm your identity. The account itself does not yet offer deletion; we carry it out when you write to us, with a procedure made for it. Data we must keep, for example invoices (section 12), we delete only when that obligation ends and until then use only for it (Article 17(3)(b) GDPR). You control the data on your Mac yourself (section 7.3).

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden, Germany, https://datenschutz.hessen.de.

15. Automated decisions

We make no decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Article 22 GDPR). Whether you have access to paid features depends on the status of your subscription and your payments, as the contract provides. You can contact us about this at any time.

16. Changes

We update this notice when our processing changes. The current version is on undernap.com with its version label. If a change significantly affects you, for example a new purpose, we inform you in advance by email or in the account where we can reach you.