Privacy Policy

1. Introduction

This Privacy Policy explains how Unitblack Labs, operating under the trading name save office ("we," "us," or "our"), collects, uses, discloses, and protects your personal information when you visit saveoffice.io or use our virtual office and business address services.

By using our website or services, you agree to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

2.1 Information You Provide

When you fill out forms on our website (contact, onboarding, pre-registration, talk-to-sales, or chatbot email forms), we collect:

• Full name
• Email address
• Phone number
• Company name and entity type (if applicable)
• Mailing or business address
• Preferred location and service preferences
• Any message or additional information you provide

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain technical information:

• IP address
• Browser type and version
• Operating system and device type
• Pages visited, referring URL, and time of visit
• Approximate geographic location (country and city, derived from IP)

2.3 Chatbot Data

When you interact with our AI-powered chatbot, we collect your conversation messages, session data (IP address, device info, approximate location), and any contact information you voluntarily provide during the conversation. The chatbot is powered by Anthropic's Claude API. Chat sessions are retained for up to 30 days and are used to improve our customer support.

2.4 Payment Information

When you subscribe to a plan, your card details are entered directly into Stripe's secure iframe and processed by Soho Workspaces, INC. (dba The Farm) as the merchant of record. We do not store, log, or have access to your raw card number, expiration, or CVC. We retain only a tokenized customer reference, the last four digits of the card, billing zip code, and subscription metadata.

2.5 Address Verification Data

Our address checker tool sends the address you enter to Smarty(a USPS-licensed verification service) and returns a high-level result (deliverable, residential or commercial classification, etc.). In accordance with Smarty's terms of service, we do not store the raw API response or cache verification results beyond what is required to display them to you in the same session.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our website and services
• Respond to your inquiries and provide customer support
• Process your service registrations, applications, and subscription payments through our partners
• Send you service-related communications (account updates, invoices, mail notifications)
• Send marketing communications you have opted in to receive
• Analyze website usage to improve our services
• Detect, prevent, and address technical issues, fraud, or abuse
• Comply with legal obligations

We do not sell or share your personal information for cross-context behavioral advertising purposes.

4. Cookies and Tracking Technologies

We use the following categories of cookies and similar tracking technologies:

• Strictly Necessary— required for core site functionality (session, security, CSRF protection).
• Functional— remember your preferences (language, dismissed banners, form drafts).
• Analytics— help us understand how visitors interact with our site. We currently use Google Analytics 4 and Microsoft Clarity (session recordings and heatmaps).
• Marketing— we do not currently run advertising pixels. If we add any (such as Meta or Google Ads), we will update this policy and obtain consent where required.

We also embed Google Mapson our location pages, which may set its own cookies under Google's policy. You can manage cookie preferences through your browser settings. Disabling cookies may affect certain website functionality.

5. Data Sharing and Service Providers

5.1 Service Providers (Sub-processors)

We share personal information with the following trusted third parties so we can operate our services. Each is bound by a data processing or confidentiality agreement and processes data only on our instructions or as required by law:

• Vercel— website hosting and edge delivery
• Stripe— payment processing (service provider; Stripe does not sell or share your data)
• Soho Workspaces, INC. (dba The Farm) — mail handling, office operations, and merchant of record for subscription billing at our seven city locations
• Google Workspace— form submissions, spreadsheets, and email
• Smarty— USPS address verification for our address checker tool
• Anthropic— Claude API for our customer-support chatbot
• Google Analytics 4 and Microsoft Clarity— website analytics

5.2 Legal Disclosures

We may disclose information when we believe in good faith that disclosure is required by law, regulation, legal process, or government request, or to protect the rights, property, or safety of our users, the public, or ourselves.

5.3 Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

5.4 With Your Consent

We may share information with third parties when you have given us explicit permission to do so.

6. International Data Processing

Your information may be processed and stored in countries other than the country in which you reside, including in the United States. The service providers listed in §5.1 operate in multiple jurisdictions. We rely on contractual safeguards (such as standard contractual clauses, where applicable) and the security measures described in §8 to protect data transferred across jurisdictions.

7. Data Retention

• Form submissions (contact, registration, sales inquiries) are retained as long as necessary to provide our services and respond to your request.
• Active subscription records are retained for the duration of your subscription and for up to seven (7) years after cancellation to comply with tax, accounting, and audit requirements.
• Chatbot sessions are automatically deleted after 30 days.
• Address checker queries are not cached beyond the active session.
• Analytics datais retained according to the respective service provider's retention policies (Google Analytics: 14 months by default; Microsoft Clarity: 13 months).

We may retain certain data longer when required by law or to protect our legal interests.

8. Data Security

We implement industry-standard security measures to protect your personal information, including HTTPS encryption for all data transmission, secure server infrastructure, role-based access controls, and a strict Content Security Policy. Payment card data is handled exclusively by Stripe, which is certified to PCI DSS Level 1, the highest level of payment-card security. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

9.1 California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) share about you
• Request deletion of your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information for cross-context behavioral advertising — we do not sell or share your data
• Limit the use and disclosure of sensitive personal information
• Not be discriminated or retaliated against for exercising your rights

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request from cross-context behavioral advertising.

9.2 EU/EEA and UK Residents (GDPR / UK GDPR)

If you are located in the EU, EEA, or UK, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Restrict processing
• Object to processing, including direct marketing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with your local supervisory authority

9.3 Other US State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain processing. Where these laws apply, we will honor your request as required.

9.4 How to Exercise Your Rights

Email us at hello@saveoffice.io with the request and any information needed to verify your identity. We will respond within the timeframes required by applicable law (generally 45 days for CCPA and 30 days for GDPR). You may designate an authorized agent to act on your behalf, subject to identity verification.

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/EEA). If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

11. Third-Party Links

Our website may contain links to third-party websites or services (e.g., Calendly for scheduling, LinkedIn, Instagram, TikTok, YouTube, and partner sites). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by a prominent notice on our website at least 30 days before they take effect, and (where appropriate) by email to active subscribers. The "Effective Date" and "Last Updated" fields at the top of this page indicate when the most recent version was published.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us: