Privacy Policy

The short version

We run our own analytics on our own servers. It sets no cookies and stores nothing in your browser, and we run no advertising or cross-site tracking, so there is still no cookie banner here.

The Unicorn Panel software is self-hosted. Your websites, databases, mailboxes, DNS zones, customer records, and traffic stay on your own servers and are never transmitted to us.

What we do hold is small and deliberate: messages you send us by form, email, or live chat, the email address you buy a license with, a count of the servers and accounts your license covers, and the email address you give us if you opt in to the newsletter. Payment details go to Stripe and never reach our servers.

Who we are

This website and the Unicorn Panel software are operated by Unicorn Labs LLC, 4925 S Broadway Ave, Unit #6070, Wichita, KS 67216, United States. For privacy purposes we are the data controller.

To ask about this policy or exercise any of the rights below, email privacy@unicornpanel.com, write to us at the postal address above, or use the contact form.

This website

The site is static. It sets no cookies at all, and embeds no advertising pixels, social widgets, or ad scripts. The one measurement script we run is our own, described below.

Server logs

Our web server records each request in an access log: your IP address, the page requested, the time, the referring page, and your browser’s user-agent string. We use these logs to keep the site available, diagnose faults, and investigate abuse. Logs are kept for about 30 days and then rotated away. The lawful basis is our legitimate interest in operating a secure, working website.

Storage in your browser

The site stores a small number of values in your own browser. They are never transmitted to us, and are not used to identify or track you:

• upcp-theme: your light or dark choice, so the site looks the same next visit. Local storage, kept until you clear your browser.
• upcp-billing-bearer, upcp-billing-exp, upcp-billing-email: your sign-in token for the account area. Session storage, cleared when you close the tab, and valid for four hours at most.
• upcp-nl: that you closed the newsletter invitation, or subscribed, so we stop showing it to you. Local storage, kept until you clear your browser.

These are strictly necessary or set at your own request, so no consent banner is required for them.

Live chat

The chat button in the corner of the page stores a little more, and only once you use it. Before you start a chat it keeps a single value, chat:status, recording whether anyone is available to answer, so that every page you open does not have to ask again. That one is session storage and goes when you close the tab.

If you do start a chat, the widget keeps the following in local storage on your device until you clear your browser:

• chat:name, chat:email: the name and email address you typed into the chat form, so you are not asked for them again. Unlike the values above, these are personal data, and nothing removes them from your device except you.
• chat:token, chat:cid: the key and the reference number for your conversation. They are what lets you close the tab and come back to the same thread, and they are sent to our chat server with each message. chat:cid is dropped when the conversation ends; chat:token stays until you clear your browser.
• chat:open: whether you left the chat panel open or closed.
• chat:muted: whether you switched the notification sound off.
• chat:nosse: the time we last found that your network blocks live updates, so we wait six hours before trying that route again rather than retrying on every page.

These are set only because you chose to start a chat, so they need no consent banner either. Clearing site data for this domain in your browser removes every one of them.

Analytics

We measure how the site is used with Peekie, our own analytics software, running on our own server at peekie.unicornpanel.com. Nothing about your visit is sent to an analytics company, an advertising network, or any other third party.

Peekie stores nothing on your device: it sets no cookies and writes nothing to your browser’s storage. The few values listed above are set by the site at your own request, never by the analytics, which is why this site still has no cookie banner: there is nothing on your machine to consent to.

To tell one visit from another, and a returning reader from a first-time one, our server works out an identifier for you rather than saving anything on your device. It is a one-way hash of your IP address and your browser’s user-agent string, combined with a secret key that only our server holds. It is not your name and it is not an account, and we cannot contact you with it, but it can recognize you across visits, so under the GDPR it counts as pseudonymous personal data. We treat it as personal data, and the rights set out below apply to it.

It is not durable. Because it is built from your address and your browser version, it changes whenever either of those changes: a browser update, a new IP from your provider, switching between wifi and mobile data. For most people it lasts weeks rather than months, and we cannot reverse it to recover your address.

For each page view it records the page address, the page you arrived from, your screen size, how long you were engaged with the page, how far you scrolled, and page-speed measurements. It also records when a link out to another site or a file download is clicked, and a small number of named events such as a 404 being served, so we can find broken links.

The lawful basis is our legitimate interest in understanding which pages are useful and where the site is broken. We have weighed that against your privacy: it is not used to build a profile of you, it is never combined with your customer record, and it never leaves our servers. You can object at any time by writing to us, and a tracker blocker or your browser’s Do Not Track setting will stop it outright. Nothing on the site depends on it.

One third-party request

The footer shows a live service-status badge. The script for it is fetched from the jsDelivr CDN and the status itself comes from Better Stack, so those providers receive your IP address and user-agent as part of serving the request. They do not receive anything else about you from us.

When you contact us

The contact form asks for your name, email address, an optional company or fleet size, the topic of your message, and the message itself. We use these to answer you, and for nothing else. The lawful basis is our legitimate interest in responding to enquiries, or the steps leading to a contract where you are asking about buying.

To keep the form from being abused, the submission we receive also records your IP address, your user-agent string, and how long the page was open before you pressed send. Your IP is additionally written to a short-lived rate-limit file on the server, which is discarded within five minutes.

The live chat asks for your name and email address, and optionally what you need help with, before it puts you through to someone. We use them to answer you and to recognize you if you come back to the same conversation. The chat runs on our own software on our own server at chatie.unicornpanel.com, so nothing you type passes through a third-party chat provider. If you ask for a transcript when the chat ends, we email it to the address you gave.

Writing to our support address reaches the same place. Support email is handled in FreeScout, an open-source helpdesk we run ourselves on our own servers in the United States, so your message and our replies stay on infrastructure we control rather than a third-party support platform.

Messages are delivered through our own mail server, which we operate on infrastructure in Texas, United States. We keep enquiry correspondence for 12 months after a conversation ends, then delete it.

When you buy a license

Checkout is handled by Stripe. We ask for your email address before sending you there, so that your purchase attaches to the right customer record; everything else is collected by Stripe on their own systems, including your card number, billing address, and tax details. We never see or store your card details.

Stripe acts as our payment processor and as a data controller in its own right for fraud prevention and regulatory purposes. See the Stripe Privacy Policy for what they do with it.

We keep a record of your license for 12 months after it ends, so we can answer billing questions and meet our accounting obligations. That record covers the email it is registered to, what it includes, and its billing history.

Your account area

Signing in to manage a license uses a one-time link sent to your email address. The link is valid for 15 minutes and works once. It gives your browser a token that lasts four hours and is stored only for the life of the browser tab.

The license, usage, and invoice details shown there are read live from Stripe when you open the page. We do not build a separate profile of you from them.

What the panel software sends us

Unicorn Panel runs on your servers. It sends us two things, and nothing else.

• A billing signal. When you add or remove a server or an account, with a daily catch-up in case an event was missed, the panel reports the current number of servers, the current number of accounts, the time, and a random installation identifier it generated on first boot. That is what makes your invoice adjust automatically.
• A license check. When you save a license key, upgrade the panel, or install or update a server role, the panel confirms the license is active. It is not checked on every request, and if we are unreachable the panel keeps working on the paid plan for up to 30 days.

These records are kept for 12 months. Nothing about your websites, domains, database contents, mailboxes, customers, traffic, or resource usage is ever sent to us, and no usage telemetry is collected.

Newsletter and product updates

You can subscribe to our newsletter for product and release news. It is double opt-in: after you enter your email address we email you to confirm, and nothing is sent until you click that link. If you never confirm, the address is not added.

Signing up asks for your email address. A first and last name are optional, and if you give them we use them only to address the mail to you. We also record the timezone your browser reports and the IP address the signup came from, so we can send at a sensible hour and deal with abuse.

The list runs on our own newsletter system at sendie.unicornpanel.com, hosted on our servers in the United States. We do not pass subscriber email addresses to an advertising network or a third-party marketing platform.

The lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in any newsletter or by writing to us. We keep your email address, and any name you gave, until you unsubscribe or ask us to delete it. Buying a license does not add you to the list: the checkbox at checkout is the only way in from there, and it is off by default.

The community forum

The forum at discussions.unicornpanel.com runs on our own servers. Registering creates an account there with the details you choose to provide, and the forum sets a first-party session cookie so you stay signed in. Anything you post is public. Ask us if you want your forum account removed.

Who else handles your data

We keep the list short on purpose. Besides Stripe, our own mail server, and the status badge described above:

• This website is hosted on infrastructure in Utah, United States.
• Our mail and update services run on infrastructure in Texas, United States.
• Our helpdesk (FreeScout), newsletter system, and community forum are self-hosted on our own servers in the United States. No third-party support, marketing, or forum provider is involved.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We may disclose information where the law requires it, or to establish or defend legal claims.

International transfers

We are a United States company and our systems are in the United States. If you are in the United Kingdom, the European Economic Area, or Switzerland, using this site or buying a license means your information is transferred to the United States. Where that transfer needs a safeguard, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with the measures described under Security below. Ask us if you would like details of the safeguards for a particular transfer.

How long we keep things

• Web server access logs: about 30 days.
• Analytics: 12 months.
• Contact-form rate-limiting records: under five minutes.
• Enquiry and helpdesk correspondence: 12 months after the conversation ends.
• Live chat transcripts: 12 months after the conversation ends.
• Newsletter subscriptions: until you unsubscribe or ask us to delete the address.
• License, billing, and panel check-in records: 12 months, longer only where tax or accounting law requires it.
• Payment records: held by Stripe under their own retention rules.

Your rights

If you are in the UK or the EEA, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds not to. You can also complain to your data protection authority, which in the UK is the Information Commissioner’s Office.

If you are a California resident, you have the right to know what personal information we collect and why, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.

Wherever you are, you can ask us the same questions and we will answer them. Email privacy@unicornpanel.com, write to the postal address above, or use the contact form. We will respond within one month, and will ask you to confirm your identity first where the request concerns an account or license.

Security

The site and our services are served over HTTPS. Access to the systems holding license and enquiry data is restricted to the people who need it. Payment data never touches our infrastructure. No system is perfectly secure, but we design for the smallest useful amount of data: most of what a hosting control panel knows never leaves your own servers in the first place.

Children

Unicorn Panel is a product for businesses and system administrators. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

If this policy changes, the revised version will appear on this page with a new date at the top. Where a change materially affects how we use your information, we will say so clearly rather than quietly editing the text.