Privacy Policy

Unique Business Basic ("UBB", "we", "us") provides the hosted Business Basic runtime described on this site, from 123 US Highway 46, Fairfield, New Jersey 07004.

We build a Business Basic runtime and operate a managed cloud that executes our customers' existing programs against their existing data files. We also run a free compatibility report for prospective customers.

This policy covers uniquebb.com, the account portal, the compatibility report, and the managed service. Write to hello@uniquebb.com with any privacy question; a person answers, and we commit to a substantive reply within 30 days.

The practical consequence: if your customer asks what happened to their record, that is your data and your answer to give. We will support you, but we will not take instructions about the contents of your files from anyone other than you.

The second practical consequence: nothing in this policy gives us permission to look inside your files for our own purposes. Our access to customer content is limited by the Terms and by the controls described on the Security page — not by this policy's marketing-style language, because there isn't any.

Account and contact details. Name, business email address, telephone number, company name, job title, and the postal address of the business. Collected when you sign up, request a report, or contact us.

Credentials. A password, stored only as a salted one-way hash, and multi-factor authentication settings. We cannot read your password.

Billing details. Billing contact, billing address, tax identifiers, invoice history, and — from our payment processor — the card brand, the last four digits and the expiry month. We never receive or store your full card number. See section 8.

Support correspondence. Emails, tickets, call notes and anything you attach to them. Please do not paste production data into a support email; if it helps us, we will ask you to put it somewhere controlled instead.

Server and application logs. IP address, timestamp, request path, response code, referrer, user agent, and for authenticated sessions the account identifier. These exist to keep the service up and to investigate abuse and security events. They are not analytics.

Uploaded program archives. When you request a compatibility report you upload an archive of programs only — no data files. That archive is Customer Content and is handled under section 4, even though at that point you are a prospect rather than a customer. We delete it within 90 days.

We do not collect special categories of personal data (health, biometrics, race, religion, political opinion, sexual orientation) about you, and we do not want any. We do not build profiles, and we do not make automated decisions that produce legal effects.

To run your ERP we necessarily hold two things: your source programs — decades of proprietary business logic — and your production data files. Those files may contain personal data about your customers, employees and suppliers.

For that content, you are the controller and we are your processor. We process it only:

• on your documented instructions, including the instruction implicit in subscribing to the Service;
• to host, execute, migrate, back up, restore and support your Environment;
• to investigate a fault or security incident affecting you;
• where we are compelled by law, in which case we will notify you first unless legally prohibited.

We do not determine the purposes of that processing, we do not enrich it, we do not index it for our own search, and we do not derive products from it. Who on our side can see it, and in what circumstances, is set out in detail on the Security page — that section is written to be audited, not skimmed.

Our staff are bound by written confidentiality obligations that survive their employment. Access to production is limited to a named group, is individually logged, and the log is available to you on request.

Data processing addendum. We will sign a DPA covering this content, including the standard contractual clauses where your transfers require them. Ask at hello@uniquebb.com and we will send one; we do not charge for it and we do not make it hard.

If a data subject contacts us directly about content inside your files, we will not answer them on the substance. We will tell them to contact you, and tell you that they got in touch, within 5 business days.

Where a data protection law that requires a lawful basis applies to you — the GDPR, the UK GDPR, and similar regimes — these are ours:

Where we rely on legitimate interests, we have considered your rights and concluded that the processing is limited, expected, and not overriding. You may object at any time under section 13, and we will stop unless we have compelling grounds that we can explain to you in writing.

Under United States state privacy statutes, we do not "sell" or "share" personal information as those terms are defined, and we do not process it for cross-context behavioural advertising. There is nothing to opt out of, because we never started.

We set two cookies. That is the complete list — not the "essential" subset of a longer one.

Both are first-party, both are marked Secure and HttpOnly, and both are strictly necessary to deliver a service you asked for. There are no analytics cookies, no advertising cookies, no third-party cookies and no local-storage trackers.

Because we set nothing that requires consent, we do not show a cookie banner. We consider the absence of the banner to be a feature and evidence of the claim, not an oversight.

You can block or delete these cookies in your browser. Blocking ubb_auth will prevent you from staying signed in.

Card payments are handled by a third-party payment processor that is certified to the highest level of the PCI Data Security Standard. Card details are entered into fields hosted by that processor and go to them directly.

We never receive, transmit or store full card numbers, magnetic stripe data, or security codes. Our systems are not a cardholder data environment. What we hold is the card brand, the last four digits, the expiry month and a token that lets us charge the card for your subscription.

The processor acts as an independent controller for fraud prevention and its own regulatory obligations, and as our processor for taking the payment. Its own privacy notice governs what it does in the first role.

For invoiced customers paying by cheque or transfer we hold only the remittance details you send us, in our accounting records.

We keep the list short on purpose. Every additional vendor is another place your data can go wrong, and we are not interested in a long integration stack.

We name each vendor in the current subprocessor list, which we will send on request to hello@uniquebb.com and which is an annex to our DPA. We list them by function here so this page does not go stale between vendor changes.

Before we add any subprocessor that will process customer content, we give subscribed customers 30 days' written notice. If you have a reasonable, security-based objection, tell us; if we cannot resolve it, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

Each subprocessor is under a written contract that imposes obligations no weaker than ours. We remain responsible to you for what they do.

All customer content and all personal data are stored in the United States. Environments, backups, logs and support records are all held in United States regions of our infrastructure provider.

We do not replicate customer content outside the United States. If you require a specific region or a data-residency commitment elsewhere, ask before you sign; we will tell you honestly whether we can do it.

Our staff work from the United States. Remote administrative access to production happens over an authenticated, encrypted path with session logging, never from personal devices holding local copies.

You may ask us to delete earlier than any of these periods, and we will, except where a legal obligation requires us to keep a record. In that case we will tell you which record and which obligation.

Our technical and organisational measures are set out in full on the Security page: encryption in transit and at rest, tenant isolation, least-privilege access, backups, disaster recovery, patching, secure development, and incident response.

That page also says plainly what we have not yet achieved. We would rather you evaluated us on facts than on a badge, and we hold ourselves to it here too.

Breach notification. If a security incident affects your personal data or your customer content, we will notify you within 72 hours of confirming it, with what we know, what we are doing, and what we recommend — followed by a written post-incident report within 10 business days.

No system is perfectly secure. What we commit to is that we will not be quiet about it if something goes wrong.

Whatever jurisdiction you are in, we extend the same rights over the personal data we hold about you:

• Access — a copy of the personal data we hold about you and an explanation of what we do with it.
• Correction — fix anything inaccurate or incomplete.
• Deletion — erase it, subject only to records we must keep by law.
• Export — receive it in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Objection and restriction — object to processing based on legitimate interests, or ask us to pause processing while a dispute is resolved.
• Withdraw consent — where we relied on consent, withdraw it at any time, without affecting what was lawful beforehand.
• Non-discrimination — exercising any of these rights never affects your pricing or your service.

Email hello@uniquebb.com. We will respond substantively within 30 days. If a request is genuinely complex we may take one further 30-day extension, and we will tell you why before the first 30 days are up. We do not charge for these requests.

We will verify your identity in proportion to the sensitivity of the request — usually by confirming from the email address on the account. You may use an authorised agent; we will ask for evidence of the authorisation.

Requests about customer content — the personal data inside your files — go to the customer who controls those files, not to us. If you contact us about content in a customer's system, we will pass your request to them and tell you we have done so.

If you are unhappy with our answer, tell us and we will escalate it internally. You may also complain to your local supervisory authority or state attorney general; we would prefer the chance to fix it first.

The Service is sold to businesses for business use. It is not directed to children, is not marketed to them, and has no consumer-facing features.

We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it promptly. If you believe a minor has given us personal data, write to hello@uniquebb.com and we will deal with it.

Customer data files may contain records about individuals of any age, because a distributor's records can. We process those as a processor under section 4 and never for our own purposes.

We are a United States company and we store data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, using the Service involves a transfer of personal data to the United States.

For those transfers we rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum where applicable, together with supplementary technical measures — encryption in transit and at rest, strict access control, and a commitment to challenge overbroad government requests and to notify you where the law permits.

Those clauses come as part of our DPA. Request it at hello@uniquebb.com.

We have not received a government demand for customer content. If that ever changes, and we are permitted to say so, we will say so.

When we change this policy we update the effective date and version at the top and keep the previous version available on request.

For material changes — a new category of data, a new purpose, a new subprocessor touching customer content, or anything narrowing your rights — we email the administrative contact on each account at least 30 days before the change takes effect.

Changes never apply retroactively to data already collected under a previous version in a way that would breach the basis on which it was collected.