App privacy

This Privacy Policy explains how UnPack handles personal information.

UnPack is operated by Unravel Consulting. The legal entity responsible for the Service is Antesto (Pty) Ltd, registration number 2014/042585/07 (“UnPack”, “we”, “us” or “our”).

Contact: [email protected]

Our privacy approach is simple:

Evidence content processed in the UnPack application is designed to stay on your device and be processed locally in your browser. We do not intentionally upload your imported evidence to UnPack.

1. Scope

This Privacy Policy applies to the evidence workspace at https://app.unpack.legal and its payment workflow. It is published here on the canonical public website, https://www.unpack.legal. The public marketing website is covered separately by our Website Privacy Policy.

It does not govern the privacy practices of third parties, including external websites or payment providers that may have their own privacy policies.

2. Evidence processed in the application

When you import evidence into UnPack, this may include:

• WhatsApp TXT exports;
• ZIP exports;
• message content;
• names and participant labels;
• telephone numbers;
• dates and times;
• images, videos, audio and other attachments;
• case or matter names and numbers;
• exhibit or annexure labels;
• locally calculated file hashes; and
• previously generated UnPack evidence packages that you choose to re-import.

How this evidence is handled

The UnPack application is designed to process this material locally in your browser.

We do not intentionally transmit imported evidence content to our servers or to a remote evidence-processing service.

In particular, the application is designed so that the following are not sent to UnPack as part of evidence processing:

• message content;
• imported media;
• participant names;
• case or matter metadata;
• source filenames; and
• evidence-file hashes.

Generation of rendered output, evidence packages, local media previews and hashes is intended to occur on your device.

3. Re-importing an UnPack evidence package

UnPack may allow you to re-import an evidence package that was previously generated by the Service.

When you do this, the package is intended to be opened and processed locally in your browser in the same way as a native source export.

Re-importing a package does not, by itself, upload the package to UnPack.

You remain responsible for storing and securing downloaded packages on your own device or storage systems.

4. Information we may receive when you visit the Service

Even where evidence processing is local, your browser must connect to internet infrastructure to load the UnPack application.

Our hosting, networking or security providers may therefore process ordinary technical request information such as:

• IP address;
• browser or user-agent information;
• requested page or asset;
• date and time of a request;
• basic network and security information; and
• information needed to detect abuse or maintain availability.

This ordinary connection data is separate from the evidence content you import into the application.

UnPack does not currently use advertising trackers, session-replay tools or behavioural analytics within the evidence application.

5. Browser-local processing and storage

The Service uses normal browser capabilities to operate, which may include browser memory, temporary object URLs, cryptographic functions, file APIs and download APIs.

Working data may exist temporarily on your device while the application is open.

UnPack is not a cloud storage service. Unless a feature expressly says otherwise, you should assume that unsaved working state may be lost when you close the application, clear browser data or change device.

Where the Service provides an evidence-package export, you may save that package yourself and later re-import it.

6. Support communications

If you contact us at [email protected], we will receive the information that you choose to include in your email.

This may include your:

• name;
• email address;
• organisation;
• support request; and
• any files or information you voluntarily attach.

Because support email is outside the application’s local-only evidence workflow, please do not email confidential or privileged evidence unless it is genuinely necessary and you are comfortable doing so.

We may retain support correspondence for as long as reasonably necessary to respond, maintain records, resolve disputes, prevent abuse or meet legal obligations.

7. Payments

The application uses Lemon Squeezy for export checkout. Print / Save as PDF and Save Evidence Package require export access; importing and reviewing evidence remain free.

When you open the locked export dialog, the app prepares a price preview and sends an empty checkout request to a payment endpoint. The endpoint creates a random payment reference and a signed session token. Payment checks send only that token. No evidence content, filenames, participant names, matter details, media or evidence hashes are included.

Lemon Squeezy hosts checkout in a separate tab and processes the checkout information you enter. For sandbox testing, use fictional checkout details. Our payment endpoint receives signed payment notifications and checks payment status with Lemon Squeezy. It retains only a random reference and order ID in temporary payment storage for up to 24 hours; it does not retain the notification’s customer details.

The checkout token stays in browser memory. After confirmation, a signed payment receipt containing only payment identifiers can be included in an evidence package you download. When you re-import the package or export again, only the receipt is sent for payment verification; source content and evidence hashes are not sent. The payment endpoint checks the order with Lemon Squeezy without requiring the temporary checkout record.

The receipt remains in your downloaded package until you delete it and travels with copies you share. It does not expire with the 24-hour checkout session, but access depends on the payment remaining valid. Closing or refreshing the tab loses unsaved work; a saved package restores its source, settings and receipt. Importing a new native source clears payment access. No payment scripts or analytics are loaded into the evidence application.

Before real paid functionality is launched, this policy and the payment terms will be reviewed for the final implementation.

8. Cookies and analytics

UnPack does not currently use advertising cookies or behavioural analytics within the evidence application.

Essential technical mechanisms may be used where required for security, routing or operation of the Service.

If analytics or similar technology is introduced later, this policy will be updated before or when that functionality is deployed.

The marketing website has a separate Website Privacy Policy. Marketing analytics, if introduced, will be disclosed there and will not change the local evidence-processing model of the application.

9. Why we process personal information that we actually receive

Where Antesto (Pty) Ltd does receive personal information, such as support correspondence or routine technical request data, we process it only where reasonably necessary for purposes such as:

• operating and securing the Service;
• responding to support requests;
• preventing misuse or abuse;
• complying with legal obligations;
• maintaining appropriate business records; and
• establishing, exercising or defending legal rights.

We aim to process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and other applicable South African law.

10. Sharing of personal information

We do not sell personal information.

We may share personal information that we actually receive with service providers only where reasonably necessary to operate the Service, for example hosting, infrastructure, security, email or future payment providers.

Those providers may process ordinary service data on our behalf or under their own applicable terms.

We may also disclose information where required by law, lawful process, court order or where reasonably necessary to protect legal rights or the security of the Service.

Because imported evidence is designed to remain local, there should ordinarily be no evidence content for UnPack to disclose from its servers.

11. International processing

Some infrastructure or service providers may process ordinary technical or business information outside South Africa.

Where applicable, we will take reasonable steps required by law in relation to cross-border processing.

The local processing of imported evidence is intended to minimise the amount of evidence information that needs to leave your device at all.

12. Security

We use reasonable technical and organisational measures appropriate to the information we actually receive and control.

However, no website, browser, device or network is completely secure.

Your own device security is important because evidence is processed locally. You are responsible for securing:

• your computer or mobile device;
• your browser profile;
• downloaded source and evidence-package files;
• local backups; and
• any files you later share with third parties.

For more detail, see Security & Data Handling.

13. Retention

Because imported evidence is intended to remain in your browser, UnPack does not ordinarily retain that evidence on its servers.

For information we actually receive, such as support correspondence or ordinary technical logs, we aim to retain it only for as long as reasonably necessary for the purpose for which it was collected, legitimate operational needs or applicable legal requirements.

14. Your rights

Subject to applicable law, including POPIA, you may have rights concerning personal information that we hold about you, including rights to:

• ask whether we hold personal information about you;
• request access to personal information we hold;
• request correction or deletion where legally appropriate;
• object to certain processing; and
• lodge a complaint with the South African Information Regulator.

To make a privacy request, contact [email protected].

Information about the South African Information Regulator is available at:
https://inforegulator.org.za/

15. Third-party material in your evidence

A WhatsApp export may contain personal information about other people.

The fact that UnPack processes that material locally does not remove your own responsibilities under privacy, confidentiality, professional, evidentiary or other applicable laws.

You are responsible for deciding whether and how to disclose, file, serve or share material relating to other people.

Features such as telephone-number masking are provided as presentation tools only and may not remove all personal or sensitive information from an export.

16. Changes to this policy

We may update this Privacy Policy as the Service changes.

The current version will show its “Last updated” date. If we introduce material changes such as paid processing, analytics, accounts or cloud storage, this policy must be reviewed and updated to reflect the actual implementation.

17. Contact

Privacy questions can be sent to:

UnPack / Unravel Consulting
Legal entity: Antesto (Pty) Ltd
Registration no.: 2014/042585/07
Email: [email protected]

See Legal & company information for operator details and the public legal documents.