Last updated: [date of publication]
This policy explains what personal data Sundesk handles and why. For the personal data of your customers that you put into Sundesk, you are the controller and we are your processor; see the Data Processing Addendum. For your own account data we are the controller.
| What | Why | Basis |
|---|---|---|
| Name, email, password (stored only as a salted hash), second-factor secret | Create and secure your account | Contract |
| Organization name, plan, seats, invoices reference | Run and bill your subscription | Contract, legal obligation |
| Sign-in records: time, IP address, browser | Security, abuse prevention, rate limiting | Legitimate interest |
| Support conversations with us | Help you | Contract |
Tickets, messages, attachments, names and email addresses of the people who write to you. We use them only to provide Sundesk to you. We do not sell them, use them to advertise, or use them to train AI models. Translation and AI features run only when you or your agents use them; when a feature uses a third-party AI provider, the text of the single item is sent for that request only (see subprocessors).
Payments are handled by Paddle as merchant of record. We receive the plan, seat count, status and a customer reference, never your card number.
We use only strictly necessary cookies to keep you signed in and to protect forms. We do not use advertising or analytics cookies. [Update this section if that changes.]
We share data only with the subprocessors that run the service, when the law requires it, or in a sale of the business with the same protections.
Data is stored in [region] by our database provider. Where data moves between countries we rely on appropriate safeguards such as Standard Contractual Clauses. [Counsel to confirm.]
Account data is kept while the account is open and deleted within [30] days after closure. Security logs are kept for [90] days. Invoices are kept as long as tax law requires.
Depending on where you live (for example the EU, UK, or California) you can ask to access, correct, delete, export or restrict your data, and to object to some uses. Email the address below. If you are a customer of one of our customers, ask them first: they decide what to do with your data and we will help them.
Passwords are hashed; connections are encrypted; each organization's data is separated at the database level; access to production is limited and logged. No system is perfectly secure; we will notify affected customers of a breach as the law requires.
Sundesk is for businesses and is not directed to children.
[Legal entity name, postal address, privacy contact email]. [Add a representative in the EU/UK if required.]