Sunsama
Review these first
Source provenance
Verified official sourceSnapshot hash f215aa2cbd4ab9a2a873157feabb83bf0eeb30b7ab5d61fafdbf9407b6d6a68f
Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
Sunsama commits to not selling user data and limits information collection to what is necessary, including a specific rejection of biometric data collection and profile picture analysis. While personal tasks, content, and usage patterns are used for AI features, the policy explicitly states that this data is *never* used to train AI models, either their own or third-party models. When AI services are used, third-party providers are contractually bound not to use user data for model training. Users are also given the right to human review and to contest automated AI decisions that significantly affect them. The company also states that data associated with inactive accounts may be deleted after notice is provided, and data may remain in backup systems for up to 90 days after account deletion.
90% confidence
Critical issues that may create immediate or severe risk for users.
Not clearly stated
No cited risk flags — wording is unclearReview how the company collects, uses, and shares your personal information.
Not clearly stated
No cited data-use findings — wording is unclearReview issues related to account cancellation, automatic renewals, and data retention post-cancellation.
If you don't use Sunsama for an extended period, the company may delete your account and associated data after providing reasonable notice.
Why it matters: Your account and data may be deleted by the company if you do not use the service for a long time, but you will receive notice.
If you don't use Sunsama for an extended period, we may delete your account and associated data after providing reasonable notice.
Even after account deletion, information may persist in backup systems for up to 90 days.
Why it matters: Even if you delete your account, your information may still exist in backup systems for up to 90 days, meaning it is not immediately and fully removed.
Information may persist in our backup systems for up to 90 days after deletion.
Potentially tricky or non-obvious clauses that could be unfavorable to users.
Not clearly stated
No cited gotchas — wording is unclearReport on clauses that are favorable to users and demonstrate a commitment to user rights and privacy.
The policy explicitly states that the company never sells user data, and never will.
Why it helps: This commitment provides a strong assurance that your personal information will not be monetized through sales to third parties.
**Our promise: We never sell your data. Never have, never will.**
The company states it collects only the information necessary to provide and improve its Services and doesn't collect personal information for the sake of having more data.
Why it helps: This commitment to data minimization helps protect your privacy by limiting the amount of personal information the company collects, reducing the potential for misuse or exposure.
We collect only the information necessary to provide and improve our Services.
The company does not collect fingerprints, face recognition data, or other biometric identifiers.
Why it helps: This protects your biometric privacy by ensuring sensitive personal identifiers like fingerprints or face data are not collected by the service.
**Biometric Data:** We do not collect fingerprints, face recognition data, or other biometric identifiers.
While users can add a profile picture, the company states it does not extract any information from it or analyze its contents, and it is solely for user's use.
Why it helps: This ensures that your profile picture is used purely for identification and personalization within the service, without any hidden data extraction or analysis, protecting your visual privacy.
**Profile Picture Analysis:** While you can add a profile picture, we do not extract any information from it or analyze its contents. It's solely for your use.
The company commits that personal tasks, calendar information, notes, and usage patterns are never used to train AI models, whether their own or third-party providers'. User data is used only to provide AI features for the user's account.
Why it helps: This is a strong privacy commitment, ensuring that your sensitive personal content and activity will not be used to develop or improve AI models beyond the direct provision of features to you, preventing unintended exposure or commercialization of your data.
**Our Commitment: We Never Train Models on Your Data.** Your personal tasks, calendar information, notes, and usage patterns are never used to train AI models - not ours, not third-party providers', not anyone's. Your data is used solely to provide the AI features you've requested for your own account.
The company requires that AI service providers do not use user data to train their general models and process information solely to provide requested AI features.
Why it helps: This protection ensures that even when third-party AI services are used, strong contractual obligations are in place to prevent them from exploiting your personal data for their own model training, maintaining your privacy across the service ecosystem.
**For AI services specifically:** We require that AI service providers do not use your data to train their general models and that they process your information solely to provide the AI features you've requested.
The company will notify affected users of law enforcement data requests unless legally prohibited from doing so.
Why it helps: This commitment helps keep you informed about potential government access to your data, allowing you to take action or seek legal counsel if necessary, preserving transparency and user rights.
We will notify affected users unless legally prohibited from doing so
The company applies data rights equivalent to those granted by GDPR and CCPA to all customers, regardless of their location, including rights such as access, portability, deletion, and objection.
Why it helps: This ensures a high standard of data privacy for all users by extending the strong protections of GDPR and CCPA globally, providing you with comprehensive control over your personal information.
At Summay, we apply the same data rights to all customers, regardless of their location. Currently, some of the most privacy-forward regulations are the EU's GDPR and California's CCPA. We recognize all rights granted in these regulations for all our users. Depending on where you're located, you may have some or all of these rights:
Users have the right not to be subject to decisions based solely on automated processing (including profiling) that significantly affect them. Where AI could have such effects, users can request human review, express their point of view, or contest the decision.
Why it helps: This protects you from potentially unfair or inaccurate automated decisions by granting you the right to human oversight and a chance to challenge decisions made by AI, ensuring fairness and accountability.
**Automated decision-making and profiling**: You have the right not to be subject to decisions based solely on automated processing (including profiling) that significantly affect you. Where we use AI in a way that could have such effects, you can request human review, express your point of view, or contest the decision.
The company states it does not retaliate or discriminate against users for exercising their privacy rights.
Why it helps: This ensures that you can confidently exercise your privacy rights without fear of negative consequences from the company, promoting trust and empowering your control over personal data.
**No Retaliation:** We do not retaliate or discriminate against you for exercising your privacy rights.
The service is not intended for children under 16, and the company does not knowingly collect personal information from them. Any such information found will be promptly deleted.
Why it helps: This safeguards children's privacy by explicitly stating that the service is not for young users and committing to delete any unintentionally collected data from those under 16.
Sunsama is not intended for children under 16. We don't knowingly collect personal information from children under 16. If we discover we've collected such information, we'll delete it promptly.
When significant changes are made to the Privacy Policy, the company will notify users via email or through the Services and provide at least 30 days' notice before changes take effect.
Why it helps: This ensures that you are informed about important updates to the Privacy Policy ahead of time, giving you an opportunity to review the changes and decide if you wish to continue using the service under the new terms.
* We'll notify you via email or through the Services * We'll provide at least 30 days' notice before changes take effect * We'll post the updated policy on our website with a new "Last Updated" date
The company states it does not sell personal information, and a "Do Not Sell or Share My Personal Information" option is prominently available through its consent management platform and in cookie and privacy preferences.
Why it helps: This ensures that California residents have a clear and accessible way to exercise their CCPA rights to opt out of the sale or sharing of their personal information.
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.