Privacy Policy

01Information We Collect

We collect information in three ways:

Information you give us. When you create an account, complete onboarding, submit a contact or partner form, or contact support, we collect your name, email address, phone number, business details (business name, category, service area, address), and any content you upload to build your website — logos, images, copy, and business information.

Information from your customers, on your behalf. When your website captures a lead, booking, order, review request, or newsletter signup, that information is stored in your dashboard. You are the controller of that data; we process it as your service provider.

Information we collect automatically. When you use the dashboard we record limited technical data — IP address, browser type, and timestamps — for security, rate limiting, and troubleshooting. We do not use advertising cookies or third-party trackers.

Payment information. Card details are collected and stored by our payment processor, Stripe. We never see or store full card numbers; we retain only a Stripe customer reference and the last four digits and card brand for display.

02How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain your website and dashboard.
• Generate your website content using AI models (see “Sub-processors”), based on the business details you supply.
• Process subscription payments and, where enabled, payments to your business.
• Enforce territorial exclusivity across our platform.
• Send you transactional messages — account, billing, security, and support notices.
• Provide customer support and respond to your requests.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Comply with legal obligations.

We send marketing email only where permitted, and every marketing message includes a one-click unsubscribe. Transactional messages are not marketing and are required to operate your account.

03Privacy-First Analytics

Analytics on the websites we build for you are privacy-first by design. We do not set cookies and do not embed third-party tracking scripts on tenant websites. Visitor insights are derived from aggregated, non-identifying request data so you can measure performance without surveilling your customers.

Because we don’t drop tracking cookies on your visitors, your site avoids the cookie consent friction that weighs down most small-business websites.

04How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share information with trusted sub-processors only as needed to run the platform:

• Stripe — payment processing, subscriptions, and payouts.
• Amazon Web Services (SES) — transactional and marketing email delivery and hosting infrastructure.
• Twilio — SMS delivery, where you enable text messaging.
• AI providers — website and content generation. We use a self-hosted model where possible and Anthropic (Claude) as a fallback; we do not send payment details or customer contact lists to these models.

We may also disclose information to comply with the law, enforce our agreements, or protect the rights, property, and safety of Sunshine Network, our clients, and the public. If Sunshine Network is involved in a merger or acquisition, your information may transfer as part of that transaction.

05Security and Retention

We protect your account with modern safeguards: passwords are hashed with Argon2id and never stored in plaintext; session tokens are stored only as SHA-256 hashes in httpOnly, secure, same-site cookies with a rolling 30-day expiry; and access to tenant data is scoped per organization. Data is encrypted in transit.

We retain your information for as long as your account is active and as needed to provide the service. After you cancel, we retain account and transaction records only as long as necessary for legal, tax, and accounting purposes, then delete or anonymize them. You can request earlier deletion as described below.

06Your Rights and Choices

You can access and update most of your information directly in your dashboard. Subject to your jurisdiction, you may also have the right to request a copy of your data, to correct or delete it, to object to or restrict certain processing, and to opt out of marketing communications. Residents of California, the EU, the UK, and other regions may have additional rights under the CCPA/CPRA, GDPR, and comparable laws.

To exercise any of these rights, contact us. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights.

Sunshine Network is not directed to children under 16, and we do not knowingly collect their personal information.

07Changes and Contact

We may update this policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or in the dashboard. Your continued use of the service after an update means you accept the revised policy.

Questions about this policy or your data? Contact us or email privacy@sunshine.network.