← Back to home

Sunzu · Legal

Privacy Policy

Last updated: March 2026.

Alpha Base OS Ltd ("Sunzu," "we," "us," or "our") is committed to protecting the privacy and security of personal information. This policy explains how we collect, use, share, and retain personal data in accordance with applicable data protection law, including the UK GDPR, EU GDPR, ePrivacy Directive, LGPD, CCPA, and CalOPPA.

Sunzu acts as data controller for personal data collected via www.sunzu.ai and the Sunzu research workspace. Alpha Base OS Ltd is registered with the Information Commissioner's Office (ICO) under registration number C1103931.

1. Data we collect

  • Contact and account data: name, email address, telephone number, job title, and company name when you create an account, book a call, or contact us.
  • Usage data: IP address, browser type, device identifiers, pages visited, session duration, and referring URLs collected automatically when you use our website or workspace.
  • Workspace data: customer records, research files, transcripts, survey exports, and other data you upload under contract. This data is processed solely for the delivery of your contracted research workspace.
  • Communications: content of emails, support tickets, or messages you send to us.
  • Cookie data: see our Cookie Policy for full details.

2. Legal basis for processing

  • Contract performance: processing your data to deliver and support the Sunzu service.
  • Legitimate interests: product development, security, fraud prevention, and service improvement, where those interests are not overridden by your rights.
  • Consent: marketing communications and non-essential cookies, where we have obtained your explicit consent.
  • Legal obligation: compliance with applicable law, regulatory obligations, and lawful authority requests.

3. How we use your data

  • Delivering and maintaining your Sunzu research workspace.
  • Communicating about your account, service updates, and support queries.
  • Sending marketing communications where you have opted in.
  • Improving and developing the Sunzu product and behavioural model.
  • Enforcing our terms and protecting against fraudulent or unlawful activity.
  • Complying with legal and regulatory requirements.

4. Workspace data

Data you upload into a contracted Sunzu workspace is processed only for the purpose of delivering your research service. We do not use workspace data to train models for third parties, share it with advertisers, or sell it. Workspace data is governed by the terms of your contract and any applicable data processing agreement.

5. Sharing personal data

  • Service providers and sub-processors: AWS (infrastructure), Google (analytics and productivity), Microsoft (productivity), Stripe (payments), SurveyMonkey (survey tooling), TestingTime AG (participant recruitment), Vimeo (video hosting), Webflow (website), and Facebook (advertising). Each sub-processor is bound by appropriate data processing terms.
  • Clients: workspace outputs are shared with contracted clients only with your explicit consent or as required by the research engagement.
  • Acquisition and business partners: in the event of a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to confidentiality obligations.
  • Legal disclosure: where required by law, court order, or to protect the rights, property, or safety of Sunzu, its users, or the public.

We do not sell personal data to third parties for advertising purposes.

6. International transfers

We store and process data primarily within the EEA, UK, and Switzerland. Where transfer outside these regions is necessary (for example, to certain sub-processors), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or applicable adequacy decisions. You may request a copy of the relevant transfer safeguards by contacting us.

7. Retention

  • Website-registration PII: retained for no longer than one year from last activity, unless required by law.
  • Market-research video: retained for no longer than one year from collection.
  • Workspace data: retained for the duration of the contract, then deleted or returned within 30 days of contract termination, unless a longer period is required by law.
  • Backup and archive: data may persist in secure backups for up to 90 days after deletion from active systems.

8. Your rights

Subject to applicable law, you have the right to:

  • Access: request a copy of the personal data we hold about you.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure: request deletion of your personal data where there is no lawful basis for continued processing.
  • Restriction: request that we restrict processing of your data in certain circumstances.
  • Portability: receive your data in a structured, machine-readable format and transfer it to another controller.
  • Objection: object to processing based on legitimate interests or for direct marketing purposes.
  • Withdraw consent: withdraw consent at any time where consent is the basis for processing, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact hello@sunzu.ai. We will respond within one month. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority. See also our Data rights page.

9. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, and regular security reviews. No system is completely secure; if you believe a security incident has occurred, notify us immediately at hello@sunzu.ai.

10. Contact

Alpha Base OS Ltd, hello@sunzu.ai.