Privacy Policy

In short

This is a summary. The full policy below is what applies.

(A) Who we are. Sundae Bar AI PLC is the controller of your personal data when you use Sundae.

(B) How Sundae works. Sundae reads your messages, remembers facts about you, and acts on websites and services on your behalf. To do that we store your conversations and send their content to the AI model providers, messaging providers and integration provider we use.

(C) What we do with conversations. We use them to run Sundae and to improve it. Card numbers, one-time codes and passwords are removed where we detect them. Our staff can read conversations where legality, safety or troubleshooting requires it, and every such access is logged.

(D) What we cannot see. We cannot read what you keep in the Vault. We do not record the card details you type during a Hand-over.

(E) Where your data goes. Your Environment runs on servers in Germany. Some of our providers are in the United States, and we use the legal safeguards described in clause 7. When Sundae deals with a website or service for you, your data goes wherever that service is.

(F) Your control. You can delete your Account from chat. You have the rights set out in clause 10 and can complain to the Information Commissioner's Office.

Privacy policy

1. About this policy and who we are

1.1 This privacy policy explains how we collect, use, share and protect personal data when you use Sundae, the AI personal assistant available at sundae.md and through messaging channels, the Vault at vault.sundae.md, pages hosted under our domains, and our related websites and services (together, the “Service”), and when you contact us.

1.2 The controller of your personal data is Sundae Bar AI PLC, a public company limited by shares incorporated in England and Wales with company number 13714088, whose registered office is at c/o Druces LLP, 6th Floor, 99 Gresham Street, London EC2V 7NG (“we”, “us” and “our”). You can contact us about privacy at the address above.

1.3 Capitalised words that are not defined here have the meaning given to them in our Terms of Use at sundae.md (the “Terms”). This policy forms part of the Terms.

1.4 If you use the Service for a business rather than as a Consumer, you are the controller of the personal data in Your Content and we process it as your processor under the Data Processing Addendum at sundae.md. This policy still applies to the data we hold about you as a user, and describes the processing we carry out on your behalf.

1.5 This policy applies to the Service as it operates at the Effective Date. Features it describes may be enabled for some users only, and may change.

2. The data we collect

2.1 Data you give us, or that Sundae collects as it works for you. This includes:

(a) Account data: the phone number or messaging identity you use to talk to Sundae, your name and any profile details you give, your settings (Plan, Spending Limit, Vault state, approved email recipients, preferences) and the date and version of the Terms you accepted;

(b) Conversation data: every message between you and Sundae, including text, images, voice, files, links and locations you send, approval requests and your responses, and Sundae's replies and reports. Card numbers, one-time codes and passwords are removed where we detect them before storage;

(c) Memory: the facts Sundae has recorded about you from your conversations so that it can act for you, such as your preferences, addresses and contacts you have mentioned, and tasks you have asked for;

(d) Environment data: the files, code, browser sessions and history, reminders, background tasks, Hosted Content, and email sent and received at Sundae's address, held in the Environment allocated to your Account;

(e) Vault metadata: the name, site and kind of each Vault Item, and the encrypted content of each Vault Item, which we cannot read;

(f) Payment events: for each Vault or Onelink payment, a record of a masked identifier for your Account, the amount, the site and the method used;

(g) Connected Services data: the tokens that allow Sundae to act in your Connected Services, and the data Sundae retrieves from them in carrying out your Instructions, such as calendar entries, emails, messages and documents;

(h) Billing data: your Plan, purchases of Credits and hosting charges, and the information our payment processor shares with us, such as your name, email address, card brand, the last four digits of your card and your transaction history. Our payment processor holds your full card details; we do not;

(i) Support and correspondence: anything you send us when you contact us, and our replies.

2.2 Data we collect automatically. This includes:

(a) Technical data: IP address, device and browser type, operating system, language, timestamps, request logs, error reports and performance data when you use our web pages, the Vault or a Hand-over link;

(b) Usage events: which features you use and how often, task counts, Allowance usage, timing and similar events. These are sent to our analytics and monitoring providers without message text;

(c) Admin log: a rolling redacted log of your messages from the last 30 days, truncated to the first 500 characters of each message, used by our staff for support and administration;

(d) Access log: a record of each occasion on which a member of our staff accesses your conversations, and the reason.

2.3 Data from third parties. We receive data about you from the Merchants and websites Sundae visits for you (such as order confirmations and booking references), from Connected Services, from our payment and wallet providers, and from the messaging channels you use (such as delivery status and the profile name the channel provides).

2.4 Data about other people. Clause 12 explains how we treat personal data about other people that you give to Sundae.

2.5 Special category and criminal offence data. We do not ask for special category data (such as information about your health, religion, sexual orientation, ethnicity, political opinions or trade union membership) or data about criminal convictions or offences. If you choose to share it with Sundae, for example to book a medical appointment or to tell Sundae about a dietary requirement, we process it on the basis of your explicit consent, which you give by sharing it, solely to carry out your Instructions and to run the Service as described in this policy. You can withdraw that consent by asking Sundae to forget the relevant facts or by deleting your Account. Withdrawal does not affect processing already carried out.

3. What we do not collect or cannot see

3.1 Vault contents. Vault Items are encrypted on your device with keys derived from your passkey. We store only the encrypted data and the name, site and kind of each item. We cannot read the contents, and when Sundae uses a Vault Item to complete a purchase the decrypted values are entered into the browser by a separate privileged process; the AI model, your conversation history, Sundae's memory and our logs do not receive them.

3.2 Hand-over details. Details you type into a Merchant's page during a Hand-over are sent to the Merchant through the browser in your Environment. They are not written to your conversation history, memory or logs. They may exist transiently in the browser session while you complete the checkout.

3.3 Redaction is best-effort. We remove card numbers, one-time codes and passwords from conversations where we detect them. Detection can fail. If you put such details in chat and we do not detect them, they will be stored with the conversation and processed like any other message. Use the Vault or a Hand-over instead.

3.4 No training by messaging providers. The content of your messages passes through our messaging providers only to deliver them. We do not permit those providers to use message content for any purpose of their own.

4. How we use your data and our lawful bases

4.1 We use your personal data for the purposes, and on the lawful bases, set out below. Where more than one basis is listed, each applies to part of the purpose.

4.2 Where we rely on legitimate interests, we have considered the effect of the processing on you and concluded that our interests are not overridden by your interests, rights and freedoms. You can ask us for more information about that assessment, and you can object to processing based on legitimate interests (clause 10).

4.3 We may create aggregated or de-identified data from your personal data, which no longer identifies you, and use it for any purpose.

5. AI models and automated processing

5.1 Third-party models make Sundae's decisions. Sundae is operated by large language models supplied by the Model Providers listed in Schedule 1. To respond to you and decide what to do, we send your messages, relevant memory, the content of pages and documents Sundae is working with, and other task context to those providers. Image, video and voice generation is carried out by a separate provider. We choose providers and models by task and by cost and may change them without notice.

5.2 What providers may do with your data. Our Model Providers process your data under their terms with us in order to provide their service to us. [Confirm before publication, per provider: that the provider does not use our data to train its models and its retention period for inputs and outputs.] Their own security and retention practices apply while data is with them.

5.3 Automated processing on your Instructions. Sundae uses automated processing, including AI, to interpret and carry out your Instructions, which can include buying, booking, sending messages and creating accounts. These are actions you have asked for and authorised, not decisions we make about you. You control what you ask for, your Spending Limit and other settings, and you can stop or correct Sundae at any time.

5.4 Decisions about you. We do not use your personal data to make solely automated decisions about you that have legal or similarly significant effects, except where needed to detect fraud or abuse and to protect the Service, in which case you can ask for human review of the decision by contacting us.

5.5 Accuracy. Output and memory are generated by AI and can be wrong. You can ask Sundae to correct or forget a fact, and you can ask us to correct your data (clause 10).

6. Who we share your data with

6.1 Our processors. We use the providers listed in Schedule 1 to run the Service. They process your data on our instructions and under contracts that require them to protect it. The list may change; the current list is at sundae.md and in Schedule 1 of the latest version of this policy.

6.2 Merchants and websites, on your Instructions. When you ask Sundae to deal with a website or Merchant, Sundae shares with it the information the task requires, such as your name, contact details, delivery address, preferences and, through the Vault or a Hand-over, payment details. Each Merchant or website is an independent controller of the data it receives and handles it under its own privacy policy. We do not control them.

6.3 Connected Services and recipients. When you connect a Connected Service, data moves between it and your Environment as your Instructions require, through our integration provider. When Sundae sends an email or message for you, its content goes to the recipient. These third parties are independent controllers.

6.4 Visitors to your Hosted Content. Anyone who opens a page you have published can see what it contains.

6.5 Our staff and contractors. People working for us may access your data where their role requires it, under obligations of confidentiality. Access to conversation content is restricted and logged.

6.6 Advisers and insurers. Our lawyers, accountants, auditors, bankers, insurers and other professional advisers, where they need the data to advise or act for us.

6.7 Authorities. Law enforcement, regulators, courts and other authorities where the law requires it, where we receive a lawful request, or where we consider disclosure necessary to protect the Service, our users or others, or to establish or defend legal claims.

6.8 Business transfers. A prospective or actual buyer, investor, lender or successor of our business or assets, and their advisers, in connection with a transaction. We will require them to keep the data confidential and, if the transaction completes, to use it only as this policy allows or as they notify you.

6.9 With your consent. Otherwise, where you ask or agree.

6.10 No sale of data. We do not sell your personal data and we do not share it with third parties for their own marketing.

7. International transfers

7.1 Germany. Your Environment runs on servers in Germany, and our monitoring and analytics providers process data in the European Union. Transfers from the United Kingdom to the European Economic Area are covered by UK adequacy regulations.

7.2 United States and elsewhere. Several of our providers, including our Model Providers, media generation provider, integration provider, messaging provider, payment processor and network provider, are in the United States or process data there. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework we rely on that certification. Otherwise we rely on the International Data Transfer Agreement issued by the Information Commissioner, or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with any supplementary measures we consider necessary. You can ask us for a copy of the relevant safeguard.

7.3 Transfers you ask for. When Sundae deals with a website, Merchant, Connected Service or recipient for you, your data goes wherever that third party is, which may be anywhere in the world. Those transfers are made at your request and are necessary to carry out the Instruction you have given, and we do not control the recipient's handling of the data.

8. How long we keep your data

8.1 We keep personal data for as long as we need it for the purposes described in this policy, as set out below, and then delete it or render it unreadable.

8.2 Deleting your Account is available by Instruction to Sundae. We do not keep readable copies of your conversations, memory, files or Vault after deletion, except as set out in clause 8.1.

9. Security

9.1 We take reasonable technical and organisational measures to protect your data, including: an isolated Environment for each Account; encryption of data in transit; end-to-end encryption of Vault Items with keys we do not hold; a separate privileged process for entering Vault details that keeps them away from the AI model, conversation history, memory and logs; redaction of card numbers, codes and passwords from conversations where detected; restricted and logged staff access to conversation content; sending logs and analytics without message text; limited retention; and contractual obligations on our providers.

9.2 No system is completely secure. The Service is beta software that may contain vulnerabilities, and we cannot guarantee that your data will not be accessed, lost or corrupted. Keep your device, messaging accounts, passkeys and links secure, store in the Vault only what you need, and tell us at once at the address in clause 17 if you believe your data or Account has been compromised.

10. Your rights

10.1 Under data protection law you have the right to:

(a) access the personal data we hold about you and receive a copy;

(b) have inaccurate data corrected and incomplete data completed;

(c) have your data erased, in certain circumstances;

(d) restrict our processing of your data, in certain circumstances;

(e) receive the data you have given us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;

(f) object to processing based on our legitimate interests, including our use of your conversations to improve the Service, and to object at any time to direct marketing;

(g) withdraw consent where our processing is based on consent, without affecting processing already carried out; and

(h) not be subject to solely automated decisions with legal or similarly significant effects, except as the law permits.

10.2 How to exercise them. Ask Sundae in chat, or email us at the address in clause 17. We may need to verify your identity, which we will usually do through the phone number or messaging identity associated with your Account. We will respond within one month, or longer where the law allows, and we will tell you if so. We do not charge unless a request is manifestly unfounded or excessive.

10.3 Limits. We cannot provide the contents of your Vault, because we cannot read them; an access request will return Vault metadata only. We may withhold or redact data where providing it would reveal personal data about someone else, where the law requires us to keep it, or where an exemption applies. We may refuse an objection to legitimate-interest processing where we have compelling legitimate grounds that override your interests, or where the processing is needed for legal claims; we will tell you if we do.

10.4 Self-service. You can delete individual Vault Items, ask Sundae to forget facts, revoke Connected Services, disable the Vault, lower or freeze your Spending Limit and delete your Account without contacting us.

11. Children

11.1 The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has an Account, contact us and we will delete it.

12. Data about other people

12.1 If you give Sundae personal data about other people, for example the names and contact details of people you want Sundae to email, book for, or remember, we process that data on your Instructions to carry out your tasks and otherwise as described in this policy. You are responsible for having the right to share it and for telling those people what the law requires.

12.2 If you are someone whose data a Sundae user has shared with us and you want to exercise your rights, contact us at the address in clause 17. We may need to involve the user who shared your data.

13. Hosted Content and visitors

13.1 When someone visits a page published under our domains, our network provider and we process technical data about the visit (such as IP address, browser type, request logs and timing) to deliver the page and to protect against abuse. We keep that data as described in clause 8.

13.2 The user who published a page decides what it contains and what, if anything, it collects from visitors. That user is responsible for its own privacy notice and for complying with the law. We do not control the content of Hosted Content and are not the controller of data it collects, other than the technical data described in clause 13.1.

14. Cookies and similar technologies

14.1 Our web pages at sundae.md, vault.sundae.md and Hand-over links use cookies and similar technologies (such as local storage) as follows:

14.2 You can control cookies through your browser settings and through the cookie banner where one is shown. Blocking essential cookies may stop the Vault or Hand-over from working.

14.3 Pages published by users under our domains may set their own cookies. Those are the responsibility of the user who published the page.

14.4 Messaging channels do not use cookies, but the channel operator (Apple or Meta) collects data about your use of its service under its own policy.

15. Service messages and marketing

15.1 Sundae sends you messages as part of the Service without a prompt from you, including task reports, approval requests, reminders, security alerts and notices about the Service or these documents. You cannot opt out of these while your Account is open.

15.2 We may send you marketing about Sundae features, Plans and offers by message or email. Where the law requires consent we will ask for it first. You can opt out at any time by replying STOP, by telling Sundae, or by contacting us. Opting out of marketing does not stop service messages.

16. Changes to this policy

16.1 We may change this policy from time to time, including to reflect changes to the Service, our providers or the law. We will post the current version at sundae.md with its Effective Date, and where a change is material we will tell you through the Service or by email before it takes effect. Please review the policy periodically.

17. Complaints and how to contact us

17.1 Questions, requests and complaints about privacy should be sent by post to Sundae Bar AI PLC, c/o Druces LLP, 6th Floor, 99 Gresham Street, London EC2V 7NG, United Kingdom. You can also ask Sundae to pass a privacy request to us.

17.2 If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you live in the European Economic Area you may also complain to the data protection authority in your country. We would appreciate the chance to resolve your concern first.

Schedule 1: Processors and sub-processors

The providers below process personal data on our behalf to run the Service as at the Effective Date. We may add, change or remove providers; the current list is published at sundae.md. Providers Sundae deals with on your Instructions (Merchants, websites, Connected Services and recipients) are independent controllers and are not listed here.