Privacy notice

Updated 30 September 2026

This notice explains how the Sunzu group handles personal data on sunzu.com and in connection with its services. Customer relationships in the UK, Switzerland and EEA are handled by Alpha Base OS Ltd, a wholly owned subsidiary of Sunzu, Inc. Sunzu, Inc. handles US customer relationships and those elsewhere in the world. Company details and contacts identify both entities.

Who is responsible for your data?

The company handling your enquiry or customer relationship acts as controller for the account, contact, billing and marketing information it uses for its own business purposes. For an existing customer, check the provider in your agreement. Contact us if you need help identifying the responsible entity. Applicable privacy rights depend on the processing and relevant law, not a region selected on this website.

For personal data contained in customer research materials that we process on the customer's documented instructions, the relevant Sunzu provider acts as processor, or subprocessor where the customer is itself a processor. The customer determines the purposes of that processing. Your customer agreement and applicable data processing agreement govern it.

1. Data we collect

Contact and account data: name, email address, telephone number, job title, and company name when you create an account, book a call, or contact us.
Usage data: IP address, browser type, device identifiers, pages visited, session duration, and referring URLs collected automatically when you use our website or workspace.
Workspace data: customer records, research files, transcripts, survey exports, and other data you upload under contract. This data is processed solely for the delivery of your contracted research workspace.
Communications: content of emails, support tickets, or messages you send to us.
Session recordings: where you accept analytics cookies, a reconstruction of your visit to www.sunzu.com; pages viewed, mouse movement, scrolling, clicks, keystrokes, screen size, and approximate location from your IP address. We do not enable recording of the contents of form fields. In the Sunzu workspace, recordings are additionally masked so that no text is captured at all; the reconstruction shows layout and interaction, never the content of your research. Recordings are stored in the European Union. See our Cookie Policy for the tools involved and how to withdraw consent.
Cookie data: see our Cookie Policy for full details.

2. Legal basis for processing

Contract performance: processing your data to deliver and support the Sunzu service.
Legitimate interests: product development, security, fraud prevention, and service improvement, where those interests are not overridden by your rights.
Consent: marketing communications and non-essential cookies, where we have obtained your explicit consent.
Legal obligation: compliance with applicable law, regulatory obligations, and lawful authority requests.

3. How we use your data

Delivering and maintaining your Sunzu research workspace.
Communicating about your account, service updates, and support queries.
Sending marketing communications where you have opted in.
Improving and developing the Sunzu product, subject to the restrictions on workspace data in section 4.
Enforcing our terms and protecting against fraudulent or unlawful activity.
Complying with legal and regulatory requirements.

4. Workspace data

Data you upload into a contracted Sunzu workspace is processed only for the purpose of delivering your research service. We do not use workspace data to train models for third parties, share it with advertisers, or sell it. Workspace data is governed by the terms of your contract and any applicable data processing agreement.

5. Sharing personal data

Service providers and sub-processors: Cloudflare (website hosting, CDN and security), Microsoft (cloud infrastructure via Azure, and productivity), PostHog (analytics and session recording), Google (productivity and website advertising measurement), LinkedIn (advertising), HubSpot (website enquiries, early-access registrations, paper requests and call booking), and Stripe (payments). Each sub-processor is bound by appropriate data processing terms.
Customer workspaces: customer content and research outputs are made available to the customer and its authorised users as part of the research service.
Acquisition and business partners: in the event of a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to confidentiality obligations.
Legal disclosure: where required by law, court order, or to protect the rights, property, or safety of Sunzu, its users, or the public.

We do not sell customer workspace data. With your advertising consent, website information is disclosed to Google Ads and LinkedIn for advertising measurement and related advertising purposes. Such disclosures may constitute sale, sharing or targeted advertising under applicable US state laws. You can refuse advertising through Cookie preferences. We honour Global Privacy Control by disabling optional analytics and advertising on this website.

6. International transfers

We store and process data primarily within the EEA, UK, and Switzerland. Where transfer outside these regions is necessary (for example, to certain sub-processors), we use a transfer mechanism applicable to that data flow, such as an applicable adequacy decision or EU Standard Contractual Clauses. Restricted transfers under UK law require an applicable UK mechanism, such as the UK Addendum to the EU clauses or the UK International Data Transfer Agreement. Group ownership does not remove these requirements. You may request a copy of the relevant transfer safeguards by contacting us.

7. Retention

Website-registration PII: retained for no longer than one year from last activity, unless required by law.
Market-research video: retained for no longer than one year from collection.
Workspace data: retained for the duration of the contract, then deleted or returned within 30 days of contract termination, unless a longer period is required by law.
Backup and archive: data may persist in secure backups for up to 90 days after deletion from active systems.

8. Your rights

Subject to applicable law, you have the right to:

Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your personal data where there is no lawful basis for continued processing.
Restriction: request that we restrict processing of your data in certain circumstances.
Portability: receive your data in a structured, machine-readable format and transfer it to another controller.
Objection: object to processing based on legitimate interests or for direct marketing purposes.
Withdraw consent: withdraw consent at any time where consent is the basis for processing, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact hello@sunzu.com. We respond within the period required by the law applicable to your request. UK and EEA requests are generally handled within one month, subject to permitted extensions. See our privacy requests page for regional information. If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority. See also our Data rights page.

9. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, and regular security reviews. No system is completely secure; if you believe a security incident has occurred, notify us immediately at hello@sunzu.com.

10. EU GDPR representative

Elkyn Europe OÜ, an Estonian company (registry code 16448398), is the appointed representative of Alpha Base OS Ltd under Article 27 of the EU GDPR. This appointment concerns Alpha Base OS Ltd; it does not appoint Elkyn Europe OÜ for Sunzu, Inc. or make Elkyn Europe OÜ your service provider.

Contact the representative directly at gdpr@elkyn.com or by post: Elkyn Europe OÜ, GDPR Representative, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond, 10151, Estonia. This is the representative’s designated correspondence address. You may contact the representative directly without first contacting Sunzu.

11. US privacy rights

Depending on your state of residence and whether the relevant law applies, you may have rights to access, correct, delete or obtain a portable copy of personal information; opt out of sale, sharing or targeted advertising; limit certain uses of sensitive information; and appeal a refusal. We do not discriminate against you for exercising applicable rights. An authorised agent may submit a request where permitted. See our privacy requests page for how to contact us.

12. Contact and complaints

Contact hello@sunzu.com and identify the relevant Sunzu company. You may also write to your relevant Sunzu company at the address on our company details page. To raise a concern, follow our privacy complaints process.