Your data, kept small.

This policy explains how Sunza handles personal data when you join our waitlist today, and how the app is designed to work when it launches. The app is still in development, so the app sections describe how it is built to behave — we'll update this policy before launch if anything changes.

1. Who we are

Sunza (“Sunza”, “we”, “us”, “our”) is operated by Oliver Cameron, an individual sole trader established in France, who is the data controller for the personal data described in this policy.

You can contact us about privacy at test@test.com.

Given the small scale of our processing, we are not required to appoint a Data Protection Officer and have not done so — please use the email above for any privacy query.

2. What we collect, why, and our legal basis

a. Waitlist (website)

• What: your email address, plus the fact and time of your subscription.
• Why: to send you a small number of emails about Sunza early access and launch.
• Legal basis: your consent (Art. 6(1)(a) GDPR), captured through double opt-in. You can withdraw consent at any time by unsubscribing or emailing us; withdrawal doesn't affect processing already carried out.
• Processor: our waitlist email is managed by Kit (ConvertKit / kit.com), which stores the subscriber list on our behalf.

b. Website hosting & security

• What: technical data such as your IP address, browser type and request logs, recorded automatically when you visit.
• Why: to deliver the site, keep it secure and prevent abuse.
• Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in running a secure website.
• Processor: the site is hosted on Cloudflare Pages, which processes these logs to deliver and protect the site.

c. Fonts

Our website loads fonts from Google Fonts. When your browser requests a font, your IP address is transmitted to Google. Legal basis: legitimate interest (Art. 6(1)(f)) in displaying the site correctly.

d. The Sunza app (planned)

• Wardrobe photos: when you add clothes, photos are processed entirely on your device to recognise and label garments. Only a downscaled copy of the photos you choose is kept, and it stays on your device. Your photos are never uploaded to us or any third party — because this data never leaves your device, we have no access to it.
• Trip details: to build a packing list, the app sends your destination and travel dates to a third-party weather forecast provider, over an encrypted (HTTPS) connection, to retrieve the forecast. Legal basis: performance of our contract with you to provide the packing list (Art. 6(1)(b) GDPR). We use these details only to fetch the forecast and don't retain them on our own systems after the request; the forecast provider processes them under its own privacy terms. We'll name the specific provider here once it's selected.
• The app does not require an account. We'll update this policy before adding any feature that changes what data is collected.

Is providing this data required? No. Giving us your email — or giving the app your destination and dates — is entirely voluntary; it is not a statutory or contractual obligation. If you don't provide your email, you simply won't receive launch updates; if you don't provide trip details, the app can't produce a forecast-based list. The app section above describes processing that begins only when the app launches, and we'll reissue this policy at that point.

3. Cookies and tracking

Our website uses no advertising, analytics or profiling cookies and runs no third-party tracking scripts. Only the strictly necessary technology needed to serve the page and submit the waitlist form is used. (Kit may set its own cookies if you interact with a Kit-hosted page; see Kit's own privacy notice.)

4. Who we share data with

We do not sell your personal data. We share it only with the service providers that help us run Sunza:

• Kit (ConvertKit) — waitlist email management
• Cloudflare — website hosting, content delivery and security
• Google (Google Fonts) — font delivery
• A weather forecast provider — to return forecasts in the app (once launched)

Each acts on our instructions as a processor, or as an independent controller for their own infrastructure and security, under their own privacy terms.

5. International transfers

Some providers (for example Kit and Google, based in the United States, and Cloudflare's global network) may process data outside the EEA. Where they do, transfers are protected by appropriate safeguards under GDPR — such as the EU Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply to a specific provider by emailing us.

6. How long we keep data

• Waitlist email: until Sunza launches and we've notified you, or until you unsubscribe or ask us to delete it — whichever comes first. To delete it: use the unsubscribe link in any email, or email us; we action deletion requests within 30 days. After that we delete or anonymise it.
• Website logs: retained by our hosting provider only as long as needed for security, and in any case no longer than 30 days.
• App data on your device: controlled entirely by you — delete individual photos in the app, or remove all of it by uninstalling the app.

7. Your rights (GDPR)

You have the right to: access your data; rectify inaccurate data; erase it (“right to be forgotten”); restrict or object to processing; data portability; and withdraw consent at any time. To exercise any of these, email test@test.com — we'll respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In France this is the CNIL (www.cnil.fr). You may also contact the authority in your own EU country.

8. Children

Sunza is not directed to young children. It is intended for users aged 15 or over, reflecting France's digital-consent age. If you are under 15 in France, a parent or guardian must consent on your behalf. This threshold varies between 13 and 16 across the EEA, so your national rule may differ. We don't knowingly collect data from children below the applicable age without the required parental consent.

9. Security

We keep personal data to a minimum, use reputable providers, serve the site over HTTPS with strict security headers, and design the app so your photos never leave your device.

10. Changes to this policy

We may update this policy as Sunza develops — especially when the app launches. We'll change the effective date above and, for material changes affecting waitlist subscribers, notify you by email.