Your data, kept small.

This policy explains how Sunza handles personal data when you contact us through the website today, and how the app is designed to work when it launches. The app is still in development, so the app sections describe how it is built to behave — we'll update this policy before launch if anything changes.

1. Who we are

Sunza (“Sunza”, “we”, “us”, “our”) is operated by Oliver Cameron, an individual sole trader established in France, who is the data controller for the personal data described in this policy.

You can contact us about privacy at test@test.com.

Given the small scale of our processing, we are not required to appoint a Data Protection Officer and have not done so — please use the email above for any privacy query.

2. What we collect, why, and our legal basis

a. Contact form (website)

• What: the email address and message you send us, plus the time of your submission.
• Why: to receive, read and reply to your enquiry.
• Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in responding to messages you choose to send us. Sending a message is entirely up to you.
• How it's handled: the contact form is processed entirely on Cloudflare — a bot check by Cloudflare Turnstile, brief storage in Cloudflare KV, and delivery to us by Cloudflare Email Routing. To limit spam and abuse we also keep a short-lived, salted hash of your IP address (not the address itself) for rate-limiting. No email-marketing service is involved.

b. Website hosting & security

• What: technical data such as your IP address, browser type and request logs, recorded automatically when you visit.
• Why: to deliver the site, keep it secure and prevent abuse.
• Legal basis: our legitimate interests (Art. 6(1)(f) GDPR) in running a secure website.
• Processor: the site is hosted on Cloudflare Pages, which processes these logs to deliver and protect the site.

c. Fonts

Our fonts are self-hosted on our own site. Displaying the site does not send your data to Google Fonts or any other third-party font service.

d. The Sunza app (planned)

• Wardrobe photos: when you add clothes, photos are processed entirely on your device to recognise and label garments. Only a downscaled copy of the photos you choose is kept, and it stays on your device. Your photos are never uploaded to us or any third party — because this data never leaves your device, we have no access to it.
• Trip details: to build a packing list, the app sends your destination and travel dates to a third-party weather forecast provider, over an encrypted (HTTPS) connection, to retrieve the forecast. Legal basis: performance of our contract with you to provide the packing list (Art. 6(1)(b) GDPR). We use these details only to fetch the forecast and don't retain them on our own systems after the request; the forecast provider processes them under its own privacy terms. We'll name the specific provider here once it's selected.
• The app does not require an account. We'll update this policy before adding any feature that changes what data is collected.

Is providing this data required? No. Sending us a message — or giving the app your destination and dates — is entirely voluntary; it is not a statutory or contractual obligation. If you don't contact us, we simply won't have your message; if you don't provide trip details, the app can't produce a forecast-based list. The app section above describes processing that begins only when the app launches, and we'll reissue this policy at that point.

3. Cookies and tracking

Our website uses no advertising, analytics or profiling cookies and runs no third-party tracking scripts. Only the strictly necessary technology needed to serve the page and submit the contact form is used. (Cloudflare Turnstile may set a token needed to run its bot check when you submit the contact form; see Cloudflare's own privacy notice.)

4. Who we share data with

We do not sell your personal data. We share it only with the service providers that help us run Sunza:

• Cloudflare — website hosting, content delivery, security, and contact-form handling (bot check, temporary storage and email delivery)
• A weather forecast provider — to return forecasts in the app (once launched)

Each acts on our instructions as a processor, or as an independent controller for their own infrastructure and security, under their own privacy terms.

5. International transfers

Some providers (for example Cloudflare's global network) may process data outside the EEA. Where they do, transfers are protected by appropriate safeguards under GDPR — such as the EU Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply to a specific provider by emailing us.

6. How long we keep data

• Contact messages: we keep your message and email address only as long as needed to handle your enquiry, then delete them. The anti-abuse IP hash is kept only for a short rate-limiting window and then expires automatically. To delete sooner: email us; we action deletion requests within 30 days.
• Website logs: retained by our hosting provider only as long as needed for security, and in any case no longer than 30 days.
• App data on your device: controlled entirely by you — delete individual photos in the app, or remove all of it by uninstalling the app.

7. Your rights (GDPR)

You have the right to: access your data; rectify inaccurate data; erase it (“right to be forgotten”); restrict or object to processing; data portability; and withdraw consent at any time. To exercise any of these, email test@test.com — we'll respond within one month.

You also have the right to lodge a complaint with a supervisory authority. In France this is the CNIL (www.cnil.fr). You may also contact the authority in your own EU country.

8. Children

Sunza is not directed to young children. It is intended for users aged 15 or over, reflecting France's digital-consent age. If you are under 15 in France, a parent or guardian must consent on your behalf. This threshold varies between 13 and 16 across the EEA, so your national rule may differ. We don't knowingly collect data from children below the applicable age without the required parental consent.

9. Security

We keep personal data to a minimum, use reputable providers, serve the site over HTTPS with strict security headers, and design the app so your photos never leave your device.

10. Changes to this policy

We may update this policy as Sunza develops — especially when the app launches. We'll change the effective date above whenever we do.