Legal

Privacy notice

Effective 2026-09-08.

Controller

Sundayclear is operated by PDF Solutions OÜ, Uus tn 2-6, 10111 Tallinn, Estonia. For anything on this page, contact support@sundayclear.com.

What we collect, and why

Purchase data. When you buy a Sundayclear product, Stripe processes your payment and shares with us your email, the product purchased, and the order status. We use this to grant access, send order confirmations, and handle refunds. We never see or store your card details — those stay with Stripe.

Email for delivery and access. Your email is used to deliver the product you bought, send your magic-link download page at /access, and reply if you contact support.

Free-kit email. If you request the free kit at /kit, we use your email to send the kit and a short welcome series of 3 emails. If you signed up with the newer consent wording ("a 3-email walkthrough, then occasional tasks and offers"), or clicked the one-click opt-in link in the third email, we also send occasional emails afterwards: a usable task every week or two, and news about our own products and prices. Nothing else, and never from anyone but us. This only happens if you tick the consent checkbox on the form. You can unsubscribe with one click from any of those emails, or by writing to us.

Post-purchase email. After a purchase we send up to six short product emails over three weeks (delivery, first-win tips, and the occasional relevant offer) — every one has a one-click unsubscribe.

Analytics beacon. The site sends a small, anonymous beacon on page loads: the page path, UTM parameters, the referrer, and a salted hash of your IP address (used only to rate-limit abuse and estimate unique visits — it cannot be reversed to your IP). There are no cookies, no device fingerprinting, and no cross-site tracking.

Cloudflare Web Analytics. Our hosting provider, Cloudflare, also counts page views and visits for us. It uses no cookies and no persistent identifiers and stores no personal data about you; we only see aggregate numbers (visits, pages, referrers).

Cookies and tracking

First-party visit beacon (always on). Every page sends a small, first-party request to our own server recording only the page path, UTM parameters, the referrer, and your IP address hashed with a private salt (irreversible — we can never recover your real IP from it). It sets no cookies, reads no device fingerprint, and is never shared with anyone but us. Because it carries no cookie and identifies no one, we treat it as strictly necessary and it runs regardless of the cookie choice you make below — there is nothing to opt out of.

Meta Pixel (only with your consent). If you choose "Accept all" or switch on "Marketing (Meta Pixel)" in the cookie banner or in "Cookie settings" (in the footer of every page), we load Meta's Pixel script, which sets its own cookies and sends Meta your page views and, on a purchase or free-kit signup, a Lead/Purchase event (product, order value, and a browser/device identifier — never your email in plain text). Meta is an independent controller for the data it receives this way, under its own privacy policy. If you choose "Only necessary", or make no choice at all, none of this runs: no Pixel script loads, no Meta cookie is set, and no request is sent to Meta from your browser. You can change your choice at any time via "Cookie settings" in the footer, which reopens the banner and immediately stops the Pixel going forward if you withdraw consent.

Where you are changes the default. If you visit from the EU, the EEA, the UK or Switzerland, the Pixel stays off until you switch it on, as described above. If you visit from anywhere else (for example the United States), the Pixel is on by default and the banner tells you so, with a one-click "Opt out"; opting out takes effect immediately and is remembered in your browser. To know which applies, the page asks our own server for the two-letter country Cloudflare attaches to your connection — nothing else, no third party, not stored beyond your browser tab. If that lookup fails, we treat you as an EU visitor. We also honour the Global Privacy Control signal: if your browser sends it, the Pixel is never switched on by default.

Meta Conversions API (server-side, purchases and kit signups). Separately from the Pixel, our server also sends Meta a server-side confirmation when you complete a purchase (event name, order value, and your email hashed with SHA-256 — never sent in plain text) or sign up for the free kit, so Meta can measure ad performance even when a browser blocks cookies or scripts. This server-side event also includes your IP address and browser user-agent string, which Meta uses (alongside the hashed email) for match quality — never anything else about your device or browsing. This server-side event, IP address and user-agent included, is sent only if you accepted marketing in the cookie banner.

Browser storage

Alongside cookies, the site keeps a few small values in your browser's own storage, never sent to us except as noted elsewhere on this page:

• localStorage — sc_consent. Your cookie-banner choice (analytics/marketing on or off), so we don't ask again every visit.
• localStorage — sc_attribution. Which page and campaign you first arrived from, kept for 30 days, so an eventual purchase can be credited to the right source.
• sessionStorage. Your Prompt Vault add-on choice at checkout, cleared automatically when you close the tab.

Legal bases

• Contract — processing your purchase, delivering the product, and providing access, because you asked us to when you bought something.
• Consent — the free-kit welcome email sequence (opt in at /kit), and the Meta Pixel cookie (opt in via the cookie banner or "Cookie settings"), both withdrawable at any time.
• Legitimate interest — the first-party analytics beacon and rate-limiting, to keep the site secure and understand traffic, in a way that is proportionate and does not identify you.

Who else sees your data (processors)

We use a small number of processors to run Sundayclear, each bound by a data processing agreement:

• Stripe — payment processing.
• Resend — sending order, access, and kit emails.
• Cloudflare — hosting, the API worker, and the anonymous analytics beacon.
• Meta — the Meta Pixel (only if you consent) and the server-side Conversions API described above, each acting as an independent controller for the data it receives.

We do not use any other company to process your personal data. Tools we use for our own internal writing and content production do not receive or process customer data.

International transfers

Cloudflare, Stripe and Resend may process data outside the European Economic Area. Where that happens, it is covered by the EU Standard Contractual Clauses or an equivalent safeguard recognised under GDPR.

How long we keep it

• Orders — kept for 7 years, as required for accounting and tax records under Estonian law.
• Free-kit subscribers — kept until you unsubscribe or ask us to delete your data.
• Access tokens — the link used at /access works for 30 days and can be reused; each download URL inside it expires after 15 minutes.
• Analytics beacons — kept for up to 13 months.

Your rights

Under GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, for anything based on consent (such as the free-kit emails), without affecting processing done before the withdrawal.

How to exercise your rights

Write to support@sundayclear.com with your request. We'll respond within a reasonable time and may ask you to confirm the email address associated with your data first.

Complaints

If you believe we have mishandled your data, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or to the data protection authority in your own EU country, in addition to (or instead of) contacting us first.

Automated decisions

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

No sale of data

We do not sell personal data, and we do not run third-party ad-retargeting pixels beyond what is disclosed on this page.

Children

Sundayclear is not directed at, and is not intended for, anyone under 16.

Changes to this notice

We may update this notice as the product or our processors change. The version on this page is always current; material changes will be reflected in the "effective" date above.