Privacy Policy

Last updated: April 24, 2026

This is the Privacy Policy for Sunbrd LLC ("Sunbrd," "we," "us"). It covers both our marketing site at sunbrd.com and our product Sunbrd Gifts at gifts.sunbrd.com.

We wrote this in plain English on purpose. Privacy policies shouldn't require a law degree. If something here is unclear, email us at privacy@sunbrd.com and we'll explain it — or fix the wording.

The short version

• We collect the minimum data needed to run our product. Your email, the names and birthdays of people you want to gift, and whatever interest information you choose to share about them.
• We don't sell your data. Not to advertisers, not to data brokers, not to anyone.
• We don't track you across the web. No Google Analytics, no Meta pixel, no cross-site tracking.
• We share data only with service providers who help us run the product — and only the minimum they need.
• You can delete your account and data at any time by emailing privacy@sunbrd.com.

The rest of this page is the detailed version.

Who this applies to

This policy applies if you:

• Join our waitlist at sunbrd.com
• Create an account at gifts.sunbrd.com
• Receive a gift through Sunbrd Gifts from someone using our product
• Contact us via email or our website

What we collect

If you join our waitlist at sunbrd.com

We collect your email address. That's it. We use it to send you one welcome email and, eventually, to invite you to use Sunbrd Gifts when your spot in the waitlist opens up.

If you create a Sunbrd Gifts account

We collect:

• Account information. Your email address and password (stored as a hash — we never see your actual password).
• Your name and display preferences. So we can address you by name.
• Recipient information you add. The names, relationships, birthdays, addresses, email addresses, phone numbers, and interest information for the people you want to gift. Optionally: social media handles (Instagram, Twitter, Facebook, LinkedIn) if you choose to share them for richer AI personalization.
• Gift preferences and history. Which gifts you approved, which you rejected, how recipients rated what they received, your notes about past gifts.
• Account settings. Your budget limits, preferences, invite codes.
• Basic usage data. Page views and feature usage within the product, to understand what's working and what isn't. This stays with Sunbrd — we don't share it with third-party analytics tools.

If someone sends you a gift through Sunbrd Gifts

If a friend or family member uses Sunbrd Gifts to send you a gift card, we process:

• Your email address (to deliver the gift card)
• Your name (as provided by the giver)
• Any wishlist information you choose to share via the optional survey link we may send you

You do not have a Sunbrd account in this case, and we don't share your information with anyone beyond delivering the gift.

What we don't collect

We want to be explicit about what we don't collect, because the absence matters:

• We don't use third-party analytics. No Google Analytics, no Meta Pixel, no Mixpanel, no Amplitude.
• We don't use cookies for tracking or advertising. We use only strictly-necessary cookies (authentication session tokens). No marketing cookies, no behavioral targeting cookies.
• We don't store credit card information directly. Payment processing is handled by Tremendous (our gift fulfillment partner). Sunbrd sees the amount charged but not your card number.
• We don't scrape or infer data. Recipient interest information comes from you or from the recipient's own responses to our optional wishlist survey. We don't scrape social media, purchase data brokers, or infer interests from third-party sources.

How we use your data

We use the data we collect to:

• Run the product. Delivering gifts on time, sending approval notifications, personalizing suggestions — these are the core functions Sunbrd Gifts exists to perform.
• Personalize AI gift recommendations. Our AI (Anthropic's Claude) analyzes your recipient's interest profile to suggest gifts that fit them specifically. This analysis happens at the time of each gift selection cycle and is not used for any other purpose.
• Communicate with you. Transactional emails (gift approval requests, confirmations), product updates, and responses when you contact us.
• Improve the product. Looking at which features are used to decide what to build next. This analysis is always done at an aggregated level.
• Prevent fraud and abuse. Identifying and stopping fake accounts, payment abuse, and other platform misuse.

We do not use your data to:

• Sell or rent to advertisers or data brokers
• Build behavioral profiles for advertising
• Train AI models on your personal information (we use Anthropic's API in a mode that does not retain data for model training)
• Share with anyone beyond the service providers listed below

Who we share data with

Running a modern software product requires a handful of service providers. Here is every company we share any of your data with, and exactly what we share:

Infrastructure and storage

• Supabase (our database host). Stores all account and recipient data. Encrypted at rest and in transit. Supabase privacy policy.
• Vercel (our hosting provider). Serves our application; processes requests as you use the site. Does not retain personal data beyond request logs. Vercel privacy policy.

AI and gift selection

• Anthropic (provider of Claude, our AI engine). When generating a gift suggestion, we send the relevant recipient profile to Anthropic's API. Anthropic does not retain data from API calls for training or other purposes under their standard API terms. Anthropic privacy policy.

Email and communications

• Resend (our email delivery provider). Processes the email addresses we send transactional messages to. Resend privacy policy.
• ImprovMX (email forwarding for sunbrd.com addresses). Forwards email sent to sunbrd.com addresses to our personal inboxes. ImprovMX privacy policy.

Gift delivery and payments

• Tremendous (our gift card fulfillment partner). Receives recipient name, email, amount, and product selection to deliver each gift. Handles all payment processing. Tremendous privacy policy.

Address support

• Google Places API (address autocomplete). Receives the partial address text you type, returns suggestions. Queries are not associated with your account. Google privacy policy.

We have signed appropriate data processing agreements with each of these vendors. If you'd like to see the specific contractual terms, email privacy@sunbrd.com.

Retention: how long we keep data

• Waitlist email addresses. Until you ask us to delete it, or five years after you join (whichever comes first), after which we delete unused waitlist entries.
• Account data. For as long as your Sunbrd Gifts account is active.
• Gift history and ratings. For the life of your account, because this information powers personalization. You can request deletion of specific records.
• Deleted accounts. When you delete your account, we remove your personal data within 30 days. We retain anonymized aggregate data (e.g., number of gifts sent on our platform) indefinitely.
• Recipient profiles on closed accounts. When you delete your account, the recipient profiles you created are deleted too.

Your rights

Regardless of where you live, you have the following rights:

• Access. You can ask us what data we have about you. Email privacy@sunbrd.com and we'll send you a copy.
• Correction. You can correct any inaccurate information directly in your account settings, or by emailing us.
• Deletion. You can delete your account and all associated data by emailing privacy@sunbrd.com.
• Portability. You can request an export of your data in a standard format.
• Opt-out of communications. Every non-transactional email we send has an unsubscribe link. Transactional emails (gift approvals, account security notifications) are part of the service and cannot be unsubscribed from, but you can close your account to stop all emails.

We respond to privacy requests within 30 days. There's no cost, and we'll never require you to justify the request.

If you're in California

California residents have additional rights under the CCPA, including the right to know the specific categories of personal information we collect, the right to request deletion, and the right to non-discrimination for exercising your rights. We extend these rights to everyone, so you don't need to be in California to use them.

If you're outside the United States

Sunbrd Gifts currently serves users in the United States. If you access the service from outside the US, your data will be processed in the US. By using Sunbrd Gifts, you consent to this transfer.

Security

We take security seriously because we're holding personal data about the people you care about most — your family and friends.

• All data is encrypted in transit (HTTPS/TLS) and at rest
• Passwords are hashed using modern cryptographic standards
• Database access is restricted by row-level security rules that enforce user isolation
• We regularly update our dependencies to patch security vulnerabilities
• We don't store payment card data directly

No system is perfectly secure. If you discover a security issue, please email security@sunbrd.com — we take reports seriously and will respond quickly.

Children

Sunbrd Gifts is not intended for children under 13. We don't knowingly collect data from children under 13. If you believe a child has created an account, email privacy@sunbrd.com and we'll delete it.

Recipients of gifts may be children (a gift for a nephew's birthday, for example), but in those cases, the account holder — the adult giver — is the one interacting with our service. The child's name and birthday are collected only to personalize the gift and are covered by the same protections as all other data.

Changes to this policy

When we change this policy in meaningful ways, we'll email active account holders and post a notice on the site. Minor wording changes may happen without notification. The "Last updated" date at the top of the page will always reflect the most recent revision.

Contact

For anything related to your data or this policy:

Email: privacy@sunbrd.com Mail: Sunbrd LLC, Connecticut, USA (exact address available on request)

We aim to respond to all privacy inquiries within 3 business days.