Privacy Policy

Who we are and the roles we have

Sundream is a service operated by Smith & Johnson, Inc., a Delaware corporation. You can reach us at support@sundream.studio or by post at Smith & Johnson, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

This Privacy Policy explains how Sundream collects, uses, discloses, and protects personal information when you visit our website, create an account, join a team workspace, upload creative materials, generate AI media, or contact us for support. Our Cookie Notice provides additional detail about browser storage and tracking technologies.

Smith & Johnson, Inc. is the controller for personal information we use for our own purposes, including account administration, billing, security, support, service analytics, and legal compliance. When a business or other customer puts personal data into a workspace and directs us to process it through the service, that customer is the controller and Smith & Johnson, Inc. acts as its processor or service provider. Our Data Processing Addendum governs that customer-directed processing where applicable.

Information we collect

• Account and profile information, such as your email address, username, authentication identifiers, team membership, account settings, and, if you choose Google sign-in, the profile information Google makes available according to your Google settings.
• Creative workspace content, such as scripts, prompts, shot descriptions, cast details, reference media, uploaded files, generated outputs, and project history.
• Voice data, such as recorded or uploaded voice samples, cloned or designed voice profiles, provider voice identifiers, preview audio, consent or permission confirmations, and provenance metadata. Depending on the processing and applicable law, voice data may be treated as biometric or sensitive personal information.
• Usage, device, and online-activity information, such as IP address, browser and device type, operating system, language settings, referring page, pages or screens viewed, access times, feature activity, approximate location derived from IP address, and diagnostic events.
• Billing and commercial information, such as plan selection, invoices, payment status, credit transactions, tax information, and limited payment metadata from our payment processor. We do not store full payment card numbers.
• Assistant conversations: when you chat with the Sundream assistant, we store the conversation — your messages, the assistant's replies, and the actions it performed — linked to your account and workspace.
• Preference and consent information, such as theme and workspace preferences, cookie and analytics choices, and records showing which version of our legal terms you accepted.
• Support communications, including messages, attachments, and information needed to resolve requests.

Where information comes from

We collect information directly from you; from workspace owners, administrators, and collaborators; automatically from your browser, device, and use of Sundream; and from service providers such as Google when you choose Google sign-in, Stripe for billing, and our analytics, security, hosting, and AI providers. Workspace content may contain information about people who do not have Sundream accounts. The customer or user who submits that content is responsible for providing any required notice and having an appropriate legal basis or permission.

How and why we use information

• Provide, secure, troubleshoot, maintain, and improve Sundream.
• Authenticate users, maintain sessions, manage team workspaces, and preserve project state.
• Send prompts, references, and related project context to AI, storage, hosting, database, authentication, and infrastructure providers as needed to operate requested features.
• Create and store generated media, including cloning a voice from a sample when an authorized user requests it, synthesizing speech, and preserving the sample and provider identifiers needed to reuse or rebuild the voice.
• Communicate about product updates, account issues, security notices, and support requests.
• Analyze product reliability and usage patterns — including reviewing stored assistant conversations — so we can improve workflows, assistant quality, and performance.
• Detect, investigate, and prevent fraud, security incidents, prohibited content, rights violations, and other abuse; enforce our Terms and AI Safety Policy; and protect users, Sundream, and the public.
• Comply with law, respond to lawful requests, establish or defend legal claims, and keep required business records.
• Create aggregated or de-identified information for lawful analytics, reliability, safety, and service-improvement purposes. We do not attempt to re-identify de-identified information except to test whether our de-identification process works or as permitted by law.

Legal bases for processing

Where the GDPR, UK GDPR, or a comparable law requires a legal basis, we rely on the bases below. The basis depends on the information and why we use it.

• Contract: to create and administer your account, provide workspace and generation features you request, process payments, and deliver support connected to the service.
• Legitimate interests: to secure and operate Sundream, prevent fraud and abuse, diagnose failures, understand service performance, improve product reliability, and establish or defend claims, where those interests are not overridden by your rights.
• Consent: where required for analytics or session replay, marketing communications, or particular uses of voice or other sensitive data. You may withdraw consent prospectively at any time, although another legal basis may still apply to necessary processing.
• Legal obligation: to comply with tax, accounting, sanctions, law-enforcement, regulatory, and other obligations that apply to us.

AI processing, voice cloning, and model training

When you request generation, analysis, speech, or voice cloning, Sundream transmits the prompts, scripts, references, voice samples, generated media, and project context needed for that request to the AI provider identified on our Subprocessors page.

We do not use private customer workspace content, assistant conversations, or voice samples to train Sundream-owned foundation models or authorize our AI subprocessors to train general-purpose models on that content, unless the affected customer expressly opts in or we enter a separate written agreement that says otherwise. Providers may retain submitted data for the limited service-operation, security, and abuse-monitoring periods described by their applicable business or API terms.

You may clone a voice only if it is your voice or you have valid permission and any legally required consent from the person whose voice it is. A confirmation in the product records the user's representation of permission; it does not transfer another person's rights or replace notice or consent required by law.

How we share information

We publish the third-party services that process customer data on our behalf, what each handles, and where, on our Subprocessors page.

• Service providers and subprocessors that help us run hosting, storage, databases, authentication, analytics, billing, support, security, AI generation, speech synthesis, and voice cloning.
• Workspace members on your team, according to your role, permissions, and project-sharing choices.
• Third parties you direct us to interact with, such as Google when you choose Google sign-in or an AI provider when you select and invoke a provider-powered feature.
• Professional advisors, regulators, law enforcement, or courts when legally required or necessary to protect rights, safety, and security.
• Successors in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

Cookies and similar technologies

We use necessary cookies and local browser storage to keep you signed in, remember workspace preferences, route you to the right team, record legal and analytics choices, and secure the application. Our Cookie Notice describes these technologies, their providers, and your controls in more detail.

With your consent where required, PostHog provides product analytics, error monitoring, and session replay. Session replay can capture how you move through and interact with the interface. We mask form-input values, but other text rendered in the interface may appear in a replay. Without analytics consent, we limit collection to error diagnostics without a persistent analytics identifier. You can withdraw analytics consent prospectively by clearing the Sundream site data in your browser or contacting us.

Sundream does not currently use advertising cookies. If we add advertising, retargeting, or cross-context behavioral advertising technologies, we will update this policy and provide legally required choices.

Retention and deletion

Account, workspace, project, assistant-conversation, uploaded-media, generated-media, voice-sample, and cloned-voice records are kept while the relevant account or workspace is active and until the user or authorized workspace owner deletes them, subject to the account-erasure process below. A provider may keep a voice identifier or request data for its limited operational retention period; our Subprocessors page identifies the provider.

Security, fraud, generation, and diagnostic logs are kept on a rolling basis for the shortest period reasonably needed to investigate reliability, billing, safety, and security events. A record connected to an incident, dispute, or legal obligation may be kept until that matter and the applicable limitation period end.

Support communications are kept while a request is open and afterwards for continuity and dispute resolution. Contract, consent, and Terms-acceptance records are kept for the account term and the period reasonably needed to establish the parties' agreement. Stripe retains invoices and transaction records for tax, accounting, fraud-prevention, and payment-network requirements.

You can delete your account yourself from Settings. Deleting cancels your subscription immediately and schedules erasure 30 days later; during that window you can cancel the request and keep your account. The delay exists so a mistaken or unauthorised deletion can be undone. Closing your account instead deactivates it and retains your content.

When the erasure runs we permanently delete your account record, workspaces you solely own, projects, uploaded references, voice samples, cloned-voice records, and generated media, including the underlying files in active storage. It cannot be reversed afterwards. Residual backup copies are isolated from ordinary use and overwritten on their normal rotation.

Limited records may survive erasure where law requires retention or where reasonably necessary to prevent fraud, document consent or a contract, resolve a dispute, enforce our agreements, or protect legal rights. We restrict those records to those purposes and delete or de-identify them when the reason for keeping them ends.

We may retain aggregated or de-identified information that can no longer reasonably be linked to you. When deciding a retention period, we consider the amount, nature, and sensitivity of the information, the purposes for which it is used, the risk of harm from unauthorized use or disclosure, whether those purposes can be achieved another way, and applicable legal requirements.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including authentication, access controls, transport security, logging, and vendor review. No online service can guarantee perfect security, so you should protect your credentials and promptly report suspected account compromise.

Your privacy choices and rights

• You may access, update, export, or delete certain account and workspace information through the product where available.
• You may request access, correction, deletion, portability, restriction, or objection by emailing support@sundream.studio. You may use an authorized agent where applicable; we may ask for proof of authority and may verify your identity before acting.
• You may opt out of marketing emails by using unsubscribe links or contacting us.
• Depending on your location, including California, Colorado, Connecticut, Virginia, Utah, the EEA, the UK, and other jurisdictions, you may have additional rights to know categories and sources, withdraw consent, limit certain uses of sensitive information, opt out of targeted advertising or profiling, or appeal a denied request. To appeal, reply to our decision or email us with the subject “Privacy appeal.” We will not discriminate against you for exercising applicable rights.
• You may complain to the data-protection regulator where you live or work. EEA and UK residents may also contact their competent supervisory authority.
• Sundream does not sell personal information or share it for cross-context behavioral advertising as those terms are defined by California law, and did not do so during the preceding 12 months. We do not use personal information for targeted advertising. If that changes, we will update this policy before the new processing starts and provide legally required opt-out controls, including support for applicable browser preference signals.

U.S. state privacy notice

This section applies to residents of U.S. states whose privacy laws apply to Sundream. Those laws use terms such as personal data, personal information, sensitive data, sale, and targeted advertising in specific ways, and not every right applies in every state or circumstance.

During the preceding 12 months, we collected the categories described in Information we collect from the sources described in Where information comes from; used them for the purposes described in How and why we use information; and disclosed them for business purposes to the categories described in How we share information. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not have actual knowledge that we sell or share personal information of anyone under 16.

Voice data, precise content about an identifiable person, account credentials, and other information you choose to submit may be treated as sensitive personal information under some laws. We use sensitive information only to provide requested features, secure the service, comply with law, and for other purposes permitted without a right to limit. We do not use sensitive information to infer characteristics about you for advertising.

• Depending on applicable law, you may request the categories and specific pieces of personal information we hold, the categories of sources and recipients, access, correction, deletion, portability, restriction, or an appeal of a denied request.
• Submit a request at support@sundream.studio. Describe the right you want to exercise and the account or information involved. We may ask for information reasonably necessary to verify your identity, residency, or authority, and we will use verification information only for that purpose.
• An authorized agent may submit a request where applicable. We may ask the agent for proof of authority and may ask you to confirm the request directly unless a valid power of attorney or applicable law provides otherwise.
• To appeal a denial, reply to our decision or email us with the subject “Privacy appeal.” We will not discriminate against you for exercising an applicable privacy right.
• Sundream does not use personal information for automated decision-making that produces legal or similarly significant effects, such as decisions about employment, housing, credit, insurance, education, healthcare, or access to essential services.

Other sites and services

Sundream may link to or integrate with websites and services operated by third parties. A link or integration is not an endorsement, and this Privacy Policy does not govern a third party's independent handling of information. Review the privacy terms of a third-party service before using it.

Children

Sundream is not directed to children. You must be old enough to create a binding account under our Terms of Service, and at least 18 unless a separate agreement allows otherwise. We do not knowingly collect personal information from children. If you believe a child provided personal information in violation of this rule, contact support@sundream.studio so we can investigate and take appropriate action.

International transfers

We process information in the United States and in other countries where our service providers operate. Those countries may have privacy laws different from the laws where you live.

For restricted transfers from the EEA, we use the European Commission Standard Contractual Clauses, normally Module Two where a customer is the controller and Module Three where a customer is itself a processor. For UK transfers, we use the UK International Data Transfer Addendum; for Swiss transfers, we apply the Swiss variations described in our Data Processing Addendum. The DPA incorporates those safeguards and our Subprocessors page identifies relevant locations. Contact us to request a copy, subject to necessary redactions.

Changes to this policy

We may update this Privacy Policy as the service, providers, and law change. We will update the date above and give notice through the service or by email when a change materially affects how we use personal information or your rights. Where consent is required for a new use, we will request it before that use begins.

Contact

Questions or requests about this Privacy Policy can be sent to support@sundream.studio, or by post to Smith & Johnson, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States. We may need to verify your identity before completing certain requests.