Privacy policy

What stays in your browser

The report linter and the theme generator read your files in the browser. A .pbip project, a theme JSON or a logo you open in those tools is never uploaded to us. What we store is what you choose to save into your workspace, plus the audit findings and scores if you save a report — never the report file itself.

What we store

When you have an account:

• your email address and, if your sign-in provider gives them, your name and avatar;
• your workspace: its name, address and plan;
• what you make: visual designs, themes, DAX SVG measures, templates, brands and saved audit results;
• export records: which design, which version, when and how large — used for your monthly quota;
• subscription records from the payment provider: plan, status, seat count and renewal date. Card details never reach us;
• technical records needed to run the service, such as error logs.

Cookies and browser storage

We use no advertising or tracking cookies, and our analytics is cookieless. What we do keep on your device is listed below. The two attribution items (bi_ref and bistudio:source) are only written after you choose "Allow attribution" in the bar at the bottom of the page; until then, and if you choose "No thanks", neither is stored. You can change your choice at any time with "Cookie choice" at the bottom of every page.

• sign-in cookies (sb-…): keep your session while you are signed in; removed when you sign out;
• lang: remembers whether you chose English or Turkish; 1 year;
• locale_set: remembers that you made that choice yourself, so the language suggestion bar does not come back; 1 year;
• market: the region whose prices you chose to see; 1 year. The price you actually pay is still set by your billing country;
• consent: remembers your answer in the attribution bar (attribution or none), so we don't ask again; strictly necessary, 12 months;
• bi_ref: only with your consent — if you arrive through a friend's referral link, the referral code, so both of you can get the reward when you sign up; 30 days, deleted once it has been read after sign-up. Without consent the code travels in the sign-in link's address instead and nothing is stored;
• bistudio:source (browser storage, not a cookie; only with your consent): the address of the first page you opened on our site, without query string or referrer, written to your account once when you sign up and then deleted. It tells us which free tool brought you here.

Where it is stored

Our database and file storage are hosted by Supabase in the European Union (Frankfurt). The application runs on Cloudflare's network. For users in Türkiye this means a transfer abroad under KVKK, and the transfer conditions in KVKK Article 9 apply.

Who we share it with

Only the processors we need to run the service:

• Supabase — database, file storage and sign-in (EU);
• Cloudflare — hosting, network protection and cookieless analytics;
• our payment provider — subscriptions, invoices and VAT, acting as merchant of record;
• our email provider — sign-in codes, invitations and account notices.

Who at Sunsato can see it

Our support panel shows plan, usage counts and account details. It does not show what you made: design contents, theme settings, brand assets and audit findings are not readable from it. If support genuinely needs to see one, we ask you first and record that we did.

How long we keep it

Deleted documents sit in the trash for 30 days and are then removed for good. If you delete your account we remove your personal data and your workspace content; backups roll off within 30 days. Records we must keep for tax and accounting are kept for the period the law requires.

Your rights

You can ask what we hold about you, correct it, have it deleted, or take it with you. Account settings let you export your whole workspace as JSON and delete your account without asking us. For anything else, write to privacy@sunsato.com; we answer within 30 days, and within the shorter period KVKK requires where it applies.

Contact

Sunsato · info@sunsato.com. Privacy requests: privacy@sunsato.com. Security reports: security@sunsato.com.