Privacy policy

We collect your email so we can tell you when SunBreak opens. If you use the product, we hold the business information you put in it: your staff and their hours, shifts and time off, clock-ins, tasks, messages your team sends each other, your stock and the supplier invoices you scan, and — only if you connect it — daily sales totals from your point of sale. We use AI to read that information and answer your questions about it. We do not sell your data, we do not run ad trackers, and you can ask us to delete everything at any time.

The rest of this page is the detail behind that.

This site and the SunBreak product are operated by Leo Herbold and Eli Konarski, the cofounders of SunBreak, together (SunBreak, 11 Apex Drive, Suite 300A #373, Marlborough, MA 01752, United States). "We" and "us" in this policy mean the two of them. For anything about your data, write to hello@usesunbreak.com. If you are in the EEA or the UK, we act as joint data controllers for the information described here, and you can raise any request with either of us at that address.

We collect four kinds of information, and no more than that.

• What you give us. Your email address when you join the early access list. If you become a customer: your name, business name, phone number, billing details, and the operational information you enter or upload, which can include schedules, staff records and hours, tasks, stock levels, supplier invoices you photograph, and notes.
• Employee and roster data. If you use SunBreak as an employer, you enter operational details about your team: employee names, emails, phone numbers, shift schedules, and hourly pay rates. This information is entered by the employer and is used exclusively to generate schedules, track attendance, and run team operations.
• What your device sends. When you load a page we receive your IP address, browser type, and the page you came from. Our analytics provider records page views, referrer, approximate country, and device type in aggregate. It does not use cookies, does not follow you across other websites, and does not build an advertising profile of you.
• What the product records. If you use SunBreak, we log account activity such as sign in times, what changed and when, and errors. This is how we keep the account secure and fix things that break.

We do not ask for and do not want government ID numbers, health information, or precise location. Please do not put that kind of information into the product.

• To run the product. Building your schedule, keeping track of hours and tasks, and answering your questions about your own business.
• To contact you. Early access news, service notices, billing messages, and answers to support requests. Every marketing email has an unsubscribe link that works. Service and billing notices are not marketing and we will still send those while you have an account.
• To keep it working and secure. Debugging, preventing abuse, and understanding which parts of the site people use.
• To meet legal obligations. Tax records, and responding to lawful requests.

If you are in the EEA or the UK, our legal bases are: performing our contract with you (running the product and billing), your consent (marketing email, which you can withdraw at any time), and our legitimate interests (security, measurement, and improving the product).

SunBreak uses artificial intelligence. This is central to how it works, so we want to be direct about it.

• What the AI sees. To answer your questions, the business information in your account is sent to third party AI model providers for processing. That can include your roster and schedule, tasks, stock, and the contents of files you upload.
• Training. We do not use your business data to train our own models, and we contract with our AI providers on terms that prohibit them from training their models on data we send through their business APIs. If that ever changes, we will tell you before it takes effect, not after.
• Human review. A small number of records may be reviewed by our staff when you report a problem, or to investigate suspected abuse. Access is limited to the people who need it and it is logged.
• AI is not always right. The brief is a summary produced by a model. It can miss things and it can be wrong. It supports your judgment. It does not replace it, and it is not legal, tax, financial, or safety advice.
• No automated decisions about you. We do not use AI to make decisions with legal or similarly significant effects on you, such as credit or employment decisions.

We do not sell your personal information, and we do not share it for cross context behavioral advertising. Under laws that use those terms, including the California Consumer Privacy Act, we do not sell or share personal information.

We do use a small set of vendors to run the service. They process data only on our instructions, under contract:

• Vercel. Website and application hosting, plus cookieless analytics and performance measurement.
• Formspree. Receives and stores the early access form submissions from this site.
• AI model providers. Process account content to generate briefs and summaries, as described above. Our current provider is Anthropic.
• OpenStreetMap. Business address lookups during setup and location settings are queried against OpenStreetMap (Nominatim) to resolve state labor law requirements. Address queries are lookups only and are not stored by OpenStreetMap.
• Supabase. The product's database, sign in, and file storage. It holds your account and the business information you put into SunBreak: staff records and hours, schedules, tasks, team messages, stock, and the files you upload.

We will also disclose information if we are legally required to, or to protect our rights or someone's safety. If our business is ever sold or merged, your information may transfer as part of it, and this policy will continue to apply until we tell you otherwise.

Our vendors are primarily in the United States. If you are in the EEA or the UK, that means your information is transferred there, under Standard Contractual Clauses or an equivalent approved mechanism.

This marketing site sets no advertising or analytics cookies. Our analytics is cookieless and counts visits in aggregate. If you sign up, the email address you entered is kept in your browser for that tab only, so a follow-up answer on the confirmation page can be matched to your signup. It is cleared when you close the tab.

The product itself uses a strictly necessary cookie to keep you signed in. There is nothing on this site to opt out of, because there is no tracking to opt out of. If that ever changes, you will see a real consent choice before anything loads.

Files you upload, such as photos of invoices, receipts, and paperwork, are stored in private storage. They are not publicly readable, they are not listed in any public index, and they are only reachable through short lived links issued to your signed in account.

Profile photos are the exception. So your team can see them, a profile photo can be viewed by anyone who has its link, though the link is not published or listed anywhere. Only you can change or remove your own photo, and you can remove it at any time.

Delete a file in the product and we remove it from active storage immediately and from our backups within 30 days. Close your account and we delete your uploads and account content within 30 days, except anything we are legally required to keep, such as billing records.

• Early access emails: until you unsubscribe or ask us to delete them, or until we shut the list down.
• Account and business data: for as long as your account is open, then 30 days after you close it.
• Billing records: as long as tax and accounting law requires, usually seven years.
• Security and error logs: up to 12 months.

Data is encrypted in transit and at rest. Storage is private by default. Access by our staff is limited to the people who need it for a specific reason and is logged. No system is perfect, and we will not pretend otherwise: if a breach affects your personal information, we will notify you and the relevant regulator within the time the law requires.

Wherever you live, you can ask us to show you the personal information we hold about you, correct it, delete it, send you a copy in a portable format, or stop using it for a particular purpose. You can unsubscribe from marketing email at any time.

Email hello@usesunbreak.com and we will respond within 30 days. We will not charge you for it and we will not treat you differently for asking. You may authorize someone else to make the request for you. If you are in the EEA or the UK you also have the right to complain to your local data protection authority.

SunBreak is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete it.

We will update this page when what we do changes. The date at the top always reflects the current version. If a change materially affects how we handle your information, we will email you before it takes effect.

Leo Herbold and Eli Konarski
SunBreak, 11 Apex Drive, Suite 300A #373, Marlborough, MA 01752, United States
hello@usesunbreak.com