sunary.

Legal

Privacy Policy

Last updated: October 2026

This policy explains how Sunary uses personal data. It covers the public website at sunary.io and the signed-in Sunary application you open from that website.

Who we are

Sunary is operated by Mirooz SRL, a Belgian private limited company (société à responsabilité limitée), Rue de la Longue Haie 4, box 11, 1000 Brussels, Belgium. Company number (BCE / KBO): 1002.557.851. VAT number: BE1002557851. Mirooz SRL is the controller of the personal data described here.

Mirooz SRL has not appointed a data-protection officer. For privacy requests, email support@sunary.io or write to Mirooz SRL at the address above.

Data we collect

Depending on how you use Sunary, we process:

  • Account information. Your login email address, the time the account was created, and the time of the last sign-in. If you set a password, we store a protected form of that password, not the password itself. If you sign in with Google, we also receive the name Google provides and the Google account identifier needed to recognize the same account. Google sign-in does not open your mailbox. Microsoft is used to connect a mailbox, not to create the Sunary account.
  • Profile information. Details you add in the app, such as your name, the email address printed on your CV, phone, location, website, date of birth, profile photo, target role, and reply preferences (for example your rate, availability, work mode, and how you like replies to be written).
  • Connected mailbox. The provider (Google or Microsoft), the mailbox address, whether you granted permission to send, and the time you connected or disconnected it. While the mailbox stays connected, we store the access and refresh tokens that provider issued, so the connection can continue. Those tokens are removed when you disconnect.
  • Recruiter emails and opportunities. For a message that is kept as an opportunity, we store the sender, subject, message body, date, and the details extracted from it, such as role, location, rate, skills, and summary. Inline images needed to display that message may be stored with it. Messages that are not opportunities are not added to your workspace. For those, we keep only an identifier of the conversation, not the message body, so the same conversation is not presented again as a new opportunity. That identifier is removed when you disconnect the mailbox.
  • Content you add yourself. An opportunity you create, a LinkedIn message you paste, or a job link you submit, together with the fields extracted from it.
  • Sender lists. Addresses you hide, and addresses you mark so their mail is always treated as an opportunity.
  • CVs and CV-related information. The CV you upload, the versions you save or export, and the information extracted from it, such as summary, experience, education, languages, and skills.
  • AI-assisted content. Analysis of opportunities, CV suggestions, and reply drafts produced for you. A reply is sent only when you choose to send it.
  • Technical records of AI use. That a feature ran, when it ran, whether it succeeded, and token counts. The text you submitted is not stored in that record.
  • Sign-in storage. A session token kept in the browser so you stay signed in, and short-lived cookies used only to complete Google or Microsoft sign-in and mailbox linking. The Cookie Policy names each one.
  • Cookie choice. Whether you allowed analytics or marketing on the public website.
  • Website usage. Only if an analytics or marketing provider is configured on that deployment and you consent. No such provider is configured on the current website. The Cookie Policy is the list of what is actually on.
  • Payment. If you subscribe, Stripe processes the payment. Sunary stores the customer and subscription identifiers Stripe returns, the plan, the status, and the relevant dates. Sunary does not store your card number. The app can show the card brand and last four digits that Stripe returns, so you can recognize the payment method.

Why we process it

We use this data to:

  • provide and operate Sunary
  • create your account and authenticate you
  • connect a mailbox you authorize and keep it in sync
  • detect and organize recruitment opportunities from that mailbox, or from content you add
  • compare an offer with your CV, and help you adapt that CV
  • prepare AI-assisted analysis and reply drafts, and send a reply when you ask
  • keep the service secure and reliable
  • remember your cookie choice on the public website
  • understand how visitors use the website, if you consent to analytics and a provider is configured
  • take payment for a subscription, through Stripe

Legal bases

  • Contract. We process account, profile, mailbox, opportunity, CV, and billing data to provide the Sunary service you asked for.
  • Consent. Connecting a mailbox is something you authorize, and you can withdraw it by disconnecting the mailbox. On sunary.io, analytics and marketing run only if you opt in and a provider is configured. You can withdraw that choice at any time in Cookie Settings. The essential cookie that remembers the choice stays on.
  • Legitimate interests. We process limited technical data, including the AI usage record described above, to keep the service secure, to prevent misuse, and to understand whether the product is working. These interests do not override your rights.
  • Legal obligation. We process data when the law requires us to keep or disclose it, including payment records that accounting rules require us to keep.

Google permissions

Sunary asks Google only for the permissions below.

  • Sign in with Google. openid, profile, and email. Used to create or open your Sunary account. This does not include access to Gmail.
  • Connect Gmail. The same sign-in permissions, plus https://www.googleapis.com/auth/gmail.readonly. Used to read the connected mailbox so Sunary can find recruitment opportunities and show those conversations. Sunary does not request permission to change or delete Gmail messages.
  • Send from Gmail. https://www.googleapis.com/auth/gmail.send, requested only when you choose to send a reply. The message leaves from your Gmail account only after you choose to send it. Until you grant this permission, Sunary can prepare a draft in the app and cannot send it through Gmail.

Gmail data is used to provide the mailbox, opportunity, CV comparison, and reply features that are visible in the application. Sunary does not use Gmail data to serve advertisements, and it does not sell that data. Sunary does not use it to determine creditworthiness or for lending.

Microsoft permissions

When you connect Outlook or Hotmail, Sunary requests permission to read that mailbox. A separate write permission is requested only when you choose to send a reply.

  • openid, profile, and email, to identify the account
  • offline_access, so the connection can continue without a new sign-in on every sync
  • User.Read, to read the basic profile of the Microsoft account you connect
  • Mail.Read, the read permission. Sunary uses it to read mail, find recruitment opportunities, and show those conversations. It does not change or delete the messages already in the mailbox.
  • Mail.Send, the write permission. Sunary requests it when you click Send, not when you only connect the mailbox. The reply leaves from your mailbox only after you choose to send it. A reply without an attachment is sent directly. A reply with an attachment is first written as a draft in that mailbox, then sent. This permission does not edit or delete the other messages in the mailbox.

Microsoft mailbox data is used for the same product features as Gmail data. Sunary does not use it for advertising and does not sell it.

Google API Services User Data Policy (Limited Use)

Sunary's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In this product, that means:

  • Google user data is used to provide or improve the user-facing features described in this policy: sign-in, reading a mailbox you connect, showing recruitment opportunities, comparing them with your CV, and preparing or sending a reply you choose.
  • Content needed for an AI feature you use may be sent to OpenAI, as described below. The application is hosted by Railway. Those are the transfers required to provide the features. Sunary does not transfer Google user data to advertising platforms or data brokers.
  • Sunary does not use Google user data for serving ads, including retargeting, personalized, or interest-based advertising.
  • The application shows mailbox content to the signed-in user. It has no feature for browsing another customer's mailbox.

AI processing

Some features need an AI provider. When you use them, Sunary sends the content needed for that feature to the provider through its API. That content can include a recruiter email, opportunity information, CV content, a message or job posting you pasted, and the context of a reply. The features are classification of a message, extraction of the useful details, comparison and review of a CV, and a reply draft.

The current provider is OpenAI. OpenAI states that data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in. The Sunary application does not send a request to opt in. OpenAI also states that, by default, abuse-monitoring logs may retain API inputs and outputs for up to 30 days, unless a separate retention arrangement applies. Sunary does not claim that a zero-retention arrangement is in place. Those statements are OpenAI's published rules. They are described in OpenAI's API data controls and its business data information.

This processing prepares information for you. It does not take a decision that produces a legal effect, or a similarly significant effect, about you. You choose whether to reply, apply, or change your CV.

Disconnecting a mailbox

You can disconnect a mailbox in Settings. Sunary then stops the sync, deletes the tokens, and removes the opportunities, messages, and inline images that came from that connection, together with the identifiers of conversations already reviewed. Opportunities you added yourself stay. Connecting the same address again starts a new scan. Your profile and CV remain until you change them or the account is erased.

The record that this address was connected, including the time you disconnected it, remains on the account until the account is erased.

You can also withdraw the permission from your Google Account or from your Microsoft account. Once the token no longer works, Sunary cannot read new mail. That withdrawal does not by itself run the deletion that Disconnect performs in the app.

Service providers

We use the following providers to operate Sunary. They process data for the role described here.

International transfers

Google, Microsoft, OpenAI, Stripe, and Railway may process personal data outside the European Economic Area, including in the United States. The product does not select a storage country. Where a transfer requires a safeguard, it is the mechanism stated in that provider's terms. This policy does not promise that every copy of the data stays in the European Economic Area.

Data retention

We keep your account, profile, CV, sender lists, and opportunity data for as long as the account exists. The product does not set a shorter automatic expiry for that data.

If you disconnect a mailbox, we stop accessing it and delete the mailbox data described in “Disconnecting a mailbox”. The connection record for that address stays until the account is erased.

The technical AI record does not include the text sent to the model. The product does not set an automatic deletion date for that record.

The sign-in token in the browser lasts 30 days, or until you log out. The short-lived sign-in cookies last from 2 to 10 minutes. The website consent cookie lasts 180 days. Details are in the Cookie Policy.

Invoices and the other accounting records of a payment are kept for seven years. That is the period set by the Belgian Code of Economic Law for accounting books and supporting documents. This policy does not state a separate period for backups, because the product does not define one.

Data you must provide

An account needs an email address, and either a password or Google sign-in. You can use the trial without a card, without connecting a mailbox, and without uploading a CV. A paid plan needs a payment method, which you enter on Stripe’s page. Without a mailbox, Sunary cannot read recruitment emails. Without a CV, Sunary cannot compare an offer with it.

Security

The public website and the application are served over HTTPS. If you set a password, we store a protected form of it, not the password itself. Mailbox tokens are removed when you disconnect that mailbox. No online service can guarantee absolute security.

Your rights

Under the GDPR, you can ask us to:

  • access the personal data we hold about you
  • correct inaccurate data
  • erase data, by writing to us
  • restrict processing in the cases the law provides
  • object to processing based on legitimate interests
  • receive a copy of the data you provided, in a commonly used electronic format
  • withdraw consent, where processing is based on consent, without affecting processing that took place before

You can also lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be.

Account erasure and data requests

You can edit your profile in the app. There is no erase-account action in the application. To erase your account and the personal data Sunary holds for it, email support@sunary.io. We then delete the account and the personal data held for it in the service, including your profile, CV, mailbox connection, and opportunities. Erasure is separate from cancelling a paid subscription, which stops the plan and leaves the account in place.

For any other privacy or data request, email support@sunary.io or write to Mirooz SRL, Rue de la Longue Haie 4, box 11, 1000 Brussels, Belgium. We reply within one month. If a request is complex, we may take up to two further months, and we will tell you during the first month.

Cookies

sunary.io uses an essential cookie to remember your choice for 180 days. Analytics and marketing stay off unless you opt in, and they are not loaded before that consent. No analytics or marketing provider is configured on the current website, so opting in does not load a tracker until one is configured. You can change or withdraw the choice with Cookie Settings in the footer. The Cookie Policy lists each technology that is actually in use.