Privacy Policy
This policy explains what information SuNodes collects when you use sunodes.com and app.sunodes.com (the “Service”), how we use it, and the choices you have. The Service is operated by Tavri, Inc., a Wyoming corporation (“we”, “us”), which is responsible for your information.
Information we collect
- Account information: your name, email address and a securely hashed password. If you sign in with Google, we receive your name, email address and Google account ID.
- Domain registrant details: the name, address, phone number and email you provide so domains can be registered in your name, as required by ICANN.
- Content you create: brand details, logos and images you upload, and the websites you build and publish.
- AI requests: the prompts, site content and images (such as photos you upload and previews of your designs) sent to an AI model to research your business, design, generate and edit your site, and choose images.
- Your existing website: if you point us to it, we fetch its public pages and images to learn about your business and reuse your own content.
- AI API keys: if you bring your own key, it is stored envelope-encrypted (a unique AES-256-GCM key per secret, wrapped by a master key kept outside our database), decrypted only in memory when making requests on your behalf, and never shown again.
- Payment information: payments are processed by Stripe. We do not receive or store your full card number.
- Visitor messages: messages submitted through contact forms on sites you publish are stored for you to read in your dashboard.
- Design feedback: if you share a design preference test link, the answers people give on it are stored for you to see. We don’t ask them to sign in.
- Reactions to design references: when you react to example websites we show while designing your site, we keep your reaction (for example “like” or “not for me”), the design qualities you liked or disliked, any comment you write, and the kind of business the site is for.
- Usage events: which features you use and how your projects progress (for example, that a design was chosen or a site published), used to run and improve the Service.
- Technical data: IP addresses and request logs, used for security, abuse prevention and rate limiting.
How we use information
- To provide the Service: building, hosting and publishing your website, and registering and configuring your domains.
- To process payments and prevent fraud and abuse.
- To keep the Service secure and reliable.
- To contact you about your account, domains and important changes.
- To improve the design examples we suggest to everyone, using anonymous, aggregated reactions (for example, that restaurant owners often like a particular site’s photography).
We do not sell your personal information.
Service providers
We share information only as needed to operate the Service: Namecheap, Inc., the ICANN-accredited registrar through which your domains are registered (registrant details are also published or escrowed as ICANN requires, with WHOIS privacy where available), Stripe for payments, Google if you choose to sign in with Google, the cloud providers that host the Service, Let’s Encrypt for SSL certificates, and AI providers for AI features: the provider that runs SuNodes’s managed AI (currently OpenAI), OpenAI for generated images, or the provider of your own key if you use one (for example Anthropic, OpenAI or Google). For photos, we send image descriptions (never your personal details) to stock photo providers such as Unsplash to search for suitable images. Unsplash photos on a published site are loaded from Unsplash’s servers, so your visitors’ browsers connect to Unsplash when they view them. Each provider processes data under its own terms and privacy policy.
Cookies
The app uses a single, essential session cookie to keep you signed in. We do not use advertising cookies. The marketing site uses no cookies and loads no third-party trackers.
Retention
We keep your information while your account is active. When you delete your account or a site, we delete the associated data within a reasonable period, except where we must retain it for legal, tax or domain-registration obligations. Reactions to design references are anonymised instead of deleted: your comments and any link to you or your project are deleted, and we keep only the example site, the reaction, short descriptions of design qualities and the kind of business, which can’t identify you. Backups are rotated on a rolling basis.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to certain processing. Contact us and we will respond within the time required by applicable law.
Security
We use industry-standard safeguards including encryption in transit (TLS), encryption of stored API keys, hashed passwords and strict access controls. No method of transmission or storage is completely secure, but we work hard to protect your information.
Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
Changes
We may update this policy. If we make material changes, we will notify you by email or through the Service before they take effect.
Contact
Questions about privacy? Email privacy@sunodes.com.