Privacy Policy

1. Who we are

Jacek Marchewka One, C17/11, 32-086 Węgrzce, Poland, VAT ID PL5130235098 ("Sunsetless", "we") is the controller of the personal data described here. For any privacy question, email [email protected].

This policy covers sunsetless.com, analytics, the coverage check, the chat, emails and calls, purchases, customer accounts and licence keys.

2. Sunsetless EWS does not send us your mail data

Sunsetless EWS runs inside your application and connects to Microsoft Graph directly, with your own app registration.
We never receive your mailbox content, tokens or credentials. The licence check works offline, and Sunsetless EWS sends no data to us.
For the data in your mailboxes, we are neither controller nor processor.

3. What we process, why, and for how long

3.1 Website visits

Data: IP address, time, page, browser and referrer, in the server and security logs of our host, Cloudflare (Cloudflare Pages).
Purpose and legal basis: to deliver and protect the site. Art. 6(1)(f) GDPR: our legitimate interest in a working, secure website.
Retention: we keep no logs of our own. Cloudflare keeps them for a short time under its own rules.

3.2 Analytics, only with your consent

We use Google Analytics 4 to learn how visitors find and use the site. It loads only after you click "Accept" in the cookie banner. If you reject or ignore the banner, Google Analytics does not load.
Data: the pages you visit, the referring page and campaign tags in the link, interactions such as scrolling, outbound links and downloads, approximate location (country and city), device, browser and screen size, and random identifiers stored in cookies (section 11). Google states that Google Analytics 4 does not log or store IP addresses.
We do not use Google signals, advertising features or data sharing with other Google products, and we do not send Google your name or email address.
Legal basis: your consent, Art. 6(1)(a) GDPR, which also covers the cookies under Polish electronic communications law. You can withdraw it at any time in "Cookie settings" at the bottom of every page.
Google Ireland Limited processes this data for us as our processor. Google may transfer it to the USA (section 7).
The cookie banner is part of our own site and loads nothing from other companies. Your answer stays in your browser (section 11); we do not receive it.
Retention: 14 months, after which Google deletes the event data. We see only aggregated reports.

3.3 Private coverage check

The EWS coverage check reads a CSV or pasted SOAP actions locally in your browser. The report, app IDs and results are not sent to us. You do not need an account or email address to use it.
If you send us your report or a question by email or in the chat, sections 3.4 and 3.5 apply.
We send no newsletters.

3.4 Live chat

The chat runs on tawk.to. It loads only after you click "Chat with us". Until then, nothing is sent to tawk.to.
Data: your messages, the name and email address you give in the chat, and technical data that tawk.to receives while the chat runs, such as IP address, approximate location, browser and the page you are on.
Purpose and legal basis: to answer your questions. Art. 6(1)(f): our interest in answering visitors; for questions before you buy, also Art. 6(1)(b).
tawk.to processes this data for us as our processor. After your click it sets its own cookies (section 11).
Retention: as for emails (section 3.5).

3.5 Emails and messages

Data: name, email address, company, your message and attachments, such as an EWS Usage Report. The same applies to messages on LinkedIn or GitHub.
Our mailboxes are hosted by home.pl (Poland).
Purpose and legal basis: to answer you. Art. 6(1)(f): our interest in replying; for customers also Art. 6(1)(b).
Retention: 3 years after the last message. EWS Usage Reports: deleted within 90 days.

3.6 Calls

If we agree to talk, we use Microsoft Teams, Google Meet or another tool we agree on with you. If you invite us through your own tool, its provider works for you, not for us.
Data: name, email address, company, call time and our notes. We do not record calls.
Purpose and legal basis: to arrange the call and learn about your needs. Art. 6(1)(f).
Retention: notes for 24 months.

3.7 Purchases

Data we receive from Paddle: name, email address, company, country, VAT ID and order details (product, price, tax, date, order number).
Purpose and legal basis: to deliver and support your licence, Art. 6(1)(b); if you buy for a company, Art. 6(1)(f): our interest in performing the contract with it. To keep tax and accounting records, Art. 6(1)(c).
Retention: 5 years from the end of the year in which the tax on the purchase was due, as Polish tax law requires.

3.8 Customer account and licence keys

When you buy, we create your account on sunsetless.com from the email address you give at checkout.
Data: email address, name and company (we get them from Paddle through its API), your orders, your licences and licence keys, the Microsoft 365 tenant ID you enter for your permanent key, the files you download with the date and time, and when you last signed in.
The licence key contains the licence ID, licence type, dates and the licensee: your company name, or your email address if Paddle has no company name. A permanent Single App or Organization key also contains your tenant ID. Test keys contain no tenant ID.
Sign-in: we email you a one-time code. It is valid for 10 minutes, and we store only a hash of it.
Where: your account data is stored at Cloudflare (D1 database) and the files you download in Cloudflare R2. Brevo sends the emails with licence keys and sign-in codes.
Purpose and legal basis: to deliver your licence and downloads, let you sign in, and send you notices about your licence, such as new releases, renewals and the sunset clause. Art. 6(1)(b), or Art. 6(1)(f) if you buy for a company, as in 3.7.
Retention: as long as you hold a licence. If you ask us to close your account, we delete it, except the purchase records we must keep under 3.7.

4. Paddle

Paddle is the Merchant of Record for our orders and an independent controller for the purchase. Paddle collects your payment details; we never see your card data. Depending on where you buy from, your contract is with Paddle.com Market Limited (UK) or another Paddle company, as set out in Paddle's Buyer Terms. See Paddle's privacy notice.

5. Where your data comes from

From you, or from Paddle when you or a colleague buy a licence with your email address.

6. Who receives your data

Processors, acting on our instructions under data processing agreements: Cloudflare, Inc. (hosting, security, customer accounts and downloads); Google Ireland Limited (Google Analytics, only with your consent); Brevo (emails, including licence keys and sign-in codes); tawk.to (live chat); Microsoft (Teams) and Google (Meet), for calls; home.pl (email hosting); our accounting office.
Independent controllers: Paddle; LinkedIn and GitHub for messages you send there; Microsoft, if you download our packages from NuGet.org; public authorities when the law requires it.
We do not sell your data.

7. Transfers outside the EEA

Some providers, such as Cloudflare and Google, process data in the USA. We use providers certified under the EU-US Data Privacy Framework, or rely on the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards.

8. Your rights

You can ask for access to your data, correction, erasure, restriction, and a copy in a portable format.
You can object to processing based on Art. 6(1)(f), and to direct marketing at any time.
Where we rely on your consent, you can withdraw it at any time. This does not affect processing before the withdrawal.
Email [email protected]. We reply within one month.
You can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain in the EU country where you live or work.

9. Do you have to give us data?

No law requires it. Your email address is needed to answer your messages. Purchase data is needed to sell and license Sunsetless EWS and to run your account. Everything else is optional.

10. Automated decisions

We make no decisions based solely on automated processing, including profiling. Paddle may run automated fraud checks when you pay; see Paddle's privacy notice.

11. Cookies

sunsetless.com sets no advertising cookies.
Strictly necessary, set without asking:
- __Host-sl_session keeps you signed in to your account. It lasts 30 days, or until you sign out. We store only a hash of it. Set only when you sign in or buy.
- __Host-sl_checkout links your payment to the browser you paid with, so that we can sign you in after the purchase. It lasts 1 day. Set only when you start a purchase.
- sl_consent in your browser's local storage remembers your answer to the cookie banner for 12 months, so that we do not ask on every page.
- Cloudflare may set strictly necessary security cookies to protect the site from bots.
Analytics, only after you click "Accept": Google Analytics sets _ga and _ga_<ID> to tell visits apart. They last up to 13 months. If you withdraw your consent in "Cookie settings", we stop Google Analytics and delete these cookies.
When you open the checkout, Paddle may use the cookies it needs for payment and fraud prevention.
The chat loads only after you click "Chat with us". Only then does tawk.to set its own cookies, which the chat needs to work.

12. Security and changes

We use HTTPS and give access to personal data only to people who need it.
Sign-in codes and session cookies are stored only as hashes.
We update this policy when our processing changes and change the date at the top.