Privacy Policy

1. Who we are

This policy explains how Second Enlightenment Global Private Limited ("Sunra", "we", "us", "our") handles personal data when you use sunra.ai, Sunra Creative (our web application, MCP server and CLI), the Sunra API and related services (the "Service").

• Company: Second Enlightenment Global Private Limited, registered in Singapore (UEN 202530874K)
• Address: 152 Beach Road, #11-05 Gateway East, Singapore 189721
• Privacy contact and Data Protection Officer: legal@sunra.ai

Our role:

• Controller. We are the controller of the personal data described here. This includes our role under the EU GDPR and UK GDPR, and our role as the organisation responsible under Singapore's Personal Data Protection Act 2012 (PDPA).
• Processor for business customers. A Data Processing Agreement is available to business customers on request. Where a business customer signs one with us, we process its users' content as its processor under that agreement.

2. What we collect

You give us:

• Account data: email address, name, profile photo (for example from Google Sign-In) and account settings.
• Content: prompts, uploaded images, video, audio and files, your conversations with Sunra's AI assistant, and the outputs generated for you, including requests made through the Sunra API.
• Organisation data: if you use the Sunra API, the organisations you belong to, your role in each, and the email addresses of people you invite.
• Payment data: plan, purchase history, Sunra API balance and auto top-up settings, and billing country. Card details are collected and held by our payment processor, Stripe. We do not store full card numbers.
• Communications: emails and messages you send to us, and survey or feedback answers.

Collected automatically:

• Usage data: features used, generation history, credits used, Sunra API requests and spending, and connections made through MCP, CLI or API.
• Device and log data: IP address, browser, operating system, device identifiers, access times and referring pages.
• Cookies and similar technologies: see Section 9.

We do not ask for sensitive data (for example health, religion or biometric identifiers). Do not upload other people's sensitive data. Only upload images or voices of other people when you have their permission (Terms, Section 8.4).

3. How we use it, and our legal bases

Under the PDPA, we collect, use and disclose personal data for these purposes with your consent, which you give by using the Service, or as the PDPA otherwise allows.

4. Your content and AI training

• No training. We do not use your prompts, uploads or outputs to train AI models.
• Storage. We store your content only to provide the Service to you.
• Sale. We do not sell your personal data for money. Our website uses advertising pixels (Meta and Pinterest) that measure our ads. Some US state laws treat this as "sharing" for advertising, and you can opt out (Section 10).
• Model providers. Sunra gives you access to many AI models. When you run a generation, your prompt and any media you attach are sent to the provider that runs the model you chose (for example OpenAI, Google, ByteDance or Kuaishou), only to produce that output.
• AI assistant. When you chat with Sunra's AI assistant, your messages and the project context it needs are sent through Sunra's model gateway to the provider of the language model in use (for example OpenAI, Anthropic, Google, DeepSeek, Moonshot AI, Alibaba Cloud or MiniMax), only to produce the reply.
• Provider commitments. We are securing written commitments from the model and language model providers above not to train on your content and to limit how long they keep it. Each provider, the data it receives and its region are listed on our sub-processor page.

5. Who we share it with

• Service providers (sub-processors): they process data only on our instructions. The current list, with each provider's purpose, data and region, is on our sub-processor page. They fall into these groups:
  • AI model and language model providers;
  • cloud hosting and storage (Alibaba Cloud, Vercel);
  • network, content delivery and security (Cloudflare);
  • payments (Stripe);
  • email (Google Workspace, Resend);
  • analytics and advertising measurement (Vercel, Ahrefs, Meta, Pinterest);
  • support and internal tools.
• Your organisation: in the Sunra API, an organisation's admins can see its members' names, email addresses and roles, and its pending invitations. Admins and members with the Developer role can see the organisation's generations and usage, including requests made with any of its API keys. Admins and members with the Billing role can see its balance, payments and invoices. If someone invites you to an organisation, they give us your email address, and we use it to send you the invitation and to add you if you accept.
• Advertising partners: Meta and Pinterest receive information about your visit and about sign-ups and purchases, to measure our ads. Where the law requires consent, for example in the EU and UK, this happens only if you allow advertising cookies (Section 9). In the US you can opt out (Section 10).
• Third-party tools you connect: if you connect the Service to an MCP client or other tool, data you send through it is handled under that tool's terms.
• Shared and published projects: projects you publish can be seen by other users, and anyone who has a project's share link can view the project and copy it into their own account.
• Legal and safety: when the law requires, or to protect the rights, safety or property of users, Sunra or others.
• Business transfers: in a merger, acquisition or sale of assets. The new owner remains bound by this policy for data already collected.

6. International transfers

We are based in Singapore, and we store your files and generated media in Singapore. Our providers also process data in the United States and in other regions listed on the sub-processor page. Some of the language models behind the AI assistant come from providers based in China (DeepSeek, Moonshot AI, Alibaba Cloud and MiniMax). We use their international services, except DeepSeek's, which processes data in mainland China. Where each of the others processes data is set by its own terms.

When we transfer personal data out of Singapore, the EU, the UK or Switzerland, we protect it with:

• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• adequacy decisions, including the EU-U.S. Data Privacy Framework where the recipient is certified; and
• contractual protections that meet the transfer requirements of the PDPA.

You can ask legal@sunra.ai for a copy of the relevant safeguards.

7. How long we keep it

8. Security

• We encrypt data in transit (TLS) and at rest, limit staff access to what their role needs, and protect sign-in with abuse prevention.
• No system is perfectly secure. If a breach is likely to put your rights at risk, we will notify you and the relevant regulators as the law requires.
• We do not yet hold SOC 2 or ISO 27001 certification.

9. Cookies

We use essential cookies to keep you signed in and keep the Service working. We also use analytics (Vercel, Ahrefs) and advertising pixels (Meta, Pinterest; Google Ads where enabled) to understand how people find and use Sunra and to measure our ads. In the EU, the UK and Switzerland, we set analytics and advertising cookies only after you agree. Elsewhere they are on by default and you can turn them off. We treat a Global Privacy Control signal from your browser as turning advertising off. You can change your choice at any time through "Your privacy choices" at the bottom of our website. Besides essential cookies that keep you signed in, the main cookies we set are:

You can also block or delete cookies in your browser settings.

10. Your rights

You can ask us to do any of the following:

• give you a copy of your personal data;
• correct it;
• delete it;
• give it to you in a portable format;
• restrict or object to how we use it;
• stop marketing emails;
• withdraw any consent you gave.

You can delete content in your library yourself at any time.

To make a request, email legal@sunra.ai from the email address on your account. We may need to verify your identity. We answer within one month, or within the time the law that applies to you sets. We do not treat you differently for using your rights.

EU, UK and Switzerland. You can also complain to your data protection authority. In the UK this is the Information Commissioner's Office.

Singapore. You can also complain to the Personal Data Protection Commission. Withdrawing consent may mean we cannot keep providing the Service. We will tell you what will happen before we act on it.

United States. Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas or Utah), you have the right to know, access, correct and delete your personal data, and to opt out of its sale, targeted advertising or profiling. We do not sell personal data for money. Our advertising pixels may count as "sharing" for targeted advertising under some state laws: you can opt out through the "Your privacy choices" link at the bottom of our website, and we honour Global Privacy Control signals as an opt-out. An authorised agent may make a request for you with your written permission. If we refuse a request, you can appeal by replying to our decision.

11. Age

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it. Contact legal@sunra.ai if you believe a minor has used the Service.

12. Changes to this policy

If we make material changes, we will tell you by email or in the Service before they take effect, and update the date above.

13. Contact

• Privacy questions and requests: legal@sunra.ai
• Account and billing: support@sunra.ai
• Post: Data Protection Officer, Second Enlightenment Global Private Limited, 152 Beach Road, #11-05 Gateway East, Singapore 189721