Privacy Policy

Last updated: August 12, 2026

Sunbase Data ("Sunbase," "SunbaseData," "we," "us," or "our") operates the SunbaseData website, CRM software, applications, integrations, and related services (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, protect, retain, and otherwise process information when you visit our website, create or use a SunbaseData account, interact with us, or connect third-party services such as Google to your SunbaseData account.

This Privacy Policy also explains how SunbaseData accesses and uses information obtained through Google APIs, including Google Analytics, Google Search Console, Google Ads, Google Calendar, Gmail, and Google Drive.

Where consent is required by applicable law, we obtain consent separately rather than treating use of the Service alone as consent.



1. Information We Collect


We collect information necessary to provide, operate, secure, support, and improve the Service.

Information You Provide


When you contact us, request a demonstration, create an account, use SunbaseData, communicate with us, or submit information through the Service, we may collect:


  • First and last name
  • Email address
  • Phone number
  • Company name
  • Job title or role
  • Account credentials
  • Customer, lead, project, appointment, and business information entered into the Service
  • Communications with Sunbase
  • Support requests
  • Files or information you choose to upload
  • Other information you choose to provide

Customer Data


Business customers may use SunbaseData to manage information relating to their own customers, prospects, employees, contractors, projects, appointments, communications, transactions, and business operations.


When we process this information on behalf of a SunbaseData customer, the customer determines why and how the information is used, subject to its agreement with SunbaseData.


Customers are responsible for ensuring that information they submit to SunbaseData has been collected and is processed lawfully.


Usage and Technical Data


When you access the website or Service, we may automatically collect information such as:


  • IP address
  • Browser type and version
  • Device type
  • Operating system
  • Pages or screens viewed
  • Referring website or traffic source
  • Date and time of access
  • Session information
  • Feature interactions
  • Application events
  • Diagnostic information
  • Approximate geographic information
  • Device and browser identifiers


We use this information to operate, secure, analyze, troubleshoot, and improve the Service.


Information From Connected Services


If you choose to connect SunbaseData with a third-party service, we may receive information from that service according to the permissions you authorize.

Connected services may include Google Analytics, Google Search Console, Google Ads, Google Calendar, Gmail, Google Drive, Facebook or Meta lead-generation services, and other integrations enabled by your organization.


Connecting these services is optional.



2. How We Use Information


We may use information collected through the Service to:


  • Provide and operate SunbaseData
  • Authenticate users and manage accounts
  • Provide CRM and business-management functionality
  • Provide customer support
  • Process customer-requested integrations
  • Display reports, dashboards, analytics, and attribution information
  • Schedule and manage appointments
  • Facilitate customer communications
  • Maintain security and prevent fraud or abuse
  • Diagnose technical problems
  • Monitor Service performance
  • Improve existing features
  • Develop features consistent with the purposes for which information was collected
  • Comply with applicable laws and legal obligations
  • Enforce our agreements and protect our rights


We do not sell customer data.


Information obtained from Google APIs is subject to the additional restrictions described in Section 6 — Google API Integrations and Google User Data.



3. How We Share Information


We do not sell or rent personal information.


We do not disclose customer information to advertisers, data brokers, information resellers, or other third parties for their own independent marketing purposes.


We may disclose information in the limited circumstances described below.


Service Providers and Subprocessors


We may use companies that provide infrastructure, hosting, security, communications, monitoring, support, database, or other services necessary to operate SunbaseData.


These providers may process information only as necessary to provide services to SunbaseData and are subject to appropriate confidentiality, security, and data-protection obligations.


They may not use SunbaseData customer information for their own independent purposes.


Customer-Directed Sharing


We may disclose or transmit information when a customer or authorized user instructs SunbaseData to do so, including through integrations, emails, calendar invitations, exports, APIs, or other features.


Legal and Safety Requirements


We may disclose information where we reasonably believe disclosure is necessary to:


  • Comply with applicable law
  • Respond to lawful legal process
  • Protect the rights or property of Sunbase
  • Investigate fraud, misuse, or security incidents
  • Protect users or members of the public
  • Enforce agreements
  • Protect against legal liability


Business Transactions


If Sunbase is involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of all or part of its business, information may be transferred as part of that transaction subject to applicable law and appropriate protections.



4. Cookies and Tracking Technologies


SunbaseData may use cookies, pixels, tags, scripts, local storage, and similar technologies.


These technologies may be used for:


Essential Cookies


Necessary to authenticate users, maintain sessions, provide security, and operate the Service.


Preference Cookies


Used to remember user settings and preferences.


Analytics and Performance Cookies


Used to understand website and application usage, traffic sources, performance, and user interactions.


Where applicable law requires consent for non-essential cookies or similar technologies, we apply the relevant consent requirements.


Users may also control cookies through their browser settings and other available privacy controls.


Disabling certain cookies may affect Service functionality.



5. Google Analytics Used on SunbaseData's Own Website


SunbaseData may use Google Analytics 4 ("GA4") to understand how visitors use our own website and Service.


Depending on configuration and user choices, Google Analytics may process information such as:

  • Page views
  • Sessions
  • Events
  • Referral or traffic sources
  • Browser information
  • Device information
  • Approximate geographic information
  • Website interactions
  • Performance information


This analytics activity relates to the operation and improvement of the SunbaseData website and Service itself.


It is separate from the customer-authorized Google Analytics connection described below, through which a SunbaseData customer may connect its own Google Analytics property to a SunbaseData marketing dashboard.



6. Google API Integrations and Google User Data


SunbaseData allows authorized users to connect certain Google services to their SunbaseData account.


These connections use Google authorization mechanisms such as OAuth. SunbaseData does not require or receive a user's Google account password in order to establish these API connections.


We request access only when a user chooses to enable a Google-connected feature.


The Google data we access depends on the Google service connected and the permissions authorized by the user.


Our use of information received from Google APIs complies with the Google API Services User Data Policy, including applicable Limited Use requirements.


For Google Workspace data, our use of information received from Google Workspace APIs adheres to the Google Workspace User Data and Developer Policy and its Limited Use requirements.



Google Analytics 4 — Customer-Connected Analytics


A customer may authorize SunbaseData to connect to one or more Google Analytics 4 properties.


SunbaseData uses this connection to retrieve reporting information from Google Analytics that may include:


  • Website traffic
  • Users
  • Sessions
  • Page and screen views
  • Events and key events
  • Traffic sources
  • Source and medium information
  • Referral information
  • Landing-page performance
  • Device information
  • Browser information
  • General geographic information
  • Engagement information
  • Conversion or key-event performance
  • Other reporting dimensions and metrics selected for SunbaseData dashboards


SunbaseData uses this information solely to provide analytics, reporting, attribution, and marketing-performance dashboards for the customer that connected the Google Analytics property.


SunbaseData does not use a customer's Google Analytics information to advertise SunbaseData to other people, build advertising audiences for SunbaseData, sell information, or provide the customer's analytics information to another customer.


SunbaseData may process or cache reporting information where reasonably necessary to provide dashboards, reporting, historical comparisons, troubleshooting, and related customer-requested functionality.


Access is limited to the Google Analytics properties authorized by the customer.



Google Search Console


A customer may authorize SunbaseData to connect to Google Search Console.


This connection is used to retrieve information about websites or properties that the customer is authorized to access.


Depending on the reporting functionality used, information retrieved may include:


  • Verified website or property information
  • Search queries
  • Landing pages
  • Google Search clicks
  • Google Search impressions
  • Click-through rate
  • Average search position
  • Search dates and reporting periods
  • Device categories
  • Countries
  • Search appearance information
  • Other Search Console reporting information


SunbaseData uses this information to provide search-performance, SEO, content-performance, and marketing dashboards inside the customer's SunbaseData account.

The connection is intended for reporting and analysis.


SunbaseData does not use a customer's Search Console information for SunbaseData's own advertising, does not sell the information, and does not provide one customer's Search Console information to another customer.


SunbaseData does not use this reporting connection to make changes to the customer's website or Google Search presence.



Google Ads


A customer may authorize SunbaseData to connect to a Google Ads account.


SunbaseData uses the connection to retrieve advertising and performance information that may include:


  • Google Ads account information
  • Campaign information
  • Campaign performance
  • Ad groups
  • Ads
  • Keywords
  • Search terms
  • Costs
  • Clicks
  • Impressions
  • Conversion information
  • Conversion actions
  • Conversion values
  • Google Click Identifiers, including GCLID where available
  • Other advertising performance dimensions and metrics


This information is used to provide Google Ads reporting and attribution functionality within the customer's SunbaseData account.


Where a customer captures a Google Click Identifier or related attribution identifier in SunbaseData, SunbaseData may associate that identifier with the applicable lead or customer record in order to help the customer understand which advertisement, campaign, keyword, or click contributed to the lead or conversion.


This allows the customer to evaluate its own advertising performance and return on advertising investment.


The Google Ads connection described here is used for read-only reporting and attribution purposes.


SunbaseData does not use this connection to create, edit, pause, delete, or otherwise modify the customer's:


  • Campaigns
  • Advertisements
  • Keywords
  • Bids
  • Budgets


SunbaseData does not use Google Ads information obtained from one customer to benefit another customer.


We do not sell Google Ads information or provide it to advertisers, data brokers, or information resellers.



Google Calendar


Users may connect Google Calendar to SunbaseData for appointment and scheduling functionality.


Depending on the feature used, SunbaseData may:


  • Create a calendar event for an appointment
  • Update information necessary for the appointment
  • Delete an event when an appointment is cancelled
  • Retrieve calendar availability or busy/free status for scheduling purposes


Calendar information is used only to provide scheduling and appointment functionality requested by the user or the user's organization.


SunbaseData may maintain its own appointment record within the CRM but does not use unrelated Google Calendar information for independent purposes.



Gmail — Sending Email


Users may connect Gmail to SunbaseData so that Gmail can act as an outgoing email provider for communications initiated through SunbaseData.


This functionality may be used for customer-controlled workflows such as:

  • Appointment communications
  • Follow-ups
  • Customer emails
  • Notifications
  • Authorized automated communication workflows


The user's company controls these workflows.


Information necessary to send the email, including recipients, subject lines and message content, may be transmitted to Google for delivery.


SunbaseData does not use Gmail access to send unrelated communications on its own behalf.


If an email is intentionally copied or forwarded into a SunbaseData CRM address or otherwise explicitly saved into SunbaseData by the user, that copy may become part of the customer's CRM record.



Gmail — Reading Email


Where enabled, Gmail read access may be used to provide an email interface inside SunbaseData so authorized users can view and work with their Gmail communications without switching to a separate application.


Gmail messages accessed for this functionality are used solely to provide the user-facing email functionality requested by the authorized user.


SunbaseData does not use Gmail message content for advertising, data brokerage, unrelated profiling, or independent marketing purposes.


Unless a user intentionally saves, copies, forwards, or otherwise imports information into SunbaseData as part of a CRM workflow, SunbaseData does not create a permanent independent database of Gmail message content.



Google Drive


Where a user enables Google Drive functionality, SunbaseData may access Google Drive information solely to provide user-requested file access and linking functionality.


This may allow users to:

  • Access authorized Google Drive files through SunbaseData
  • Select files
  • Associate or link files with SunbaseData records
  • Access attachments required for a customer workflow


Google Drive information is not used for advertising or unrelated purposes.


SunbaseData does not create a permanent independent database of a user's Google Drive contents through this integration.



7. Additional Restrictions on Google User Data


Notwithstanding anything else in this Privacy Policy, information obtained from Google APIs is subject to the following additional protections.


Limited Purpose


Google user data is used only to provide or improve the user-facing functionality for which the user authorized access.


No Sale of Google User Data


SunbaseData does not sell Google user data.


No Advertising Use


We do not transfer, sell, or use Google Workspace user data for:


  • Advertising
  • Retargeting
  • Personalized advertising
  • Interest-based advertising
  • Building advertising profiles for third parties


No Data Brokerage


Google user data is not transferred or sold to data brokers, information resellers, or similar organizations.


No Credit or Lending Use


Google user data is not used to determine creditworthiness or for lending decisions.


Artificial Intelligence and Machine Learning


Google Workspace user data obtained through Workspace API scopes is not transferred, sold, or used to create, train, or improve a generalized artificial intelligence or machine-learning model.


This restriction does not prevent functionality specifically permitted under Google's policies for an individual user's authorized, user-facing use case.

Human Access


SunbaseData personnel do not access the content of Google Workspace user data unless such access is:


  • Specifically requested or affirmatively authorized by the user for particular information;
  • Necessary to investigate security incidents, bugs, fraud, or abuse;
  • Required by applicable law; or
  • Otherwise permitted under applicable Google policies, including appropriately aggregated and anonymized internal operations.


Service Providers


Where a service provider processes Google user data on SunbaseData's behalf, that processing is limited to what is necessary to provide the authorized SunbaseData functionality and is subject to appropriate confidentiality, security, and data-processing restrictions.


Google user data is not provided to service providers for their own independent use.



8. Google Authorization Credentials and Security


Google connections may require SunbaseData to maintain authorization information such as OAuth access tokens, refresh tokens, account identifiers, or integration metadata.


These credentials are used only to maintain the connection authorized by the user.


SunbaseData applies reasonable administrative, organizational, and technical safeguards designed to protect credentials and Google user data from unauthorized access, alteration, disclosure, loss, or destruction.


Access to systems containing customer information is restricted based on operational need.



9. Disconnecting Google Services and Deleting Google Data


A user or authorized administrator may stop SunbaseData from accessing a Google service by disconnecting the applicable integration where that functionality is available.


Users may also revoke SunbaseData's authorization through their Google Account security and third-party access settings.


After authorization is revoked, SunbaseData will no longer retrieve new information through that authorization.


Where applicable, authorization credentials associated with the disconnected integration will no longer be used and will be deleted or invalidated in accordance with our security and data-retention practices.


Users may request deletion of Google-derived information maintained by SunbaseData by contacting us using the information in the Contact Us section below.


We will process valid deletion requests in accordance with applicable law, our contractual obligations, security requirements, and permitted retention requirements.


Revoking a Google connection does not necessarily delete information that the user or their organization separately entered, created, saved, or imported into SunbaseData as ordinary customer records.



10. Facebook and Meta Lead Capture


Where a customer connects Facebook or Meta lead-generation services, SunbaseData may receive information that a prospective customer submits through a lead-generation form.


This information may include contact information and other responses submitted through the form.


SunbaseData uses the integration to transfer the customer's leads into its CRM and support the customer's lead-management workflow.


We do not use a customer's Facebook or Meta lead information for another customer's purposes.



11. Data Retention


We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:


  • Provide the Service
  • Maintain customer accounts
  • Fulfill customer instructions
  • Maintain necessary business records
  • Provide reporting functionality
  • Meet contractual obligations
  • Resolve disputes
  • Enforce agreements
  • Protect security
  • Comply with legal requirements


Retention periods may vary depending on the type of information, customer configuration, applicable law, and contractual requirements.


When information is no longer required, we take reasonable steps to delete, anonymize, or otherwise securely dispose of it.


Google Workspace information is additionally subject to applicable Google API data-use and retention restrictions.



12. Data Security


We use commercially reasonable administrative, organizational, technical, and physical safeguards designed to protect personal information against:


  • Unauthorized access
  • Unauthorized use
  • Disclosure
  • Alteration
  • Loss
  • Destruction


These measures may include access controls, secure authentication, encrypted communications, monitoring, security procedures, and other controls appropriate to the nature of the information being processed.


No method of transmitting information over the Internet or storing information electronically can be guaranteed to be completely secure.



13. International Data Transfers


Sunbase is based in the United States.


Information may therefore be processed or stored in the United States or other locations where Sunbase or its service providers operate.


Data-protection laws in these jurisdictions may differ from those in the user's jurisdiction.


Where required by applicable law, Sunbase uses appropriate safeguards for international transfers of personal data.



14. Privacy Rights


Depending on where you live and applicable law, you may have rights concerning your personal information.


These rights may include the right to:


  • Request access to personal information
  • Request correction of inaccurate information
  • Request deletion
  • Request restriction of certain processing
  • Receive certain information in a portable format
  • Object to certain processing
  • Withdraw consent where processing relies on consent
  • Opt out of certain uses where required by law
  • Lodge a complaint with an appropriate data-protection authority


Rights are subject to applicable legal exceptions and verification requirements.



California Privacy Rights


California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including rights to:


  • Know what categories of personal information are collected
  • Access personal information
  • Correct inaccurate personal information
  • Request deletion
  • Obtain information concerning disclosures
  • Opt out of certain qualifying sales or sharing
  • Limit certain uses of sensitive personal information where applicable
  • Exercise privacy rights without unlawful discrimination


SunbaseData does not sell Google user data.


We also do not use Google Workspace user data for cross-context behavioral advertising or other advertising purposes.



EEA, United Kingdom and Switzerland


Where applicable data-protection laws provide these rights, users may request:


  • Access
  • Rectification
  • Erasure
  • Restriction
  • Portability
  • Objection
  • Withdrawal of consent
  • Information about processing
  • The ability to lodge a complaint with the appropriate supervisory authority


Where required, Sunbase processes personal information on an applicable legal basis such as:


  • Performance of a contract
  • Compliance with legal obligations
  • Legitimate interests
  • Consent


Where Sunbase processes personal data solely on behalf of a business customer, requests relating to that information may need to be directed to the applicable customer as the organization responsible for determining how the information is processed.



15. Exercising Your Privacy Rights


To exercise an applicable privacy right or request deletion of information, contact:

Email: sales@sunbasedata.com


Please provide sufficient information for us to understand and process your request.


We may need to verify your identity or authority before completing a request.


If the information is controlled by one of our business customers, we may refer the request to that customer or assist the customer as required by applicable law and our contractual obligations.



16. Children's Privacy


SunbaseData is intended for business use and is not directed to children under the age of 18.


We do not knowingly collect personal information directly from children for their independent use of the Service.


If we learn that personal information has been collected from a child contrary to applicable law, we will take appropriate steps to delete or otherwise address that information.



17. Third-Party Websites and Services


The Service may contain links to or integrations with websites, applications, and services operated by third parties.


Their privacy practices are governed by their own privacy policies and terms.


SunbaseData is not responsible for the privacy practices of third parties except to the extent required by applicable law or contractual obligations.



18. Changes to This Privacy Policy


We may update this Privacy Policy from time to time to reflect:


  • Changes to the Service
  • New integrations
  • Changes in our data practices
  • Legal or regulatory requirements
  • Security or operational changes


When we update this Privacy Policy, we will revise the Last updated date.


Where required by law or applicable platform policy, we will provide additional notice or obtain consent before using information for a materially different purpose.



19. Contact Us


Questions about this Privacy Policy, Google API data use, privacy rights, or deletion requests may be directed to:

Sunbase Data

Email: sales@sunbasedata.com
Phone: 1-888-678-6227


For requests involving Google-connected information, please identify the Google integration involved so we can process the request appropriately.