Privacy Policy

Last updated: June 10, 2026

This Privacy Policy describes how Sunly AI, available at https://sunly.ai (the "Service"), collects, uses, shares, and protects your personal data. The Service is operated by Onlyapps LTD ("Company," "we," "us," or "our"), a company registered in Cyprus with its registered office at Makariou III, 228, Agios Pavlos Court A, 7th floor, Flat/Office 712, 3030, Limassol, Cyprus.

WE HOPE YOU TAKE SOME TIME TO READ THROUGH THIS CAREFULLY, AS IT IS IMPORTANT.

By using the Service, you acknowledge that your personal data will be processed as described in this Privacy Policy. You should not use the Services if you disagree with this Policy, our Terms of Use, and any other agreement that governs your use.

BY USING THE SERVICE, YOU PROMISE US THAT (I) YOU HAVE READ, UNDERSTAND AND AGREE TO THIS PRIVACY POLICY, AND (II) YOU ARE OVER 16 YEARS OF AGE (OR HAVE HAD YOUR PARENT OR GUARDIAN READ AND AGREE TO THIS PRIVACY POLICY FOR YOU).

Table of Contents

  • Who We Are (Data Controller)
  • Information We Collect
  • How We Use Your Information — Purposes, Personal Data, and Legal Bases
  • Cookies and Tracking Technologies
  • How We Share Your Information — Third Parties Processing Personal Data
  • Data Retention and Security
  • Your Rights Regarding Personal Data
  • Legal Bases for Processing
  • Age Limitations
  • CCPA Rights (California Residents)
  • Third-Party Links and Services
  • Changes to This Privacy Policy
  • Contact Us

1. Who We Are (Data Controller)

Onlyapps LTD ("Company," "we," "us," or "our") is the data controller responsible for determining how and why your personal data is processed in connection with Sunly AI. We are committed to handling your data responsibly, transparently, and in compliance with applicable data protection laws, including the GDPR where it applies to you.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, you can reach us at any time at support@sunly.ai. We aim to respond to all privacy-related inquiries promptly and within the timeframes required by applicable law.

2. Information We Collect

When you use our Services, we collect, use, receive, process, transfer, and share some of your personal data for different legitimate purposes. Below is an explanation of what personal data we may collect or process and why.

2.1 Information You Provide Directly

  • Account information: name, email address, password (stored in hashed form), and authentication data if you sign up via a third-party login (e.g., Google).
  • Profile and preferences: language, subscription plan, settings.
  • Content you submit: text prompts, uploaded files, images, documents, and other inputs you provide to AI Tools, as well as the outputs generated for you ("Generated Content").
  • Communications: messages you send to our support team.

2.2 Payment Information

If you subscribe to a paid plan, payment details (such as card information) are collected and processed by our third-party payment processor. We do not store full payment card numbers on our own servers; we receive limited transaction information (such as plan, amount, billing status, and last 4 digits of your card) from our payment processor.

2.3 Information Collected Automatically

  • Usage data: features used, AI models selected, frequency and timing of use, error logs, and performance data. This includes length of sessions, number of sessions, in-app events, ad clicks, and ad source data.
  • Device and technical data: IP address, browser type, operating system, device type and model, device identifiers, Firebase ID, network provider, connection type (WiFi, 3G, 4G), OS version, and approximate location derived from IP address.
  • Diagnostic information: logs, error reports, event types, timestamps, and associated pages.
  • Cookies and similar technologies: see Section 4 below.

2.4 Data from Third-Party Integrations

3. How We Use Your Information — Purposes, Personal Data, and Legal Bases

We use your personal data only when we have a valid legal basis to do so. The following explains each purpose, the data involved, and the legal basis relied upon.

  • To provide, operate, and maintain the Service. Personal data: Contact Data, Content you submit, Location Data, Usage Data. Legal basis: Performance of contract.
  • Account creation and management. Personal data: Contact Data (including third-party login data such as Google ID, name, profile picture). Legal basis: Performance of contract.
  • Payment processing and billing. Personal data: Contact Data, billing and payment information. Legal basis: Performance of contract.
  • Research, development, and internal improvements. Personal data: Automatically collected information (usage data, diagnostics). Legal basis: Legitimate interest.
  • Diagnosing and fixing issues. Personal data: Usage Data, diagnostic information. Legal basis: Legitimate interest.
  • Transactional communications. Sending account confirmations, billing notices, and security alerts. Personal data: Contact Data. Legal basis: Performance of contract.
  • Marketing communications. Sending promotional emails and offers where required with your consent. Personal data: Contact Data. Legal basis: Consent (you may withdraw at any time).
  • Tracking marketing campaign performance and optimizing the Service. Personal data: User ID, in-app activity data, advertising ID, IP address, approximate location. Legal basis: Legitimate interest.
  • Personalized advertising. Personal data: Automatically collected information, Location Data. Legal basis: Consent.
  • Fraud prevention, security, and abuse detection. Personal data: Automatically collected information, Contact Data. Legal basis: Legitimate interest / Legal obligation.
  • Compliance with legal obligations. Personal data: Contact Data and other data as required (e.g., for tax, accounting, or regulatory purposes). Legal basis: Legal obligation.

4. Cookies and Tracking Technologies

We use cookies and similar technologies (such as tracking pixels / web beacons, embedded scripts, local storage, fingerprinting, and device recognition) to:

  • Keep you signed in and remember your preferences;
  • Understand usage patterns through analytics (e.g., Google Analytics, Firebase, Amplitude);
  • Measure advertising performance (e.g., Facebook/Meta Pixel) and, where applicable, show you relevant ads;
  • Provide customer support tools.

Types of cookies we use: Essential Cookies (required to provide Services and enable features); Functionality Cookies (to remember login details and personalize the Service); Analytics Cookies (to understand traffic and usage trends); Social Media and Advertising Cookies.

Users can opt out of tracking by Google Analytics by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout. Google Remarketing may be used to serve targeted ads and can be disabled at http://www.google.com/settings/ads.

You can manage cookie preferences through our cookie consent banner (where shown) and through your browser settings. Disabling certain cookies may affect the functionality of the Service. Where required by applicable law, we obtain your consent before placing non-essential cookies.

For further details about cookies, including how to view and manage them, visit: https://www.allaboutcookies.org and https://www.youronlinechoices.com.

5. How We Share Your Information — Third Parties Processing Personal Data

We do not sell your personal data. We share information with the following categories of recipients:

5.1 AI Model Providers

To generate responses, images, video, and other outputs, we send your prompts, uploaded files, and related inputs to one or more third-party AI providers (such as Anthropic, OpenAI, Google, and other model providers integrated into the Service). These providers process your inputs solely to generate outputs returned to you, subject to their own privacy and data processing terms. We encourage you not to submit highly sensitive personal data (e.g., health records, government ID numbers) in your prompts unless necessary.

5.2 Payment Processors

Billing and subscription information is shared with our payment processors to process transactions, manage subscriptions, and prevent fraud.

5.3 Analytics and Advertising Partners

We use analytics and advertising/tracking tools to understand how users interact with the Service and to measure the effectiveness of our marketing. These providers may set cookies and collect technical data as described in Section 4.

5.4 Service Providers and Processors

We share data with hosting providers, cloud infrastructure providers, customer support tools, and other vendors who process data on our behalf under data processing agreements. Below are key processors we work with:

5.5 Legal and Business Transfers

We may disclose information if required by law, regulation, legal process, or governmental request, or in connection with a merger, acquisition, restructuring, or sale of assets.

6. Data Retention and Security

6.1 Data Retention

We retain personal data for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is generally retained while your account is active and for a reasonable period afterward. We retain all personal data for as long as you use the Services and 24 months after you stop using them. If you do not use the Services for 24 continuous months, we erase your personal data from our database and request the same erasure from any third party to whom your personal data may have been transferred.

Prompts and Generated Content may be retained to operate and improve the Service, including for abuse detection, unless you delete them or request deletion as described in Section 7.

6.2 International Transfers

If you are located outside of the USA and choose to provide information to us, please note that we may transfer your data, including personal data, to the USA and other countries and process it there. We implement appropriate safeguards for such transfers in accordance with applicable data protection law.

6.3 Security Measures

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. These include encryption in transit and at rest, pseudonymization and tokenization, access controls, data integrity protections, and regular security reviews. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights Regarding Personal Data

You have control over your personal data. Depending on where you live, you may have the following rights:

  • Right to Be Informed: You have the right to know what personal data we hold and how and why we handle it.
  • Right of Access: You may request a copy of the personal data we hold about you.
  • Right to Rectification: You may request corrections to your personal data if it is incomplete or inaccurate.
  • Right to Erasure: You may request deletion of your data under certain conditions. In some cases, we may retain data if necessary for legal or security reasons.
  • Right to Restrict Processing: You may restrict processing under specific circumstances, such as inaccurate data or unresolved objections.
  • Right to Data Portability: You may request a copy of your data in a machine-readable format for use with another provider.
  • Right to Object: You may object to processing based on legitimate interest or for direct marketing purposes.
  • Right to Withdraw Consent: For processing based on consent (e.g., marketing emails, non-essential cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.
  • Right to Opt-Out of Advertising: You can opt-out of direct or interest-based advertising through your device settings.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, e.g., https://edpb.europa.eu/about-edpb/board/members_en or https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html for Switzerland.

To exercise any of these rights, email us at support@sunly.ai. We may ask you to verify your identity before processing your request. We will respond within 30 business days. One free copy per request; additional copies may incur a fee.

8. Legal Bases for Processing

We only process your personal data when we have a valid legal basis to do so:

  • Performance of contract: When you create an account, send a prompt, or subscribe to a paid plan, we need to process certain data to provide the Service.
  • Consent: For non-essential cookies, marketing emails, personalized advertising, or certain optional features, we ask for your permission first. You can withdraw this consent at any time.
  • Legitimate interests: We process some data to keep the Service secure, prevent fraud and abuse, understand how people use Sunly AI, and improve our products — provided this does not override your rights and interests.
  • Legal obligation: In some cases we are legally obligated to process or retain certain data, for example for tax, accounting, or regulatory reasons.

9. Age Limitations

The Service is intended for adults. In general, you must be 16 years of age or older to use the Service, or your age may require parental consent for us to process your personal data.

In accordance with the Federal Children's Online Privacy Protection Act of 1998 ("COPPA"), we will never knowingly solicit, nor will we accept, personally identifiable information from users known to be under 13 years of age. If we become aware that we have collected personal data from a child under 13 without verified parental consent, we will take steps to delete it promptly.

If you believe we have information from or about anyone under thirteen (13) years of age, please notify us at support@sunly.ai. Please include "COPPA Concern" in the subject line for fastest processing.

10. CCPA Rights (California Residents)

This section provides additional information for individual residents of the State of California under the California Consumer Privacy Act of 2018 ("CCPA"). Any terms defined in the CCPA have the same meaning when used in this section.

In the past 12 months, our Services have collected the following categories of personal information from California consumers:

  • A. Identifiers (e.g., name, IP address, email address, account name, unique identifiers). Collected: YES. Sold: NO.
  • B. Personal information under Cal. Civ. Code § 1798.80(e) (e.g., name, address, financial information). Collected: limited to payment data. Sold: NO.
  • C. Protected classification characteristics (e.g., race, religion, sex). Collected: NO. Sold: NO.
  • D. Commercial information (e.g., subscription records, purchasing history). Collected: YES. Sold: NO.
  • E. Biometric information. Collected: NO. Sold: NO.
  • F. Internet or network activity (e.g., browsing history, interaction with the Service). Collected: YES. Sold: NO.
  • G. Geolocation data (precise). Collected: NO. Sold: NO.
  • H. Sensory data (e.g., audio, visual). Collected: NO. Sold: NO.
  • I. Professional or employment-related information. Collected: NO. Sold: NO.
  • J. Non-public education information. Collected: NO. Sold: NO.
  • K. Inferences drawn from personal information (e.g., user preferences, behaviors). Collected: YES. Sold: NO.

As a California resident, you have the right to:

  • Request information about how we have collected and used your personal information during the past 12 months.
  • Request a copy of your personal information collected in the last 12 months.
  • Request deletion of your personal information (subject to certain exceptions required to provide the Service, comply with law, ensure security, etc.).
  • Opt out of the sale of personal information. We do not sell your personal information to third parties.
  • Be free from discrimination for exercising your privacy rights.
  • Request information about our disclosure of your personal information to third parties for direct marketing purposes in the prior calendar year (free, once per year).

To exercise your California privacy rights, email us at support@sunly.ai. We will need to confirm your identity (e.g., name, account name, email, state of residence) before processing your request. We aim to respond to access or deletion requests within 45 days. If more time is required, we will notify you in writing.

11. Third-Party Links and Services

The Service may contain links to third-party websites or integrate third-party services not operated by us. This Privacy Policy does not apply to such third parties, and we encourage you to review their respective privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you via the Service or by email, and update the "Last updated" date above. The new version of the Privacy Policy takes effect after notification. Continued use of the Service after changes take effect constitutes acceptance of the revised Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: support@sunly.ai

Onlyapps LTD
Makariou III, 228, Agios Pavlos Court A, 7th floor, Flat/Office 712
3030, Limassol, Cyprus