1. Introduction
Sundra ehf., based at Stórhöfða 33, 110 Reykjavík, Iceland, operates the website www.sundra.io and a video processing platform. The organization follows the Icelandic Data Protection Act and the EU General Data Protection Regulation (GDPR).
2. Data We Collect
The platform gathers information directly provided and generated through usage:
- Account Data: Name and email address
- User Content: Video files, audio files, text, documents, transcripts, and translations
- Metadata: File size, duration, creation date (unless removed before upload)
- Technical & Log Data: IP addresses, browser type, ISP, timestamps, device information
- Payment Data: Handled by Paddle; credit card details not stored
3. How We Use Your Data
Services include transcription, translation, and video processing. Data supports account management, subscription handling, site improvements, personalization, customer communications, and security measures.
Regarding voice generation: We utilize text-to-speech technology using pre-generated AI voices. We do not use your uploaded audio for voice cloning, nor do we extract or process biometric voice data.
Neither we nor our AI sub-processors (including OpenAI and Elevenlabs) use your uploaded video, audio, or transcripts to train machine learning models. We have opted out of data training on these third-party platforms to ensure your data remains entirely private.
Service improvements may involve manual corrections, glossaries, wordbanks, and product interaction data. Future model training would require an updated policy notice and opt-out mechanisms.
4. Legal Basis for Processing (GDPR)
For EEA residents, processing occurs under contractual necessity, consent (marketing), and legitimate interest (security, analytics).
5. Data Sharing and Sub-processors
Third parties include AWS (hosting), OpenAI, Elevenlabs and Google (AI), Paddle (payments), ConvertKit and Google Analytics (marketing), Posthog and Webflow.
While our primary hosting is in the EU, some sub-processors (like OpenAI and ElevenLabs) are based in the USA. Standard Contractual Clauses protect data transfers.
6. Data Retention
Active accounts maintain content throughout the subscription. Deleted accounts retain data for thirty days before deletion. Full account deletion removes personal data within thirty days, except legally required records.
7. Your Rights
GDPR grants access, rectification, erasure, objection, and portability rights. CCPA/CPRA residents may request disclosure, deletion, and opt-out options. Exercise rights by contacting admin@sundra.io.
8. Cookies and Tracking
Essential cookies enable secure login; analytics cookies track visitor behavior through Google Analytics. See our Cookie Declaration for full details.
9. Children’s Information
Sundra does not knowingly collect any Personal Identifiable Information from children under the age of 13.
10. Security
Industry-standard protections include encryption in transit and at rest.
11. Contact Us
Sundra ehf.
Stórhöfða 33, 110 Reykjavík, Iceland
admin@sundra.io