Privacy Policy
1.Who We Are (Data Controller)
This website, dunefox.io, is operated by Sucetas Technologies UK Ltd (the "Company", "we", "us", "our"), a company incorporated in England and Wales under company number 16984447, with its registered office at:
2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AEWe are registered with the UK Information Commissioner's Office (ICO) under reference number ZC086490.
As the data controller, we are responsible for deciding how and why personal data about you is collected and processed. This Privacy Policy explains what data we collect, why we collect it, and your rights in relation to it, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
2.Data Protection Officer (DPO)
We have appointed a Data Protection Officer who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this policy, including any requests to exercise your legal rights, please contact the DPO:
Name: Sanket Barmukh
Email: sanket@sucetastech.co.uk
Postal address: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE
3.What Personal Data We Collect
We collect personal data in the following categories:
3.1Data You Provide Directly
| Data | How Collected | Purpose |
|---|---|---|
| Name, business email address, company name, phone number | Contact Sales form, Demo request form | Responding to sales and support enquiries |
| Website URL | Demo chatbot set-up flow on dunefox.io | Provisioning and demonstrating our AI chatbot service |
| Message content | Contact form, live chat | Handling your enquiry |
| Lead information (name, email, phone) | AI chatbot interactions on dunefox.io demo | Providing the lead-capture demonstration service |
3.2Data Collected Automatically
| Data | Source | Purpose |
|---|---|---|
| IP address, browser type, device type, operating system, referrer URL, pages visited, session duration | Google Analytics 4 (GA4) | Website analytics and performance measurement |
| Mouse clicks, scroll depth, session recordings, heatmaps | Microsoft Clarity | Understanding user behaviour to improve UX |
| Cookies and similar tracking technologies | Our website | See our Cookie Policy |
3.3Data We Do Not Collect on This Website
Account registration, passwords, and payment card details are handled on our applications, not on this website: app.dunefox.io (the Dunefox platform), whose privacy notice is presented at the time of account creation, and voice.dunefox.io (Dunefox Voice), covered by the Dunefox Voice Privacy Policy. What Dunefox Voice does with data from a connected Google account is set out in section 12, and what the Dunefox platform does with data from a connected YouTube channel in section 13. Payment processing on app.dunefox.io is conducted by Stripe, a PCI-DSS compliant payment processor. We do not receive or store full card details.
4.Lawful Basis for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out our lawful basis for each processing activity:
| Processing Activity | Lawful Basis | Details |
|---|---|---|
| Responding to contact/sales enquiries | Legitimate interests (Art. 6(1)(f)) | We have a legitimate interest in responding to prospective customer enquiries |
| Providing the demo chatbot service and collecting leads | Legitimate interests / Pre-contractual steps (Art. 6(1)(b) & (f)) | Necessary to perform the demonstration service you have requested |
| Analytics (GA4, Microsoft Clarity) | Consent (Art. 6(1)(a)) | We obtain your consent via our cookie banner before activating analytics cookies |
| Marketing communications (if applicable) | Consent (Art. 6(1)(a)) | We only send marketing emails where you have opted in |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Where we are required by law to process data |
5.International Data Transfers
We and our third-party service providers may transfer your personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place as required by UK GDPR:
| Recipient | Location | Safeguard |
|---|---|---|
| MongoDB, Inc. (database hosting via MongoDB Atlas) | Mumbai, India (AP-South-1 region) | Standard Contractual Clauses (SCCs) under MongoDB's Data Processing Addendum. India does not currently hold a UK adequacy decision; transfers rely on SCCs approved under UK GDPR. |
| Google LLC (Google Analytics 4) | United States | UK International Data Transfer Agreement (IDTA) / SCCs. Google is certified under the UK's Data Bridge arrangements. |
| Microsoft Corporation (Microsoft Clarity) | United States | UK IDTA / SCCs. Microsoft is certified under the UK's Data Bridge arrangements. |
| Stripe, Inc. (payment processing, app.dunefox.io only) | United States | UK IDTA / SCCs. Stripe is PCI-DSS compliant and operates under appropriate transfer mechanisms. |
You may request a copy of the relevant safeguards by contacting our DPO at sanket@sucetastech.co.uk.
6.Third-Party Processors
We use the following third-party processors who process personal data on our behalf under our instruction. All processors are bound by contractual obligations consistent with UK GDPR:
| Processor | Purpose | Privacy Information |
|---|---|---|
| Google LLC | Website analytics (GA4) | Google Privacy Policy |
| Microsoft Corporation | Session recording & heatmaps (Clarity) | Microsoft Privacy Statement |
| MongoDB, Inc. | Database hosting (lead & demo data) | MongoDB Privacy Policy |
| Stripe, Inc. | Payment processing (app.dunefox.io) | Stripe Privacy Policy |
We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.
7.Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
| Data Category | Retention Period | Reason |
|---|---|---|
| Contact/sales enquiry data | 3 years from last contact | Legitimate interest in follow-up; limitation period for contract disputes |
| Demo chatbot lead data | 12 months from collection | Operational necessity; review and handoff period |
| Website analytics data (GA4) | 14 months (configured in GA4) | Industry standard analytics retention |
| Microsoft Clarity session data | 90 days (Clarity default) | UX review cycle |
| Legal / compliance records | 7 years | UK statutory requirements |
Upon expiry of the relevant retention period, personal data is securely deleted or anonymised.
8.Your Rights Under UK GDPR
You have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions:
| Right | What It Means |
|---|---|
| Right of access | You may request a copy of the personal data we hold about you (a Subject Access Request / SAR). We will respond within one calendar month. |
| Right to rectification | You may request that we correct inaccurate or incomplete personal data. |
| Right to erasure ("right to be forgotten") | You may request that we delete your personal data where we no longer have a legal basis to retain it. |
| Right to restriction | You may request that we restrict the processing of your data in certain circumstances (e.g. while accuracy is disputed). |
| Right to data portability | Where processing is based on consent or contract, you may request your data in a structured, machine-readable format. |
| Right to object | You may object to processing based on legitimate interests. We must stop unless we can demonstrate compelling legitimate grounds that override your interests. |
| Rights related to automated decision-making | You have rights not to be subject to solely automated decisions that produce legal or similarly significant effects. We do not carry out such processing on dunefox.io. |
| Right to withdraw consent | Where processing is based on consent (e.g. analytics cookies), you may withdraw consent at any time via our cookie settings. Withdrawal does not affect lawfulness of prior processing. |
To exercise any of these rights, please contact our DPO:
Email: sanket@sucetastech.co.uk
Post: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE
We may need to verify your identity before processing your request. We will not charge a fee except in cases where a request is manifestly unfounded or excessive.
9.Right to Lodge a Complaint
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at contact@dunefox.io.
10.Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit (TLS/HTTPS across all dunefox.io pages)
- Encryption of data at rest in our database infrastructure
- Access controls and role-based permissions for internal systems
- Regular review of our security practices
Despite these measures, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform affected individuals without undue delay.
11.Children's Privacy
Our website and services are directed at business professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at support@dunefox.io and we will take steps to delete it.
12.Dunefox Voice and Google User Data
Dunefox Voice (voice.dunefox.io) is our AI phone agent application. A workspace can connect a Google account on its Integrations page, and each teammate can connect their own on their Profile page, so that Dunefox Voice can send email from Gmail, check, book, move and cancel Google Calendar appointments, and write exports to Google Sheets. It asks Google only for the access the feature being switched on needs. This section explains what Dunefox Voice does with data it receives from Google. Everything else Dunefox Voice processes is described in the Dunefox Voice Privacy Policy.
12.1What We Access
Dunefox Voice asks Google only for the access these features need, and you see each permission on Google's own consent screen before you allow it:
| Google permission | What Dunefox Voice does with it |
|---|---|
Your Google name and email address (openid, userinfo.email, userinfo.profile) | Signs you in with Google and shows which Google account is connected. |
Gmail, send only (gmail.send) | Sends the emails you set up from your address: booking confirmations, changes and reminders, call follow-ups, call summaries for your team, proposals and scheduled exports. Dunefox Voice cannot read, search or delete your email. |
Google Calendar (calendar) | Lists your calendars so you can choose where bookings go and which ones count as busy. During a call, checks whether the time a caller asks for is free, reading only busy times, never event titles, descriptions or attendee details. Adds, moves and cancels the appointments your agents and teammates book, and sends the caller the invitation. Only if you ask, creates a team bookings calendar and shares it with the people you name. |
Google Sheets, only the files you choose (drive.file) | Adds call and lead exports to a spreadsheet you pick in Google's file picker or that Dunefox Voice creates for you, and reads that sheet when you import leads from it. Dunefox Voice cannot see any other file in your Drive. |
12.2How We Use It
Google user data is used only to provide these features to you, inside your workspace. Whether a time is free is passed to the AI agent on that call so it can offer the caller a time, and is used for that call only. Leads you import from a sheet become contacts in your workspace, and the appointments and emails Dunefox Voice sends for you are recorded in that workspace's call history.
12.3Storage and Protection
We keep the access token Google gives us encrypted, together with the address of the connected account and the spreadsheet you chose. For appointments and emails we keep only what Dunefox Voice created: the time, the Google event id, the guest's name, number and email (encrypted), and each email's subject and recipient (encrypted). We do not copy your calendar or your mailbox into our systems. These records are deleted with the lead they belong to. Dunefox Voice runs on Google Cloud in India (Mumbai region); the Dunefox Voice Privacy Policy explains how that transfer is safeguarded.
12.4Sharing
We do not sell Google user data, use it for advertising, or use it to train AI models, whether ours or anyone else's. It is shared only with the service providers that run the call itself (the AI and speech providers listed in the Dunefox Voice Privacy Policy), only to deliver the feature you asked for, and where the law requires it. Our staff do not read it unless you ask us to for support, it is needed for security, or the law requires it.
12.5Removing Access and Deleting Data
Disconnect Google on the Dunefox Voice Integrations page (or, for your own account, your Profile page), which revokes our access with Google and deletes the stored token, or remove Dunefox Voice from your Google Account's connections. You can also ask us to delete any Google user data we hold by emailing contact@dunefox.io.
Dunefox Voice's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
13.Dunefox Platform and YouTube Data
The Dunefox platform (app.dunefox.io) uses YouTube API Services. A workspace owner can connect a YouTube channel on the Channels page so that Dunefox can find potential customers in the comments on that channel's videos and, if the owner turns it on, reply to those comments. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
13.1What We Access
Dunefox asks Google for a single YouTube permission, the only one this feature needs, and you see it on Google's consent screen before you allow it:
| YouTube permission | What Dunefox does with it |
|---|---|
See, edit, and permanently delete your YouTube videos, ratings, comments and captions (youtube.force-ssl) | Reading: reads the connected channel's ID and name so we can show which channel is connected, and reads the public comments posted on that channel's videos: the comment text, the commenter's display name and YouTube channel ID, the video ID and the time it was posted. Replying: posts the reply you write in your auto-reply settings, as your channel, under a comment that shows buying interest. This happens only if you turn auto-reply on. |
Google bundles reading and replying into this one permission, and no narrower permission allows replying to comments, so Dunefox asks for it even if you never turn auto-reply on. However broad Google's wording is, Dunefox only does the two things above. Dunefox does not upload, edit or delete videos, change ratings or captions, change channel settings, or delete or moderate comments.
13.2How We Use It
Each new comment is checked for words that show buying interest, such as a request for the price or for more details. When a comment shows interest, Dunefox adds the commenter as a lead in your workspace, using their display name, YouTube channel ID and the comment text, so your team can follow up. If auto-reply is on, Dunefox posts your reply under that comment. YouTube data is used only to provide this feature to you, inside your workspace.
13.3Storage and Protection
The access tokens Google gives us are stored encrypted with a key unique to your workspace. Commenter names on leads are also encrypted. All data is encrypted in transit and at rest, and the Dunefox platform runs on Google Cloud in India (Mumbai region). We keep a record of each comment we have checked so the same comment is not processed twice; these records are deleted automatically after 30 days. Leads created from comments stay in your workspace until you delete them or close your account.
13.4Sharing
YouTube data is visible only to the people in your workspace you give access to. We do not sell it, use it for advertising, or use it to train AI models, whether ours or anyone else's. We do not share it with third parties, except with our hosting provider (Google Cloud) to run the service and where the law requires it. Our staff do not read it unless you ask us to for support, it is needed for security, or the law requires it.
13.5Cookies
The Dunefox platform uses strictly necessary cookies and browser storage to keep you signed in. We do not place cookies or other tracking technologies on YouTube, and we do not store YouTube data in your browser.
13.6Removing Access and Deleting Data
Disconnect the channel on the Dunefox Channels page, which revokes our access with Google and immediately deletes the stored tokens and comment records. You can also revoke Dunefox's access at any time from the Google security settings page; when you do, we delete the stored tokens and comment records within 30 days. To ask us to delete any YouTube data we hold, including leads created from comments, email contact@dunefox.io and we will delete it within 7 days.
Dunefox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Questions about this section can be sent to contact@dunefox.io.
14.Third-Party Links
Our website may contain links to third-party websites. This Privacy Policy applies to dunefox.io, to Google user data in Dunefox Voice (section 12) and to YouTube data in the Dunefox platform (section 13). We are not responsible for the privacy practices of any third-party websites and encourage you to read their privacy policies before providing any personal data.
15.Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, our data practices, or our services. We will post the updated policy on this page with a revised effective date. Where changes are material, we will make reasonable efforts to notify you (e.g. via a prominent notice on our website or by email where we hold your contact details). We encourage you to review this page periodically.
16.Contact Us
Sucetas Technologies UK Ltd
2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE
Company No: 16984447 · ICO Ref: ZC086490
General enquiries: contact@dunefox.io
Support: support@dunefox.io
DPO (Sanket Barmukh): sanket@sucetastech.co.uk