1. Two roles: yours and ours
Your account details (the information about you and your company that you give us to sign up and pay) are ours to look after: we decide why and how they are used, so we are responsible for them.
Your business information (your customers, travellers and their passport and travel details, bookings, suppliers, tasks, the communications you log, the documents you upload, and your invoices and payments) belongs to your company. We store and process it to run SunTrip for you, and for the other purposes set out in this policy and in our Terms of service. Your company decides what goes in and is responsible for having the right to use it, and for any notices and consents needed for us to handle it as described here, including for personal information about your own customers and travellers.
2. What we collect
- Sign-up details: your name, email address, phone number, country, company name and, if you add it, your website.
- Sign-in: you sign in with your email address and a password you choose. The password is handled by our sign-in provider. We never see it and cannot read it.
- Your team: the email addresses, names and roles of the people your Admin invites.
- Your business information described above, including the files you upload.
- Billing: when you subscribe, payment is taken on a payment page run by our payment provider, Stripe. Your card details go to Stripe and are never seen or stored by us. We keep your Stripe customer reference, the status of your subscription, the number of seats, renewal dates and the amounts and dates of your payments.
- Technical records: like most online services, our systems record things like times of sign-in, the pages and actions requested, error messages and your internet address. We use these to keep the service working and secure.
- Enquiry forms: if your company puts its SunTrip enquiry form on its website, what a visitor sends (their name, mobile and the details your form asks for, and that they agreed to be contacted, with the time) arrives in your company's Leads. It is your company's information, like your other customers'. We use it only to deliver it to you and to keep the form working and free of abuse. To limit abuse we count how often a form is sent from the same place, using a scrambled form of the visitor's internet address, which we do not keep as such.
- Emails we send you: we keep a record that an email was sent, to whom and when, so we do not send the same message twice and can see if one failed.
3. Passport and identity details
Travellers' passport numbers are hidden on every screen and shown only when someone whose role allows it presses Reveal. Passport and visa files can be downloaded only by those roles. Each reveal and each download is recorded in your company's history: who, which traveller or file, and when. Your Admin decides which roles may see these details, under Settings, Permissions.
SunTrip never asks for, and is not meant to hold, passwords, loyalty programme PINs, supplier portal logins or card numbers. Please do not type them into notes or other fields.
4. Why we use it
- To create your account, run your workspace and let your team use it.
- To take payment, send receipts and manage your subscription.
- To send you the emails the service needs: invitations, your trial and subscription, payments, storage warnings, and (if you leave them on) the morning summary, emails about tasks given to you and about new enquiries from your website form. You can switch these off for yourself in Settings, Notifications.
- WhatsApp: SunTrip never sends WhatsApp messages. When someone in your team presses a WhatsApp button, SunTrip opens WhatsApp on their device with a message ready, and they send it from your company's own WhatsApp, under WhatsApp's own terms. SunTrip notes in your records that the message was prepared.
- To contact you about your account and to offer help, using the phone number and email address you gave us.
- To keep SunTrip running, fix problems and prevent misuse.
- To analyse how SunTrip is used and to carry out research and development, including improving our services and building new ones. For this we may access, use and analyse information held in SunTrip, including business information, and we may use it in aggregated or de-identified form.
- To meet our legal and accounting duties.
We do not sell personal information, and we do not use your business information for advertising. SunTrip emails your team only: it does not email your customers or travellers.
5. Who we share it with
Only with those who help us run SunTrip, and only what they need:
- Stripe, to take and manage payments.
- Cloud hosting and infrastructure providers, who store and process the information on our behalf, including the service that delivers our emails.
- Your own e-invoicing provider, when SunTrip offers e-invoicing and your company chooses to connect one: we then send it your invoices, on your company's instructions and under your company's own agreement with that provider.
- Professional advisers, authorities or a buyer of our business, where the law requires it or we reorganise the business, in which case this policy will continue to apply to the information unless we tell you otherwise.
Our public pages load fonts from Google Fonts, so your browser contacts Google when you open them. We do not use advertising or tracking cookies. The sign-in uses your browser's session storage to keep you signed in while you use the app.
6. How we look after it, and what we cannot promise
We use measures that we consider reasonable for a service of this kind. For example, each company's information is organised in its own workspace, and access is meant to be limited to the people in that company, with the role their Admin gives them (Admin, Manager, Member or Viewer). We do our very best to protect the information we hold, and we sincerely intend to prevent its loss, damage and misuse.
However, no system is completely secure and mistakes and failures happen. We do not promise or guarantee that information is encrypted at every stage; that it cannot be lost, damaged, corrupted, accessed without permission or disclosed; or that nobody will ever view it. Nothing on this page, on our website or in the app should be read as such a promise. Please use a strong, unique password, only invite people you trust, give each the role they need, and keep your own copies of anything important.
7. How long we keep it
- While your account is open, we keep your account details and business information.
- If your trial or subscription ends, we do not delete your information straight away. We aim to keep it for at least 90 days so you can come back, and to email you before we remove anything. This is our practice, not a guarantee.
- Issued invoices and credit notes are sealed when they are issued and kept for at least 5 years, even if your account ends or you ask us to delete your information, because invoices must be kept for tax purposes. They cannot be changed or deleted during that time, by you or by us.
- While you have access, you can download a backup of your customers and travellers from Settings. It does not include uploaded files, and keeping your own copies is your responsibility.
- Payment and invoice records are kept for as long as accounting and tax law require.
- If you ask us to delete your company's information, we will, except what we must keep by law, including the sealed invoices above.
8. Your choices and rights
You can ask us to give you a copy of your personal information, correct it, restrict how we use it or delete it, and you can object to some uses. Company Admins can update the company's details in Settings. To use any of these rights, or to ask a question, write to info@sunbirdit.com. We will answer within a reasonable time and will tell you if we cannot do something and why. We handle personal information in line with the data protection law of the United Arab Emirates.
If you are a traveller or a customer of a travel agency that uses SunTrip, please contact that agency first, because it decides how your information is used.
9. Children
SunTrip accounts are for businesses and their staff, and are not intended for anyone under 18. Travel agencies may keep information about travellers of any age, including children; the agency is responsible for that information and for any consent it needs.
10. Changes
If we change this policy in a way that matters, we will tell account Admins by email before the change takes effect. The date at the top shows when it was last updated.
11. Contact
Sunbirdit L.L.C-FZ, United Arab Emirates. Email: info@sunbirdit.com.