SunStory MCP API Privacy Notice

Last updated: 15 October 2026.

This notice covers requests to the SunStory MCP API and API support. Browsing sunstory.co.uk, including these pages and the Compass, is covered by the website privacy notice.

Cruth Labs Ltd is the data controller, registered in Scotland (SC869947) at Suite 2/3, 48 West George Street, Glasgow G2 1BP. Contact support@sunstory.co.uk or write to that address with privacy questions, requests or complaints.

What we collect

We receive locations, dates and times from your assistant or other client. We record full postcodes and exact supplied or resolved coordinates, alongside request details, outcomes, IP addresses and client information in service logs and analytics. We also keep support correspondence you send us. This information may be personal data even though the API requires no account.

For postcode requests, we send the postcode to Ordnance Survey and receive its approximate location. Coordinate-only requests do not need that lookup. Requests may concern you or someone else. Your client controls what it sends; avoid including unrelated personal information or secrets.

Why we use it

We rely on these lawful bases:

• Contract: to provide your requested calculation under the API terms, where the personal information relates to you. A location and date or time are needed to answer the request.
• Legitimate interests: to provide calculations involving other people's information; operate and secure the service; manage demand; resolve support enquiries; and understand and improve use of the API, including analysis of full location data. We balance these interests against individuals' rights.
• Legal obligation: where we must keep or disclose information by law.

Using the API is not consent to these activities. The API itself does not set cookies.

Who receives it

Your assistant or client receives the results and handles them under its own privacy policy. We use AWS for hosting, security and analytics, Ordnance Survey for postcode lookups, and Google Workspace for support email. Authorised people and providers access information as needed for these purposes. We may also disclose it to advisers or authorities where necessary for legal obligations or claims.

AWS and Google may process information outside the UK, including in the United States. We rely on applicable UK adequacy decisions or contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, as appropriate. Contact us for details or a copy of the relevant safeguard.

How long we keep it

We keep service logs and analytics for up to 13 months, and access logs for one year. We keep support correspondence as long as needed to resolve the enquiry and retain proportionate complaint or legal records. Specific records may be held longer where required by law or needed for an identified security investigation or legal claim, and deleted when that reason ends.

Your rights

Subject to legal conditions, you can ask to access, correct or erase your personal information, restrict its use, or receive a portable copy.

You can object to processing based on legitimate interests, including analytics, for reasons relating to your circumstances. We will stop unless the law permits us to continue.

Contact us using the details above. We may need request details and proportionate proof of identity to locate and protect your information. We normally respond within one month. You can complain to us or to the Information Commissioner's Office.

We will update this notice when our processing changes and provide further information before new uses where required.