Consumer Privacy

Last updated: 12 June 2026.

This privacy notice tells you what to expect us to do with your personal information when you use or buy a consumer SunStory.

SunStory is not intended for children, and we do not knowingly collect personal information from children.

Contact details

SunStory is provided by Cruth Labs Ltd. Cruth Labs Ltd is the data controller for this privacy notice and is registered with the Information Commissioner's Office under registration reference ZC169679.

Registered office: Suite 2/3, 48 West George Street, Glasgow, G2 1BP. Cruth Labs Ltd is registered in Scotland with company number SC869947.

Email: support@sunstory.co.uk

What information we collect, use, and why

We collect or use the following information to provide SunStory:

• Names, contact details and addresses where provided through checkout, support or service use
• Purchase, report and access history
• Website and app usage information, including user journeys, analytics information, cookies and similar storage
• Report/location information, including postcode, selected property/location details, report status, and SunStory access link information

We collect or use the following information to comply with legal requirements:

• Names, contact information and financial transaction information where needed to comply with legal obligations
• Any other personal information required to comply with legal obligations

We collect or use the following information for dealing with queries, complaints or claims:

• Names and contact details
• Purchase or service history
• Customer or client accounts and records
• Financial transaction information
• Correspondence
• Report/location information, SunStory access link information, screenshots, and other details customers choose to send us

We collect or use the following information to operate, secure, debug, support, and improve SunStory, including essential and optional analytics:

• Purchase or account history
• IP addresses
• Website and app user journey information
• Records of consent, where appropriate
• Service logs, analytics identifiers, consent records, device/browser information, performance/error data, and report/location information

Cookies, storage and analytics choices

We use essential cookies and similar storage where needed to provide SunStory, authorise access to map or tile resources, protect the service, remember report access, and keep the service working securely.

We also collect essential session-level and journey-level product and operational analytics. These help us understand whether SunStory is working, diagnose errors, protect the service, and improve the customer journey.

Optional analytics help us understand return visits and product usage using a persistent visitor identifier in your browser. We only use optional analytics if you allow them. You can change this choice at Privacy choices.

We do not sell your personal information. We also do not use optional analytics for advertising. We may use or share aggregated, non-identifying information about how SunStory is used, such as broad location or product trends. This aggregated information does not identify you or your home.

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide SunStory are:

• Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests - we collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are to operate, maintain, secure and improve SunStory, including managing report access, service reliability, fraud prevention, debugging and customer support.

Our lawful basis for collecting or using personal information for legal requirements is:

• Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests - we collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are to respond to customer queries, investigate issues, handle complaints, manage refunds or disputes, and keep appropriate records of support and claim handling.

Our lawful bases for collecting or using personal information to operate, secure, debug, support, and improve SunStory are:

• Legitimate interests - we collect or use your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are to operate, secure, monitor, debug and improve SunStory, including essential service logs, performance monitoring, error investigation, service analytics and protection against misuse.
• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. We use consent for optional persistent analytics used to understand return visits and product usage. You can withdraw this consent at any time at Privacy choices.

For more information on our use of legitimate interests as a lawful basis, please contact us using the contact details set out above.

Where we get personal information from

We collect personal information directly from you when you use SunStory, buy access, make privacy choices, or contact us. We also receive information from service providers where needed to provide SunStory, including payment/order information from Onelink by Stripe, support correspondence through Google Workspace, and property/location data from Ordnance Survey.

Onelink by Stripe processes checkout, payment, order, receipt, invoice, tax, refund, dispute and payment-support data under its own terms and privacy policy. Cruth Labs Ltd receives the order information needed to provide and support your SunStory.

How long we keep information

We keep different types of personal information for different periods.

• SunStory access links remain active for the access period shown at purchase, currently 30 days for the consumer offer.
• We keep report journal records, including report status, payment/order references, postcode and selected property/location information, for as long as needed to maintain purchase history, manage access to SunStory, provide support, handle refunds or disputes, and maintain business records.
• We keep generated SunStory service data for up to 13 months.
• We keep service logs, analytics data and optional analytics data for up to 13 months.
• We keep support correspondence for as long as needed to handle the request and maintain appropriate support, dispute and business records.
• Payment records are primarily kept by Onelink by Stripe as merchant of record. We keep payment/order status information as part of our report journal and business records.

Who we share information with

Data processors

Google Workspace

This data processor does the following activities for us: Email service provider

Amazon Web Services (AWS)

This data processor does the following activities for us: Hosting provider, CDN, analytics storage, generated SunStory artifact storage, and secure log storage

Others we share personal information with

• Professional or legal advisors
• Organisations we are legally obliged to share personal information with
• Onelink by Stripe: payment and merchant-of-record provider
• Ordnance Survey: we may use property or location queries to retrieve map and property data used to create SunStory

Sharing information outside the UK

Where necessary, we and our data processors may transfer personal information outside of the UK. When this happens, we rely on appropriate safeguards under UK data protection law.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Organisation name: Onelink by Stripe

Category of recipient: Payment and merchant-of-record provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation name: Google LLC

Category of recipient: Email service provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation name: Amazon Web Services, Inc.

Category of recipient: Hosting provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint