Privacy notice

Last updated: 10 October 2026.

This notice explains how Cruth Labs Ltd handles personal information when you explore SunStory, buy a report for yourself, use an estate-agency organisation, receive a report link, make a privacy choice or contact us. You can use or view a report without creating an account. SunStory is not intended for children, and we do not knowingly collect their personal information.

Who we are

Cruth Labs Ltd is the controller for personal information we use for our own purposes: managing purchases and accounts, delivering direct consumer reports, securing and supporting SunStory, and understanding service use. We are registered in Scotland under company number SC869947 and with the Information Commissioner's Office under reference ZC169679.

Registered office: Suite 2/3, 48 West George Street, Glasgow, G2 1BP. For privacy questions or rights requests, email support@sunstory.co.uk.

A business customer, such as an estate agency, decides which properties and details it submits, who it admits to its organisation and whom it sends report links to. Where we process personal information in its report content on its instructions, we act as its processor or subprocessor under the business terms. Contact that business about those choices or its own use of your information; you can also contact us for help directing a request.

Information we use

People buying directly: selected postcode and property, location preview, report and access-link details, checkout contact and order information returned by Onelink by Stripe, support messages, and service usage. We do not receive or store your full payment card number.

Organisation administrators, members and billing contacts: name, email and account identifiers, organisation and membership details, invitations and roles, branch and agency branding, logos, report titles and listing links, property and report activity, billing contact and address, tax information, payment status, invoices and limited card details such as brand and last four digits. Stripe handles full card details for business purchases.

Anyone viewing a report or using the site: report link and the pages and controls used, IP address, device and browser information, service logs, performance and error information, analytics and privacy choices. A shared link may reveal the report's selected property, agency branding and details supplied by the purchaser. You do not need to identify yourself to view a public report, but technical and analytics information can still be personal information.

People contacting us: the contact details, correspondence, screenshots, report link and other information you choose to provide, plus records needed to resolve support, complaints, refunds, disputes or claims.

We get information from you and your device; from an agency that invites you, creates a report or shares a link; from Clerk for account and membership activity; from Stripe or Onelink by Stripe for payment and order activity; and from Ordnance Survey and other source-data providers for property and location information.

Why we use it and our lawful bases

• Provide a direct consumer purchase: we use the property selection, order and report information needed to enter into and perform our contract with the individual buyer.
• Run business organisations and reports: we use membership, billing and report activity information for our legitimate interests in performing the agreement with the business, giving its authorised people access, protecting payments and operating the service. A contract with an agency is not automatically a contract with each employee or report viewer. We consider the individual's rights when relying on legitimate interests. For personal report content we process on the business's instructions, the business is responsible for the lawful basis.
• Operate, secure, support and improve SunStory: our legitimate interests include access control, fraud prevention, debugging, service logs, essential operational analytics, support and fair handling of complaints and disputes.
• Meet legal duties: we keep and disclose information where needed for tax, accounting and other legal obligations.
• Optional persistent analytics: we use a browser identifier to understand return visits and product use only with your consent. You can withdraw it at Privacy choices at any time.

We may contact a purchaser or business contact for occasional product feedback under our legitimate interests. They can ask us to stop. Any direct marketing also follows the applicable UK electronic-marketing rules and the choices offered at collection.

Cookies, storage and analytics choices

Essential cookies and similar storage keep accounts and report access working, authorise map resources, remember necessary choices and protect the service. We collect session-level and journey-level operational information to diagnose errors and understand whether the service works.

Optional analytics use a persistent visitor identifier only if you allow them. They are not used for advertising. Change your choice at Privacy choices. We do not sell your personal information. We may use aggregated information that no longer identifies a person or home to understand broad product and location trends.

Sharing and public reports

We use AWS for hosting, content delivery, report and analytics storage and logs; Clerk for sign-in and organisation membership; Stripe for business payments and billing; Onelink by Stripe for consumer checkout as merchant of record; and Google Workspace for support email. We may send property or location queries to Ordnance Survey or other source-data providers to build a report. These providers have their own roles and terms for some activities, particularly identity and payments.

We may also share information with professional advisers or authorities when needed by law or to resolve a claim. An agency's report is available to anyone with its active link. The agency controls whom it sends that link to; our service presents the report and its branding to those viewers. A direct buyer can likewise share their report link.

How long we keep information

• A consumer report link is currently active for 30 days from payment. A successfully generated business report is normally active for 12 months from generation. A refund, payment reversal or exceptional restriction can end access sooner.
• We normally keep generated scene assets for 13 months. Report journal and transaction records may be kept longer where needed to account for purchases, provide support, manage disputes or comply with law.
• We keep organisation, membership and branding records while the organisation uses SunStory and then as reasonably needed to support remaining report access, close the account, handle support or disputes and meet legal duties. When processing of business-supplied personal content ends, the business may request its return or deletion through support, subject to legally required retention.
• We keep service logs and analytics data for up to 13 months. We keep support correspondence for as long as needed to resolve the request and maintain appropriate support, dispute and business records.
• Stripe and Onelink by Stripe keep their own payment records under their notices. We retain the order and payment status needed to operate and support SunStory.

Information deleted from active systems may remain protected and beyond use in backups until routine deletion.

Transfers outside the UK

Our providers, including Stripe or Onelink by Stripe, Clerk, Google and AWS, may process information in the United States or permit access from other countries. When a transfer needs a safeguard under UK data protection law, we rely on an applicable UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to EU Standard Contractual Clauses, as appropriate to the provider and transfer. Contact us for details of a particular transfer or a copy of the relevant safeguard.

Your rights and complaints

Depending on the information and lawful basis, you may ask to access or correct your information, erase it, restrict its use, object to processing, receive a portable copy, or withdraw consent. These rights have legal limits. Contact support@sunstory.co.uk to make a request. We normally respond within one month.

If you are concerned about our use of your information, please contact us first. You can also complain to the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113.

We review this notice when our processing changes. The date above identifies the current edition; contact us for an earlier edition.