Privacy Policy

Sunny Side Up is a creative agency in Boston. This policy explains what we collect when you visit ssustudio.com, use one of our free tools or get in touch, and what we do with it. We have written it in plain language rather than boilerplate, because a policy you cannot read is not really a disclosure.

The Short Version

• We use Google Analytics to see how people use the site. It sets cookies. Google's advertising features are turned off, and we run no advertising pixels.
• We collect your name and email only when you hand them to us: a newsletter signup, a call request or an audit request.
• We do not sell your personal information, and we never have.
• You can ask us to delete anything we hold about you by emailing [email protected].

Who We Are

Sunny Side Up ("Sunny Side Up," "SSU," "we," "us"), Boston, Massachusetts. Reach us at [email protected]. For the purposes of the GDPR and UK GDPR, we are the data controller for information collected through this site.

What We Collect

Information you give us

• Newsletter. Your email address, when you subscribe to The Scramble.
• Call requests. Your name, email, company name and whatever you write in the message field.
• Audit, score and teardown requests. Your name, email, company name and your website address.
• Direct contact. Anything you include when you write to us or message us on LinkedIn, Instagram or YouTube.

Information collected automatically

Our host keeps standard server logs: IP address, browser and device type, pages requested and timestamps. We use these to keep the site running and secure. We do not use them to build a profile of you.

We also use Google Analytics 4 to understand how the site is used: which pages are viewed, how visitors arrive, roughly where they are (country and city level), what device and browser they use, and which forms and links they use. Google Analytics does not log or store IP addresses. We have turned off Google signals and ad personalization, so this data is not used for advertising.

What we do not collect

No advertising or conversion pixels. No session recording. No Google advertising features. There are no accounts on this site, so there are no passwords, and we do not process payments here.

Cookies

Google Analytics sets first party cookies (named _ga and _ga_ followed by an identifier) to tell one visit from another and to count returning visitors. They last up to two years. We set no cookies for advertising. You can block or delete cookies in your browser settings, or install Google's browser add-on to opt out of Google Analytics on every site. Our host may set a strictly necessary cookie for security and load balancing. The third parties listed below may set their own cookies when you interact with their embedded forms, and their policies govern that.

Who Processes Data for Us

This list is short on purpose. Each one is a service we actually use.

• Cloudflare. Hosting and delivery, server logs and security.
• Flodesk. Our newsletter list and delivery.
• Formspree. Routing the call request form to our inbox.
• Google Analytics. Measuring how the site is used, as described above.
• Google Fonts. The site loads its typeface from Google's servers, which means Google receives your IP address as part of that request.
• Google Workspace. Our email.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.

How We Use It

• To reply to you
• To send The Scramble, if you asked for it
• To produce and deliver an audit or score you requested
• To understand how the site is used and improve it
• To keep the site secure and working
• To meet our legal obligations

Our Legal Bases

If you are in the EEA or UK, we rely on these grounds:

• Consent for the newsletter. You can withdraw it any time using the unsubscribe link.
• Legitimate interests for replying to inquiries, delivering an audit you asked for measuring and improving the site, and keeping the site secure.
• Legal obligation where the law requires us to keep or produce records.

How Long We Keep It

• Newsletter. Until you unsubscribe, then removed from the active list within 30 days.
• Inquiries and audit requests. Up to 24 months from our last contact, so we have context if you come back.
• Analytics data. Fourteen months, then deleted automatically.
• Server logs. A short rolling window, as retained by our host.
• Records tied to a paid engagement. As long as needed for contract and tax purposes, generally seven years.

Where Your Information Goes

We are in the United States and our providers are largely US based. If you contact us from outside the US, your information will be transferred to and processed in the US under the safeguards our providers have in place.

Your Rights

Depending on where you live, you may have the right to access what we hold, correct it, delete it, receive a copy in portable form, restrict or object to how we use it and withdraw consent you previously gave.

California residents may request the categories and specific pieces of personal information we have collected, request deletion and request correction. We will not discriminate against you for asking. We do not sell or share personal information as those terms are defined under California law, so there is no opt-out to offer.

To exercise any of this, email [email protected]. We will respond within 30 days, or within 45 days for California requests where the law allows an extension. We may need to verify your identity first.

If you are in the EEA or UK and think we have handled your information badly, you may lodge a complaint with your local supervisory authority.

Global Privacy Control

We honor GPC and similar browser signals where they apply. Because we do not sell or share personal information for advertising, there is nothing for the signal to switch off.

Children

This site is aimed at business audiences and is not directed to children under 16. We do not knowingly collect their information. If you believe a child has given us something, email us and we will delete it.

Security

The site runs over HTTPS. Access to our inbox and mailing list is limited to our principals and protected by two-factor authentication. No system is perfectly secure, and if something happens that affects your information, we will tell you promptly and as the law requires.

Changes to This Policy

We will update the date at the top of this page whenever this changes. If a change is material, we will flag it on the site rather than leave you to spot it.

Contact

Questions, requests or corrections: [email protected]