Sundial Privacy Policy
Sundial Privacy Policy
Last Updated: October 6, 2026
This Privacy Policy describes how Oxhead X, LLC ("Sundial," "we," "us," or "our") collects, uses, and shares information when you use our Sundial customer relationship management platform (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.
Questions or concerns? Contact us at privacy@sundial.click.
We collect information in several ways depending on how you interact with our Service.
When you create an account, we collect your name, email address, password, company name, job title, and billing information. For team accounts, administrators may add user information for agents and managers.
The Service allows you to store and manage contact information, which may include names, phone numbers, email addresses, physical addresses, company affiliations, job titles, and any custom fields you create. This data may be entered manually or imported from third-party services such as Google Contacts.
If you use our voice AI or call recording features, we collect and store audio recordings of calls, transcriptions of those recordings, metadata such as call duration, timestamps, and participant information, and AI-generated summaries and coaching insights.
Important: Our call coaching features analyze voice characteristics to provide performance insights. This may include processing voice patterns and characteristics that constitute biometric data under certain state laws (including Illinois, Texas, and Washington). We process this data only with your explicit consent and solely to provide coaching analytics. We do not sell biometric data or use it for purposes other than the Service.
We automatically collect information about how you use the Service, including task assignments and completions, communication logs, login times and session duration, feature usage patterns, and device and browser information.
When you visit our website, we record how you arrived (for example the referring site and any campaign tags in the link), the page you first landed on, and the addresses of up to the last 30 pages you viewed, without anything after a "?" in the address. This is stored in your own browser and is sent to us only if you submit a form or start a chat, so we know which of our marketing brought you to us and what you looked at first. We also use a cookieless analytics service to count page views and visits in aggregate.
Links in the emails and text messages we send you go through our link service, which records that a link was clicked before taking you to the page. If you click a link in one of our marketing messages and then submit a form or start a chat on our website, we can connect that visit to the message we sent you.
When you connect third-party services (such as Google), we collect data according to the permissions you grant. For Google Contacts integration, this includes contact information, profile photos, and organizational data you have authorized us to access.
We use the information we collect to provide, maintain, and improve the Service; process and complete transactions; send transactional communications (such as confirmations and alerts); provide customer support; generate analytics and coaching insights from call recordings; detect, prevent, and address technical issues and security threats; comply with legal obligations; and communicate with you about products, services, and events (with your consent where required).
We do not sell your personal information. We may share information in the following circumstances:
We share information with third-party vendors who perform services on our behalf, including Amazon Web Services (cloud hosting and storage), Google (authentication and contacts integration), voice AI and telephony providers (for call features), payment processors (for billing), and analytics providers. These providers are contractually obligated to protect your information and use it only for the services they provide to us.
If you use Sundial as part of a team or organization, administrators and managers may have access to your activity data, call recordings, and performance analytics as part of the Service's intended functionality.
We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
Sundial's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data is never used to develop, improve, or train generalized AI and/or ML models. Certain AI models (e.g. voice-activity detection) run self-hosted within Sundial's own infrastructure; data processed by these models is handled locally and is never shared with the model provider.
To measure and improve our advertising, we may share limited information with advertising platforms such as Google and Meta when someone who came to us through an ad becomes a qualified lead or a customer: the ad-click identifier from your visit, the outcome and its value, and your email address and phone number in hashed (encrypted one-way) form, which the platform can only match against people it already knows. We do not share this information for anyone who has opted out of our marketing communications.
Many jurisdictions require consent from one or more parties before recording a telephone call. You are responsible for complying with all applicable call recording laws in your jurisdiction and the jurisdictions of the individuals you contact. The Service provides configurable disclosure announcements that can be played at the beginning of calls. We recommend consulting with legal counsel to ensure your use of call recording features complies with applicable laws.
We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods include: account information retained for the life of your account plus 30 days after deletion; contact data retained until you delete it or close your account; call recordings and transcriptions retained for 12 months; and activity logs retained for 24 months for security and audit purposes. After the applicable retention period, we delete or anonymize your information unless retention is required by law.
We implement industry-standard security measures to protect your information, including encryption of data in transit (TLS 1.2+) and at rest (AES-256), access controls and authentication requirements, regular security assessments and monitoring, and employee training on data protection. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
Depending on your location, you may have certain rights regarding your personal information:
You may request a copy of the personal information we hold about you in a structured, commonly used format.
You may update or correct inaccurate information through your account settings or by contacting us.
You may request deletion of your personal information, subject to certain legal exceptions. You can delete contact data and call recordings directly in the Service. To delete your account entirely, contact us at privacy@sundial.click.
You may disable call coaching features that process biometric data at any time through your account settings.
Where we rely on consent to process your information, you may withdraw that consent at any time. This will not affect the lawfulness of processing conducted prior to withdrawal.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
Categories of Information Collected: In the past 12 months, we have collected identifiers (name, email, phone number), commercial information (transaction history), biometric information (voice characteristics for call coaching), internet activity (usage data), and professional information (job title, company).
We do not sell personal information as defined under the CCPA/CPRA. To exercise your rights, contact us at privacy@sundial.click or submit a request through your account settings.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and similar laws:
Legal Bases for Processing: We process your information based on contractual necessity (to provide the Service), legitimate interests (to improve and secure the Service), consent (for biometric processing and marketing), and legal obligations (to comply with applicable laws).
Your Rights: You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. You also have the right to lodge a complaint with your local supervisory authority.
International Transfers: Your information may be transferred to and processed in the United States. We use Standard Contractual Clauses approved by the European Commission to protect data transferred outside the EEA.
If you use Sundial on behalf of a business, that business is the data controller for the contact data and call recordings stored in the Service, and we act as a data processor on their behalf. Our processing of such data is governed by our Data Processing Agreement, available upon request. If you are an end user whose information is stored in Sundial by a business customer, please contact that business directly regarding your privacy rights.
The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@sundial.click.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on our website and updating the "Last Updated" date. For significant changes, we will provide additional notice (such as email notification). Your continued use of the Service after such changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:
Email: privacy@sundial.click
Website: www.sundial.click
To submit a data subject access request, please email privacy@sundial.click with "Privacy Request" in the subject line.