Privacy Policy.

Information we collect

We may collect the contact details, project instructions, brand assets, files, workflow preferences and communications we need to provide our services.

How we use information

We use this information to produce client work, run workflows, communicate with clients, improve the service, and maintain safety and quality.

Client files and assets

We use client-provided files only in that client's workspace and for that client's project. We do not intentionally use one client's assets, credentials or brand voice in another client's workspace.

Third-party tools

Sundayable may use third-party tools for hosting, AI generation, analytics, storage or communications when needed to provide the service. These tools process information according to their own policies. The ones that run on this website are named in the next section.

Cookies, analytics and advertising

On the production website, Google Analytics loads through Google Tag Manager after the page becomes interactive, and the Meta pixel loads when the browser is idle. Both can set cookies. Preview sites, proofs and local development do not send visits to those production properties. There is no banner asking you first.

Google Analytics records which pages you opened, roughly where you are from your IP address, and what browser and device you used. The Meta pixel tells Meta that a browser visited this site, which is what lets us measure whether an ad we paid for led anywhere. Neither one receives your name, your email, or anything you type into the form or the chat — we keep those out on purpose.

Tag Manager also loads Google Ads’ conversion tag. If you came from one of our Google ads and then book a consultation, Google Ads is told that a booking happened, with a reference number for it. It does not get your name, your email, or anything you typed.

We also record a handful of actions as events: opening the chat, sending a message in it, clicking through to book a consultation, each step of the booking form (seeing the times, picking one, pressing confirm, and a short error code if it failed), and clicking a contact or email link. The event is the fact that it happened and the page it happened on. What you wrote is not part of it.

If you arrived from an ad, a campaign link or another website, we keep the first and most recent attribution details in your browser for up to 90 days. Those details can include UTM tags, an advertising click ID, the landing-page path, and the referring site with its query string removed. If you book a consultation, that record is stored with the booking so we can tell what led to it. Google Analytics also reads the campaign tags on the page you landed on.

The booking page is ours; nothing on it loads from a scheduling service. The realtor onboarding form loads its uploader and its styles from Vercel and from a public code host.

To switch this off: your browser can block or clear cookies, Google publishes an opt-out add-on for Analytics, and Meta's ad preferences control what it does with what it collects. Blocking any of it changes nothing about how this site works.

The contact form

The form on our contact page collects your name, your email address, your business name, your website, your phone number if you choose to give it, and whatever you write in the note. We use them to answer you and for nothing else — the form sends us an email and stops there. It doesn't go into a database, a CRM or a mailing list. The email sits in our inbox as long as we need it to answer you and to keep a record of the conversation; ask us to delete it and we will. Please don't put passwords, payment details or your own customers' information into it.

The GEO and SEO website check

When you submit a public website address, we read a small sample of its public pages and may send the homepage URL to Google's PageSpeed Insights API. We cache the public findings for 24 hours. The check does not send the site's content to an AI model or measure actual AI recommendations.

If you request the full report, we save your email, name, website, report and consent record in our website database, and create or update a contact in Sundayable HQ, our CRM. Resend delivers the report-link email. This is a request for that report, not a marketing subscription. We do not automatically create a sales task, assign an owner or schedule a follow-up.

For the report email only, we measure whether it was delivered, when it was first opened (a small image served from sundayable.com) and which of its links you used (each link passes through a short redirect on sundayable.com). The report page notes when it is viewed, when the PDF is downloaded and when a consultation link is used. These steps are saved with your report request in Sundayable HQ, so we can see whether the report helped and improve it. Report emails carry no advertising or third-party trackers, and this is not a marketing subscription.

Our server also sends these report steps to Google Analytics to count how the report is used. It uses an anonymous reference for each report, without your name, email, website address, private report link or anything you typed. These events are not used for personalized advertising. This server measurement does not depend on browser cookies; contact us to request deletion or discuss your privacy choices.

The website's report and encrypted contact copy expire after 30 days and are removed by daily cleanup. The CRM and delivered email retain the request as a relationship or delivery record; you can ask us to delete it. We store hashed IP and email counters to limit abuse, and remove old counters after two days. Cloudflare Turnstile may check that the form is being used by a person.

Your private report link grants access to its public-site findings, so share it only if you intend to. The report does not contain your name or email. Private report pages do not load our analytics or advertising tags and do not send their link as a referrer.

GEO MCP accounts and agent checks

GEO MCP uses the same verified Google or email sign-in account as the website check and GEO Quest. When you sign up, we create or update your contact in Sundayable HQ using your verified email, and record the source “GEO MCP”, your first-touch attribution when available, Terms acceptance and optional marketing choice. Marketing consent is separate and unchecked. Signing in again keeps your saved preference.

We use Cloudflare Turnstile, disposable-email checks, request limits and an audit log to prevent abuse. Personal agent tokens are shown once and stored as hashes. Agent checks store the requested public website, findings, account ownership, request-key hashes and timestamps. They use the shared website analyzer and 24-hour public-findings cache. The MCP tools do not start paid AI sampling, send report emails, create another lead, subscribe you to marketing or book a meeting.

HQ records landing visits, signup, token creation, the first MCP call, analyses and consultation clicks on your contact timeline. Our server mirrors these steps to Google Analytics with an anonymous reference, without your name, email, token, requested website or private report link. The token-management screen does not load advertising or browser analytics scripts.

MCP report access and personal tokens expire after 30 days. That expiry, or revoking a token, does not automatically delete stored results, audit records, consent records or token metadata. The website report cleanup described above does not cover these MCP records. Account deletion removes its token records; agent report records do not yet have an automatic deletion process. Contact hello@sundayable.com to request access, correction or deletion. Browser reports require the owning account; API reports require its active bearer token. Neither is a public share link.

GEO Quest progress and email sign-in

Levels 1–2 work without an account. To continue, sign in with Google or a link sent to the email address you provide. Each email link works once and expires after 15 minutes. We store a hash of the link, not the link itself, and expired link records are removed after one day.

Guest progress stays in your browser. Once you sign in, we encrypt your saved progress in our database so you can resume on another device. Our CRM records the source “GEO Quest”, sign-in method, language, level reached, score and your optional marketing choice. The game does not store passwords. Progress stays with your account until you request deletion or it is no longer needed.

We measure game starts, sign-in, level progress, completion and consultation clicks in our CRM and Google Analytics. Analytics receives only the step, language and learning progress, never your name, email, sign-in link or game answers. Sign-in emails use a first-party open image and redirect to measure delivery, opens and link use. Analytics receives an opaque reference for the game run, separate from your account identity. This does not opt you into marketing.

Signing in with Google

You can use Google to request your GEO report, save your GEO Quest progress or sign in to GEO MCP. Google shares your name, verified email and an account identifier. We verify the response on our server and save an encrypted name and email, a hashed account identifier and a secure session cookie for up to 30 days. We do not receive or store your Google password, and we do not request access to Gmail, Drive, Calendar or contacts.

The report email is sent because you request it. Optional GEO tips and offers require the separate, unchecked marketing consent box. We record your choice, its date and the wording version in our website database and CRM. You can withdraw marketing consent or request deletion by emailing hello@sundayable.com; marketing emails also include an unsubscribe link. Account and consent records are retained until you request deletion or they are no longer needed for the relationship.

Booking a consultation

The booking page asks for your name, email address, phone number, business name, and how you found us. Your website and a note about what you'd like to see are optional. When you confirm a time, we put the meeting on the calendar of the person you'll meet, and Google Calendar sends you the invite with the Google Meet link. That invite is the only thing that goes through Google. Which times are open comes from that person's calendar as busy or free; we don't read the rest of it.

The booking itself lives in our database with the time, what you entered, its attribution record, and a hashed version of your IP address that we keep to slow down spam. We email you a confirmation, a reminder the day before, and a link you can use to move or cancel the meeting. The booking and its current status also go into our CRM with your name, email, phone number, business name, and how you found us, so the person you meet can see each consultation and where it came from. Bookings are removed from our database eighteen months after the meeting; ask sooner and we'll delete it.

If a booking attempt fails, we may keep the contact details you submitted and the error for up to 120 days so we can troubleshoot and help you finish booking.

The chat on this site

What you type into the chat is sent to Anthropic, our AI provider, to write the answer, and it is processed under their policies. We don't store the conversation on our servers — it stays in your browser for the session and then it's gone. The chat does carry one card that asks for your name, email and website, for the free visibility check. That is the only thing in the chat that asks for contact details, it sends only when you fill it in and press the button, and it reaches the same inbox as the contact form. Please don't put passwords, payment details or your own customers' information into it.

Retention

We keep project materials as long as we need them to provide the service, maintain records and support recurring workflows. If you ask us to delete them, we will do so when legally permitted.

Security

We use reasonable technical and organizational safeguards, but no internet service can guarantee absolute security.

Your choices

You can request access, correction or deletion of your information by contacting Sundayable.

Contact

For privacy questions, email hello@sundayable.com.