Privacy Policy

This policy explains how Sundust Creative Studio processes your personal information in accordance with the Protection of Personal Information Act (POPIA).

Information we collect

Contact details (name, email, phone), booking and payment history, and any notes you provide. We collect this to respond to enquiries, manage bookings, process payments, and—where you consent—send you relevant updates.

How we use your information

To provide and manage our services: scheduling, payments, invoicing, reminders, and customer support. Marketing communications are sent only with your consent and you may opt out at any time.

Who we share it with (processors)

We use trusted service providers to operate the platform: our hosting provider (cPanel shared hosting, where the website and database are stored), Resend (email delivery), Google (analytics, calendar scheduling, and Google Drive storage for Sundust Gather — see below), and Meta (Pixel and analytics, only with your consent). When online payments are enabled, a payment gateway will process card payments on our behalf. Each provider processes data under their own terms.

Google Drive access (Sundust Gather)

If you use Sundust Gather to collect photographs from your guests, you connect your own Google account and we ask Google for a single permission: drive.file.

This is the narrowest Drive permission Google offers. It lets us see and manage only the files and folders this app itself creates in your Drive — the album folder we make for your event, and the photographs your guests upload into it. It gives us no ability to see, open or list anything else in your Drive. The rest of your Drive stays invisible to us.

We use that access solely to:

create the album folder and its published/hidden sub-folders in your Drive;
upload the photographs your guests submit into that folder;
show those photographs in your album page, and move a photo between the published and hidden folders when you publish or hide it.

The photographs stay yours and stay in your Drive.Sundust never holds the originals, and we do not copy them to our own storage. We store only what we need to run the album: the Drive file id, the file name, its size and dimensions, the uploader’s name if given, and whether the photo is published or hidden.

Your Google account’s access tokens are encrypted at rest (AES-GCM) and are used only to talk to Google on your behalf. We do not use Google user data for advertising, we do not sell it, and we do not use it to train any AI or machine-learning model. You can disconnect at any time from your account page, or revoke our access directly at myaccount.google.com/permissions. Revoking access stops all future syncing; the files themselves remain in your Drive, untouched.

Sundust’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention

We keep personal information only as long as necessary for the purposes above and to meet legal and tax obligations. Inactive records are reviewed and removed periodically.

Your rights

You may request access to, correction of, or deletion of your personal information. Contact us at our contact address and we will respond as required by POPIA.

Security

Data is transmitted over HTTPS and stored with access controls. We apply reasonable technical and organisational measures to protect your information.