Privacy Policy

Last updated: Friday, 9th of August, 2024

Introduction

This Privacy Policy sets out the basis on which we will process any Personal Data that we may collect about you as a visitor to our website at www.stunning.so or our customers or potential customers, or other business partners or in any other cases where we specifically state that this policy will apply. This policy further sets out how we protect your privacy and your rights in respect of our use of your Personal Data.

Who is the Data Controller?

A "data controller" is a person or organization who alone or jointly determines the purposes for which, and the manner in which, any personal data is, or is likely to be, processed. In this sense, Zeew OU of Voolu tn 20a, Nõmme linnaosa, 10918 Tallinn, Estonia ("Stunning", "we", "us", "our") is the data controller. If you have any questions about data protection at Stunning in general, you can reach us by email using [email protected] or our Contact Form.

What is Personal Data?

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute Personal Data.

Why Do We Have a Privacy Policy?

Estonia's Personal Data Protection Act ("PDPA") and the EU's General Data Protection Regulation ("GDPR") control how your Personal Data is used by us. We are also required to explain which Personal Data we collect from you via our website and shop, what we use it for, when we delete it and how your data is protected.

What Personal Data Do We Collect?

Collection of access data and log files

When you visit our website, we collect the Personal Data that your browser automatically transmits to our server. This is technically necessary for us to display our website and to ensure its stability and security. In this sense, we collect the following data:

  • •IP address of the requesting computer
  • •Date and time of access
  • •Name and URL of the file accessed
  • •Website from which the access was made (referrer URL)
  • •Browser used and, if applicable, the operating system of your device as well as the name of your access provider

Hosting

To provide our website, we use the services of Azure (Microsoft) who process the below-mentioned data and all data to be processed in connection with the operation of our platform on our behalf.

Content Management System

We also use the Content Management System (CMS) of Shuffle to publish and maintain the created and edited content and texts on our website. This means that all content and texts submitted to us by our users is transferred to our Azure server.

Cookies

For the processing of personal data using cookies and similar technologies on our website, please refer to our Cookie Policy. The legal basis for the use of cookies is our legitimate interest or your consent when you agree to the use of technically non-essential cookies.

Cookie consent

As set out in Estonia's Electronic Communications Act ("ECA") and the EU's Privacy and Electronic Communications Directive ("PECD"), we need to obtain consent for the use of technically non-essential cookies.

Fonts

We use Google Fonts by Google on our website to display external fonts. To enable the display of certain fonts on our website, a connection to a Google server is established when our website is accessed.

Google Maps

Our website uses Google Maps API to visually display geographical information. When using Google Maps, Google also collects, processes and uses data about visitors' use of the map functions.

YouTube Videos

We have integrated videos from YouTube (Google). The integration requires that YouTube can perceive the IP address of the user. The IP address is required in order to send the video content to the user's browser.

Analytics

For business reasons, we analyze the data we have on web and server traffic patterns, website interactions, browsing behavior etc. The analyses serve us alone and are not disclosed externally and processed using anonymous analyses with summarized and or anonymized values.

Working with Us

If you wish to use our AI powered website development services, we process the data you provide which typically includes Personal Data and non-personal data ("Service Data"). We recognise that you own your Service Data and provide you with complete control over your Service Data by providing you the ability to:

  • •Access your Service Data
  • •Share your Service Data
  • •Request export or deletion of your Service Data

When we process Service Data, we become your Data Processor or in other words, we will process the Service Data involved in your use of our AI powered website development services in accordance with your instructions and shall use it only for the purpose of providing you our services.

We ensure that access by our employees to your data is only available on a need-to-know basis, restricted to specific individuals, and is logged and audited. We communicate our privacy and security guidelines to our employees and enforce privacy and protection safeguards strictly.

Payment Data

If you make a purchase your payment data will be processed via our payment service providers Stripe and PayPal. Payment data will solely be processed through Stripe/PayPal (as chosen by you) and we have no access to any Payment Data you may submit. The legal basis for the provision of a payment system is the establishment and implementation of the contract.

Administration

We process data in the context of administrative tasks as well as organization of our business, and compliance with legal obligations, such as archiving. In this regard, we process the same data that we process in the course of providing our contractual services. The processing bases are our legal obligations and our legitimate interest.

Promotional Use of Your Data

We use your data within the legally permissible scope for marketing purposes, e.g., to draw your attention to special promotions and discount offers via email. In addition, we reserve the right to use your first and last name as well as your postal address for our own advertising purposes, e.g., to send you interesting offers and information about our products by post. This serves to protect our legitimate interests.

Affiliate Registration

Affiliate Registration requires some Personal Data and the acceptance of our Affiliate Program Terms. The following information is collected and stored by us: Name, Email, Password. Full registration is necessary to use our Affiliate services and we use the affiliate management platform of Rewardful. The processing of your Personal Data is based on your consent.

Newsletter

If you register for our newsletter, we use your email address to send you our email newsletter on a regular basis on the basis of your consent. Unsubscribing from the newsletter is possible at any time and can be done via the unsubscribe link provided in each newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration.

Disclosures of Your Personal Data

We will not disclose or otherwise distribute your Personal Data to third parties unless this is:

  • •Necessary for the performance of our services
  • •You have consented to the disclosure
  • •We are legally obliged to do so

International Transfer

We may transfer your Personal Data to other companies as necessary for the purposes described in this Privacy Policy. In order to provide adequate protection for your Personal Data when it is transferred, we have contractual arrangements regarding such transfers. We take all reasonable technical and organizational measures to protect the Personal Data we transfer.

Social Media

We are present on social media (currently, X (formerly Twitter) and LinkedIn). If you contact or connect with us via social media, we and the relevant social media platform are jointly responsible for the processing of your data and enter into a so-called joint controller agreement.

When you visit our social media profiles, we, as the operator of the profile, process your actions and interactions with our profile (e.g., the content of your messages, enquiries, posts or comments that you send to us or leave on our profile or when you like or share our posts) as well as your publicly viewable profile data (e.g., your name and profile picture).

Advertising

We would like to show you interesting advertising outside of our website and use various third-party tools and cookies for this purpose. These collect and process information about your activities on our website - for example, which products you are interested in or which pages you visit.

Through the tools, your browser regularly establishes a connection to the server of the tool provider when you visit our website. For some tools, we have no direct influence on what data is processed by the providers.

Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.

Data Security

We take appropriate organizational, technical, and physical measures to help safeguard against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of, or access to, the Personal Data we collect and process.

Linked Sites

For your convenience, there may be hyperlinks on our website that link to other websites. We are not responsible for, and this Privacy Policy does not apply to the privacy practices of any linked websites or of any companies that we do not own or control.

We do not endorse any of these linked websites, their products, services, or any of the content on their websites. We encourage you to seek and read the Privacy Policy of each linked website that you visit to understand how the information that is collected about you is used and protected.

Your Rights and Privileges

Privacy Rights

You can exercise the following rights:

  • •The right to access
  • •The right to rectification
  • •The right to erasure
  • •The right to restrict processing
  • •The right to object to processing
  • •The right to data portability

Stunning Cowork Browser Extension

Stunning Cowork is our Chrome extension that carries out tasks in your browser on your instruction. This section explains what it reads, what leaves your machine, and what we keep. Everything else in this policy applies to it too.

The short version

  • •The extension does nothing until you type a task. It is not a background monitor and does not watch your browsing.
  • •When you give it a task, the contents of the page it is working on are sent to Stunning's servers so the AI can decide the next step.
  • •It never sends passwords or payment details. It refuses to type into those fields at all.
  • •We do not sell your data, and we do not use it to train models.

Permissions it asks for

  • •Side panel — draws the Stunning Cowork panel beside the page.
  • •Tabs and tab groups — opens the tab it works in, keeps track of which tab is its own, and groups it so its work is visibly separate from yours.
  • •Scripting and access to all sites — reads the page it is acting on and performs the clicks and typing you asked for. Broad access is required because you may ask it to work on any website; the extension cannot know in advance which ones.
  • •Storage — remembers your settings (workspace, language, model, approval mode) and your recent conversations, locally in your browser.
  • •Debugger — lets the agent send a real mouse click or real keystrokes to the page it is working on, for sites that ignore simulated input (Gmail, WhatsApp Web, Notion and similar). Attached only to the agent's own tab, only while your task runs; Chrome shows a "started debugging" bar the whole time. Never used to read data or run code.
  • •Web navigation — lists the frames of the agent's own tab so forms embedded in an iframe (payment boxes, booking widgets) can be filled. Nothing about your navigation is recorded.

What is sent to Stunning

Only while a task is running, and only for the tab the agent is working in:

  • •The text and interactive elements of that page (links, buttons, fields), so the AI can decide what to do next.
  • •A screenshot of that tab, when a picture is needed to understand the page or when the agent appears stuck.
  • •Your instruction and the conversation for that task.
  • •Your Stunning account token, to authenticate you and bill the task to your workspace.
  • •The titles and domains of your other open tabs on the first step of a task, as context — domains only, never full URLs.

This is processed by Stunning and by the AI model provider that runs your chosen model (Anthropic, DeepSeek or Z.ai). Providers process it to produce the response; they do not use it to train their models.

What is never sent

  • •Passwords, card numbers, CVV codes and similar fields. The extension detects these and refuses to type into them — it stops and asks you to enter them yourself.
  • •Pages you are simply browsing while no task is running.
  • •Anything from tabs the agent does not own, beyond the title and domain described above.

Connected apps, storage and your choices

  • •If you connect an app (Gmail, Slack, Google Calendar and similar), that connection is held by our integration provider, Composio. Actions that change something — sending, posting, deleting, paying — ask for your approval first unless you chose "Act without asking". You can disconnect any app at any time from your Stunning account.
  • •In your browser we keep your settings and recent conversations; on our servers, a short record of each completed task in your workspace's shared memory (visible and deletable under Setup → Memory) and the usage records needed to bill credits.
  • •Stop halts a running task immediately. Removing the extension stops all collection and deletes everything it stored locally. The extension is for business use and is not directed at children under 13.

Help and Complaints

If you have any questions about this policy or the information we hold about you please contact us by email using [email protected] or our Contact Form.

Changes

The first version of this policy was issued on Friday, 9th of August, 2024 and is the current version. Any prior versions are invalid and if we make changes to this policy, we will revise the effective date.