Privacy Policy

Sunday Morning LLC, a South Dakota limited liability company doing business as Liiminal ("Liiminal," "we," "us"), operates the Liiminal platform: an intelligence service for lifecycle and email sending programs. You can reach us at legal@liiminal.com.

This policy covers the Liiminal platform, the liiminal.com website, and our sales and marketing activity. It does not cover the Lifecycle Department consultancy website at lifecycledept.com, which has its own privacy policy.

We handle personal data in two distinct roles, and your rights differ depending on which applies.

We are a controller for personal data about the people who use Liiminal: account holders, workspace members, prospects, and website visitors. That means we decide how it is used, and this policy governs it.

We are a processor for the data the platform retrieves from a customer's connected sending platforms, including contact-level data about that customer's own email recipients. The customer is the controller of that data. We process it only on the customer's instructions, under our Data Processing Agreement. If you are an email recipient of one of our customers and want to exercise a right over your data, contact that company directly. We will forward any request we receive to the relevant customer.

This section, together with sections 5 and 10, is our notice at collection under California law. We make it available at or before the point at which we collect personal information.

Customers control how much contact-level data the platform ingests by selecting one of three modes in account settings, changeable at any time.

Pseudonymized mode reduces the personal data we hold. It is not anonymization under the GDPR and not de-identification under HIPAA, because hashed identifiers that stay linked to a persistent event history remain personal data. Some features are limited in Pseudonymized and None mode.

• To provide, operate, secure, and support the platform.
• To authenticate users and administer accounts and workspaces.
• To produce findings, alerts, and recommendations for the customer whose data it is.
• To communicate about the service, including security and legal notices.
• To respond to enquiries and provide support.
• To bill customers and collect payment.
• To detect, prevent, and address fraud, abuse, and security incidents.
• To market our products to business contacts and prospective customers.
• To comply with legal obligations and enforce our agreements.

We do not use a customer's contact-level data in identifiable form for the benefit of any other customer.

We create aggregated, de-identified data from use of the platform, such as benchmarks and measurements of how accurately our detections perform. Before any such data is used beyond the account it came from, direct identifiers are removed and the data is aggregated so that it does not identify any customer, user, or individual and cannot reasonably be used to do so.

We own this aggregated and de-identified data and use it to operate, improve, and market the platform, including to train and evaluate detection models. Customers can opt out of the use of their data for model training by emailing legal@liiminal.com. We apply the opt-out to future model training within 30 days of the request.

Where the GDPR or UK GDPR applies and we act as a controller, we rely on:

Where we act as a processor, the customer is responsible for establishing a legal basis for the data it instructs us to process.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are used in United States state privacy laws.

We share information with service providers that host and operate the platform. This is our current list. We give customers at least 30 days' notice before adding a new provider that processes customer data, by updating this page and emailing workspace administrators.

We also share information with professional advisors, with an acquirer in connection with a merger or sale of assets, and where required by law or to protect our rights.

We and our service providers are established in the United States and process data there. Where personal data is transferred from the EEA, the United Kingdom, or Switzerland to the United States, we rely on the European Commission's standard contractual clauses, with the UK International Data Transfer Addendum where applicable, as set out in our Data Processing Agreement.

We keep account data for as long as your account is active and for as long afterwards as we need it for legal, tax, and accounting purposes.

When a customer disconnects a sending platform, we stop retrieving data from it. Within 30 days after an account ends, we delete customer data from active systems. Backups containing that data are overwritten on our normal cycle and no later than 90 days after the account ends. We certify deletion in writing on request.

We retain aggregated and de-identified data after an account ends, as described in section 6.

These are the criteria we apply by category.

We do not collect sensitive personal information, as that term is defined under United States state privacy laws, for our own purposes. Where a customer's connected platform contains data that a state law treats as sensitive, we process it only as that customer's processor and only on their instructions. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit.

We maintain administrative, technical, and physical safeguards designed to protect personal data. These include encryption in transit and at rest, encrypted storage of platform credentials, access controls designed to restrict each workspace's data to that workspace's members, access limited to personnel who need it, logging, and automated scanning of our code and dependencies. We are pursuing SOC 2 Type II and will publish the report when it is available. No security program eliminates risk entirely, and we do not guarantee that unauthorized access will never occur.

If we confirm unauthorized access to personal data, we notify affected customers without undue delay.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, and opt out of marketing. You also have the right not to be discriminated against for exercising these rights.

To make a request, email legal@liiminal.com. We respond within the period the applicable law allows, which is one month under the GDPR and UK GDPR and 45 days under most United States state privacy laws, and we will tell you if we need an extension. We may ask you to verify your identity. You can use an authorized agent where the law allows it.

If you are in the EEA, the UK, or Switzerland, you can also complain to your local supervisory authority.

If your request concerns data we process on behalf of a customer, see section 2.

We use cookies and similar technologies that are necessary for the platform to work, including to keep you signed in, and we use PostHog for product analytics. Where consent is required, we ask for it before setting non-essential cookies, and you can change your choice at any time. You can also control cookies in your browser, though some features will not work if you block them.

The platform is for business use. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, email legal@liiminal.com and we will delete it.

We may update this policy. We will change the date at the top and, for material changes affecting the platform, notify workspace administrators by email at least 30 days before the change takes effect.

Privacy questions and rights requests: legal@liiminal.com. If you need to reach us by post, email us and we will provide a mailing address.