Privacy policy

The short version

• You can use Sumocat without an account. Until you sign in, your records stay on your device.
• We use information to run Sumocat, support you, keep it secure and improve it.
• We do not sell your personal information, show ads, or track you across other companies’ apps and websites.
• You can turn off usage data, and delete your account and its records from the app.

What we collect

Information you give us

• Account details when you create an account, such as your name, email address and sign in details. If you use Sign in with Apple, we receive what Apple shares, which may be a private relay email.
• Your records once you sign in and sync, such as clients, invoices, estimates, payments, expenses, saved items and settings.
• Receipt images if you use receipt backup.
• Messages you send us, such as support requests.

Some information stays on your device and is not sent to us, such as your business profile and logo, and the records you create before you sign in. Receipt scanning reads the receipt on your device.

Information collected automatically

• Usage and diagnostics: how features are used, crash and error reports and performance information, with device type, operating system and app version, language and time zone. This information is designed not to include the names, contact details, amounts or text in your records.
• Purchase information needed to confirm your subscription. Payment card details for subscriptions are handled by Apple and never reach us.
• Notification tokens if you allow notifications, so we can send them to your device.
• Technical information any website or online service receives, such as IP address, browser type and request logs, used to deliver and secure Sumocat. The sumocat.app website does not use advertising or analytics cookies.
• Document activity, such as when a document you shared is viewed, accepted or paid, so we can show it to you.

How we use it

We use information to:

• provide Sumocat, including sync, backup, sharing, sending, reminders and the features you turn on
• confirm and manage subscriptions
• send you notifications and service messages, and respond to you
• keep Sumocat and its users safe, prevent fraud and abuse, and enforce our terms
• understand how Sumocat is used, fix problems and improve it
• meet legal obligations and protect our rights

We do not use your records for advertising, and we do not sell your personal information.

Information about your clients

The records you keep in Sumocat can include information about your clients and other people, such as names, contact details and what you bill them. We process that information on your behalf and on your instructions, to provide Sumocat to you. You are responsible for having a lawful basis and any notice or consent needed to give it to us. If one of your clients asks us about their information, we will refer them to you.

When you share a document or ask Sumocat to email it, your client receives it from Sumocat. Your clients do not need an account and are not Sumocat users.

When we share it

We share information only as follows:

• Service providers who help us run Sumocat, such as hosting, storage, email delivery, notification delivery, analytics and crash reporting, and customer support. They may use the information only to provide their services to us and must protect it.
• People you choose, such as clients you share documents with and members of your organization.
• Services you connect, described below.
• For legal reasons, when we believe in good faith that the law requires it, or to protect the rights, property or safety of Sumocat, our users or others.
• Business transfers, if we are involved in a merger, acquisition, financing or sale of assets, in which case this policy continues to apply to your information.
• With your consent, or in a form that does not identify you.

Services you connect

Some features work with services run by other companies, under their own terms and privacy policies. When you use them, information passes between Sumocat and that service as needed for the feature:

• Apple, for Sign in with Apple, App Store purchases and notifications.
• Stripe, if you connect your own Stripe account for online payments. Stripe collects the details it needs for your account, and your clients pay on Stripe’s pages; their card details never reach us.
• AI assistants you connect to your account. The assistant can access your organization’s records on your instructions, and what you share with it is governed by its provider’s policies.

We are not responsible for how those services handle information.

Your choices

• Use Sumocat without an account, and your records stay on your device.
• Turn off usage data and crash reports in the app, under Settings, Privacy, Share usage data.
• Turn notifications on or off in the app or in your device settings.
• Disconnect online payments or an AI assistant at any time.
• Delete your account from the app, in Settings under your account.

How long we keep it

We keep information for as long as your account is active and as long as needed for the purposes in this policy, then delete it or keep it only in a form that does not identify you. When you delete your account, we delete your account and the records of organizations only you belong to, within a reasonable time. Some information may remain for a limited period in backups and logs, or longer where the law requires it or to resolve disputes, prevent fraud and enforce our terms.

Deleting your account does not cancel a subscription bought through Apple. Cancel it in your Apple subscription settings.

Security

We use reasonable technical and organizational measures to protect information, including encryption in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your device and sign in details secure, and tell us promptly if you suspect unauthorized access.

Where it is processed

We are based in Canada. Our service providers may process information in Canada, the United States and other countries, whose laws may differ from those where you live. Where the law requires it, we use appropriate safeguards for these transfers.

Your rights

Depending on where you live, including the European Union, the United Kingdom, Canada and some US states, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict some processing. Where we rely on consent, you can withdraw it at any time.

Where the GDPR or UK GDPR applies, we process information to provide the service you asked for, for our legitimate interests in operating, securing and improving Sumocat, with your consent, and to meet legal obligations.

We do not sell or share personal information for cross context behavioral advertising, as those terms are defined in California law.

To make a request, email support@sumocat.app from the address on your account. We may need to verify your identity before acting on it, and we respond within the time the law requires. You can also complain to your local data protection authority.

Children

Sumocat is a business tool and is not directed at children under 16. We do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Changes and contact

We may update this policy. We will change the date at the top of this page and, for significant changes, tell you in the app or by email. If you keep using Sumocat after the changes take effect, the updated policy applies.

Small Factory Marketing Inc., Vancouver, British Columbia, Canada. Email support@sumocat.app.