Privacy Policy

Who we are and what this policy covers

Sumly is operated by Sumly Ltd, a company registered in Cyprus with registration number HE498829. This policy covers our websites, the Sumly accounting application, customer accounts, support, sales and the professional or administrative services we arrange or provide. Together, we call these the "Services".

It applies when you visit our website, use the application, contact us, buy or ask about a Service, work with us, or appear in information that a customer or service partner gives us. It does not replace the privacy notice of a bank, government body, independent professional or other third party whose service you use.

When Sumly is a controller and when it is a processor

For the website, account administration, billing, our direct relationship with you, security, marketing and Services that Sumly delivers for its own stated purposes, Sumly decides why and how personal data is used. In those cases, Sumly is the data controller.

A business using the application may also add personal data about its customers, suppliers, workers, directors, shareholders and other people. That business normally decides why the data is used and acts as the controller. Sumly processes the data on its instructions under our agreement with that business. If your data is held in a customer's Sumly account, you should usually send privacy requests to that customer. We will help the customer respond where required.

Personal data we collect

The data depends on which part of Sumly you use. It may include:

Identity and contact data. Your name, email address, telephone number, postal address, job title and preferred language.
Account and business data. Login and account details, preferences, permissions, company details, registration numbers, tax numbers, business contacts and information about authorised users.
Accounting and financial data. Bank transactions and balances, invoices, receipts, expenses, payments, tax records, payroll or employment records, counterparty details and other information added to the application or given to us for a Service.
Service and verification data. Depending on the Service, this may include identification documents, proof of address, date of birth, nationality, tax residence, signatures, ownership and management information, application forms and correspondence with professional advisers or public authorities.
Documents and communications. Files you upload or send, emails, messages, support requests, meeting notes, feedback and records of our work for you.
Payment and subscription data. Your plan, billing contact, invoices, payment status and payment details. When a payment provider collects full card details directly, its own privacy notice also applies.
Technical and usage data. IP address, device and browser information, login and security events, pages or screens viewed, clicks, feature use, referral information, approximate location derived from an IP address, error reports and online identifiers.
Marketing data. Communication preferences, campaign and conversion information, and interactions with our website, application or advertising.

Documents may sometimes contain sensitive personal data or information about people other than the person who gives them to us. Please only provide personal data that is needed and that you are authorised to share. Where sensitive data is necessary, we process it only when the law allows and with safeguards suited to the risk.

Where personal data comes from

We may receive personal data:

directly from you or from an administrator of your Sumly account
from the business, employer or other customer that asked us to handle it
from services you connect, such as banks, open-banking providers, payment providers and other software integrations
from professional advisers, service partners, public authorities, public registers and other organisations involved in a Service
automatically from your device through logs, cookies, pixels and similar technologies

Why we use personal data and our legal bases

We use personal data only when we have a lawful reason. The main reasons are:

To take steps before a contract and perform it. This covers creating and managing an account, providing the application and Services, processing connected data, handling payments, communicating with you and providing support.
To comply with legal obligations. This may include tax, accounting, company, employment, record-keeping and, where applicable, identity verification, anti-money laundering or requests from courts and public authorities.
For our legitimate interests. These include securing and operating Sumly, preventing fraud and misuse, troubleshooting, improving the Services, understanding business performance, managing customer relationships, protecting legal rights and sending relevant business communications where the law permits. We weigh these interests against your rights before relying on this basis. Improving the Services never includes training AI models on your data.
With your consent. We use consent for optional marketing, analytics or advertising technologies where the law requires it, and for other specific purposes we explain when asking. You can withdraw consent at any time.

Some information is required to create an account, provide a requested Service or meet a legal obligation. If you do not provide it, we may be unable to open the account, complete the work or continue providing the relevant Service. We will tell you when this applies.

How we use AI

Inside the Sumly application, AI features read the invoices, receipts and other documents you add, suggest how to book them and answer questions you ask about your books. When an AI provider does this work for us, we use it only in a configuration with zero data retention. The provider processes the content to return a result to us and does not keep it afterwards.

We never use your personal data, documents or communications to train, fine-tune or otherwise improve any AI model, whether it is ours or a provider's. Our AI providers are not allowed to use them for that purpose either.

People carry out our company formation, tax registration and tax residency work. We do not use AI to process your documents or personal data in those services. Our team may use AI tools for general work, such as drafting or research, but never with personal data or information about a specific client.

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Sumly prepares tax returns, and a person reviews and submits each one. On Base that person is you. On Premium it is your Sumly certified bookkeeper.

Cookies, pixels and analytics

Our website and application use cookies, tags, pixels, software development kits and similar technologies. Some are needed for login, security, preferences and core functionality. Others help us see how people find and use Sumly, diagnose problems, measure whether advertising works and improve the experience.

These technologies may collect or generate:

online identifiers and cookie or device IDs
IP address, browser, device and approximate location information
pages, screens, buttons and features used
referring links, campaign information, signups and other conversion events

We use first-party analytics and may use advertising measurement tools, including Google Ads, to understand campaign performance. Google and other providers may receive online identifiers and information about visits or conversion events. For some of their processing, they may act as separate controllers under their own privacy policies.

Where consent is required for non-essential tracking, consent is our legal basis. You can refuse or withdraw consent without losing access to core Services. You can also block or delete cookies through your browser or device settings, though strictly necessary cookies may be needed for the application to work.

We do not sell personal data. We may share it with:

Technology providers. Hosting, storage, database, authentication, security, communications, support, document-processing, analytics and other suppliers that help us operate Sumly. This includes AI providers, which we use only with zero data retention.
Payment and financial providers. Payment processors, banks, open-banking providers and integrations used to provide a feature you request.
Professional and service partners. Bookkeepers, accountants, auditors, lawyers, corporate service providers and other specialists involved in a Service. Some act on our instructions. Others are independent controllers with their own professional and legal duties.
Your organisation. Account owners, administrators and authorised users may access data according to their permissions.
Authorities and legal recipients. Tax, company, employment and other public authorities, courts, regulators, law enforcement, insurers and advisers when required by law or needed to establish, exercise or defend legal claims.
Business transaction recipients. A buyer, investor or adviser if we consider a financing, reorganisation, sale or transfer of all or part of the business, subject to suitable confidentiality and data protection safeguards.

Service providers acting as our processors receive only the data needed for their work and must protect it under contract. When a third party acts as an independent controller, its own privacy notice also applies.

International transfers

Our application infrastructure, databases and customer data storage are located in the European Economic Area (EEA). Some service providers or recipients may still process personal data outside the EEA. Where this happens, we use a lawful transfer mechanism, such as a European Commission adequacy decision, standard contractual clauses or another safeguard permitted by data protection law. Contact us if you want information about the safeguards used for a particular transfer.

How long we keep personal data

We keep personal data only as long as needed for the purpose for which it was collected, to provide the Services, meet legal and professional record-keeping duties, resolve disputes, prevent fraud and enforce our agreements. There is no single period that fits every type of data.

Account and service data is generally kept while the account or Service is active and for a reasonable period afterwards.
Accounting, tax, company, payment, identity and compliance records may be kept for the period required by applicable law or professional obligations.
Support, security and technical records are kept for as long as needed to resolve issues, protect the Services and maintain reliable records.
Marketing data is kept until you opt out, withdraw consent or it is no longer useful for the stated purpose.

When data is no longer needed, we delete or anonymise it. Closing an account does not always mean immediate deletion because legal retention periods, active disputes, fraud prevention and backup cycles may still apply. Data we process for a customer is retained and deleted under our agreement with that customer, subject to applicable law.

How we protect personal data

We use technical and organisational measures designed for the sensitivity of the data and the risks involved. We restrict access to people and providers who need it for their work, require confidentiality and review the safeguards used by service providers. No online system can be guaranteed completely secure. If a personal data breach is likely to put your rights and freedoms at high risk, we will tell you without undue delay. If you believe your account or data may be at risk, contact us promptly.

Your data protection rights

Depending on the circumstances, you may have the right to:

be informed about how your personal data is used and access a copy of it
correct incomplete or inaccurate personal data
ask us to delete personal data
ask us to restrict how personal data is used
receive certain data in a portable, machine-readable format
object to processing based on legitimate interests
object at any time to personal data being used for direct marketing
withdraw consent at any time, without affecting earlier lawful processing
ask for human review where a decision with legal or similarly significant effects is made solely by automated means, where applicable

These rights are not absolute. For example, we may need to keep information to meet a legal obligation or defend a legal claim. We may ask for information to verify your identity before acting on a request. Exercising these rights is normally free of charge. We respond within one month, though the GDPR allows up to two more months for complex or multiple requests, and we will tell you if we need it.

To exercise a right, email support@sumly.cy. If the request concerns data controlled by a Sumly customer, we may refer you to that customer and help them handle the request.

Complaints

Please contact us first if you have a concern so we can try to resolve it. You also have the right to complain to the supervisory authority where you live or work, or where you believe a breach took place. In Cyprus, this is the Office of the Commissioner for Personal Data Protection.

Changes to this policy

We may update this policy when our Services, providers or legal obligations change. When we do, we change the date at the top of this page.

If we make a material change to our sub-processors or to how we use AI to process personal data, we will give at least 30 days' written notice before the change takes effect, sent to the email address registered with us. For other important changes, we will give notice by email or inside the application where appropriate.

Contact

For questions, requests or concerns about privacy, email support@sumly.cy.