LEGAL

Privacy policy

Effective August 2026 · Applies to the Sumu app and website

Preamble

We, Sumu, (hereinafter "we", "us", or "sumu"), are the provider of the application "sumu" (hereinafter "sumu" or the "App"), an AI‑first daily planner that you can download to your device or use as a web app. sumu helps you capture a brain dump, turn it into a planned daily timeline with the help of AI, execute your day with a focus timer, and stay motivated with streaks and trophies. sumu stores your data locally on your device and can synchronize it across your devices when you sign in.

The protection of your privacy when using sumu is very important to us. With this Privacy Policy, we inform you about what personal data we process when you use sumu and our website, how we handle that data, why we process it, and the legal bases for doing so. Where processing is necessary to protect our legitimate interests, we also describe those interests.

You can access this Privacy Policy at any time within sumu under Settings → Privacy → Privacy Policy, and on our website at https://getsumuapp.com/privacy.

1. Controller and Contact

We are the controller responsible for the processing of your personal data described in this Privacy Policy.

2. Overview: sumu is Local‑First

sumu is designed to be local‑first. Your tasks, notes, plans, focus sessions, streaks, and settings are created and stored on your device first. This means much of your content stays on your device unless you choose to enable an account and cloud sync.

The personal data we process falls into these broad categories, each described in detail below:

  • Data stored locally on your device (Section 3.1);
  • Data processed when you create an account and sync across devices (Section 3.2);
  • Data processed when you use sumu's AI features (Section 3.3);
  • Data processed when you connect your calendar (Section 3.4);
  • Data processed for subscriptions and payments (Section 3.5);
  • Usage, diagnostics, and device data (Section 3.6);
  • Push notifications (Section 3.7);
  • Data processed when you download sumu from an app store (Section 3.8);
  • Data collected when you visit our website (Section 3.9);
  • Data processed when you contact us (Section 3.10).

3. What Data We Process and Why

3.1 Data You Enter and Store in sumu

When using sumu, you can enter, manage, and edit tasks, brain‑dump text, notes, steps, plans, calendar‑style events, focus sessions, and settings. These entries may contain personal data, for example names, addresses, email addresses, phone numbers, or any other information you choose to type into a task or note. We process (in particular, store) this data so you can use the App's planning features.

By default this content is stored locally on your device. If you enable cloud sync (Section 3.2), it is also processed on our infrastructure to synchronize it across your devices.

Purpose: to provide the core planning, timeline, focus‑timer, streak, and trophy functionality of sumu. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b) GDPR.

3.2 Account Registration and Cloud Sync

When you create a sumu account, we process your email address and a securely hashed representation of your password (or the credentials from a third‑party sign‑in provider you use, such as Apple or Google, if offered). We use these credentials to authenticate you when you sign in.

When cloud sync is enabled, we process the data you enter in sumu (Section 3.1) in order to store it and synchronize it between your devices, on your behalf and according to your use of the App. We have no influence over the specific personal data you choose to enter or the categories of data subjects it may relate to.

Our authentication and database services are provided by a third‑party cloud infrastructure provider acting as our processor on our instructions (see Section 4).

Purpose: to authenticate you and provide cloud backup and cross‑device synchronization. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b) GDPR.

3.3 AI Features (Brain‑Dump Parsing, Planning, Task Breakdown, and Chat)

sumu offers AI‑powered features, including: parsing your brain‑dump text into structured tasks, planning your day into a timeline, breaking a task into smaller steps, and an AI chat/assistant. When you use these features, the relevant content you submit (your "AI prompt", for example brain‑dump text, task titles and details, and related context needed to fulfill your request) is transmitted to a third‑party provider of AI foundation models, acting as our processor, and the AI‑generated result is returned to you.

We do not use your AI prompts or their content to train AI models, and our AI providers are contractually instructed not to use them for model training.

To generate a result, your AI prompt is shared with third‑party providers of AI foundation models who process it on our behalf as our processors. These providers act on our instructions and are contractually prohibited from using your content for their own purposes, including model training. We may add or change AI providers as sumu develops; every provider we use is bound by the same restrictions. See Section 4.

Purpose: to provide sumu's AI planning, breakdown, and assistant features. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b) GDPR.

Important: AI‑generated suggestions may be inaccurate, incomplete, or unsuitable. You are responsible for reviewing AI output before relying on it. See our Terms and Conditions for the applicable disclaimers.

3.4 Calendar Integration (Apple Calendar / EventKit)

If you choose to connect your calendar (for example, Apple Calendar via Apple's EventKit), sumu will, with your permission, read and/or write calendar events so they can appear alongside your planned timeline. Calendar access is requested through your device's operating system, and you can grant or revoke it at any time in your device settings. Calendar data accessed on your device is processed to display and manage your schedule within sumu.

Purpose: to integrate your existing calendar events with your sumu plan. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b) GDPR; where the operating system requires it, your consent given through the OS permission prompt, Art. 6(1)(a) GDPR.

3.5 Subscriptions and Payments (sumu Pro)

sumu is offered in a free version and a paid subscription version ("sumu Pro"). All purchases and subscriptions are processed by the Apple App Store. Payment card details and billing information are handled entirely by Apple. We do not receive or store your payment card details. We may receive limited transaction data such as your subscription status, plan, purchase/renewal dates, and a purchase or transaction identifier, so we can enable Pro features on your account.

Purpose: to provide and manage paid subscriptions and unlock Pro features. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b) GDPR.

3.6 Usage, Diagnostics, and Device Data

To operate, secure, and improve sumu, we may process limited technical and usage data, which may include: device type and operating‑system version, app version, language and locale, app settings, crash reports and error logs, and aggregated usage information (for example, streak counts, focus‑session activity, or feature usage). We do not currently use any third‑party analytics, tracking, or crash‑reporting service in sumu. If we introduce one in future, it will act on our behalf on the terms described in Section 4, and we will update this Privacy Policy before we begin using it.

Purpose: to ensure stability and security, diagnose and fix errors, and improve the App. Legal basis (GDPR): our legitimate interests in operating, securing, and improving sumu, Art. 6(1)(f) GDPR; where required, your consent, Art. 6(1)(a) GDPR.

3.7 Push Notifications and Reminders

If you enable notifications, sumu can send reminders and alerts (for example, for tasks, focus sessions, and streaks). Local reminders are scheduled on your device. If we send remote push notifications, they are delivered through the platform's push service (Apple Push Notification service and/or Firebase Cloud Messaging), which requires a device push token. You can disable notifications at any time in your device settings.

Purpose: to deliver reminders and alerts you have enabled. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b) GDPR; where required, your consent, Art. 6(1)(a) GDPR.

3.8 Data Processed When You Download sumu

When you download sumu, certain information is transmitted to the relevant app store, for example your user name, email address, customer/account number, the time of download, payment information, and a device identifier. This data is processed by the respective app store and is outside our control. Please refer to the app store's own privacy policy.

3.9 Data Collected When You Visit Our Website (getsumuapp.com)

When you visit our website, your browser automatically transmits certain information to our server, which may be temporarily stored in a log file, including:

  • the IP address of the requesting device, and device type/identifier;
  • the name of the file retrieved and the amount of data transferred, and the date and time of retrieval;
  • notification of successful retrieval;
  • the requesting domain;
  • the browser type and, where applicable, the operating system and access provider;
  • standard weblog information.

Purpose: to enable a reliable and secure connection, to evaluate system security and stability, and for internal statistical purposes. Your IP address is analyzed only in the event of attacks on our infrastructure and for statistical purposes. Legal basis (GDPR): our legitimate interests, Art. 6(1)(f) GDPR.

Cookies and analytics: We do not set cookies on our website, and we do not use web analytics, advertising, or tracking technologies. If this changes, we will update this Privacy Policy and, where consent is required, ask for it before setting any non‑essential cookies.

3.10 Data Processed When You Contact Us

When you contact us (for example by email, contact form, or social media), we process the personal data you provide in order to handle and respond to your request. We delete such inquiries when they are no longer required, subject to any statutory retention obligations.

Legal basis (GDPR): performance of a contract, Art. 6(1)(b) GDPR, and/or our legitimate interest in handling inquiries, Art. 6(1)(f) GDPR.

4. Disclosure of Data

We never sell your personal data, and neither we nor any provider we work with uses your data to train AI models.

To operate sumu, we share personal data with third‑party service providers who process it on our behalf. They act only on our instructions, may use the data only to provide the service we have engaged them for, and are contractually bound to keep it confidential and to protect it with appropriate technical and organizational measures. If you would like more detail about the providers we use, contact us using the details in Section 1.

Apart from this, we disclose personal data only where permitted or required by law, for example to comply with a legal obligation under Art. 6(1)(c) GDPR, or to protect our legitimate interests such as enforcing our terms or responding to unlawful activity under Art. 6(1)(f) GDPR.

Where we transfer personal data to countries outside the EU/EEA, we use the European Commission's Standard Contractual Clauses or other appropriate safeguards under Chapter V GDPR to protect your data.

5. International Data Transfers

Some of our processors are located outside your country of residence. Your personal data may therefore be transferred to and processed in a country that may not provide the same level of data protection as your own. Where required, we implement appropriate safeguards (such as the EU Standard Contractual Clauses) for these transfers. You may request a copy of the relevant safeguards using the contact details in Section 1.

6. Data Retention

We delete or anonymize your personal data as soon as it is no longer required for the purposes for which we collected or used it. Unless otherwise stated:

  • Account and synced data is retained for the duration of your account. When you delete your account, we delete or anonymize your synced personal data, and any backup copies within a period of up to 30 days, unless we are required to retain data longer to comply with legal obligations or to establish, exercise, or defend legal claims.
  • Locally stored data remains on your device until you delete it, delete your local data, or uninstall the App.
  • AI prompts submitted to our AI processor are processed to generate a result and are handled according to our agreement with that processor; we do not retain them for model training.
  • Website server logs are retained only as long as necessary for the purposes in Section 3.9.

7. Data Security

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse. Data transmitted between your device and our servers is encrypted in transit using TLS. Passwords are stored using industry‑standard hashing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights (GDPR / UK GDPR)

If the GDPR or UK GDPR applies to you, you have the following rights regarding your personal data:

  • Right of access (Art. 15): to obtain confirmation of whether we process your data and to access it.
  • Right to rectification (Art. 16): to have inaccurate data corrected and incomplete data completed.
  • Right to erasure (Art. 17): to have your data deleted where the conditions are met.
  • Right to restriction (Art. 18): to restrict processing in certain cases.
  • Right to data portability (Art. 20): to receive your data in a structured, commonly used, machine‑readable format, or to have it transmitted to another controller.
  • Right to withdraw consent (Art. 7(3)): where processing is based on consent, to withdraw it at any time with effect for the future.
  • Right to object (Art. 21): to object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop processing unless we have compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend legal claims.

To exercise your rights, contact us using the details in Section 1.

Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA Member State of your habitual residence, place of work, or the place of the alleged infringement.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident and the CCPA/CPRA applies, you have the right to:

  • Know / access the categories and specific pieces of personal information we have collected about you;
  • Delete personal information we have collected, subject to exceptions;
  • Correct inaccurate personal information;
  • Opt out of the "sale" or "sharing" of personal information. We do not sell your personal information and do not share it for cross‑context behavioral advertising;
  • Limit the use of sensitive personal information, where applicable;
  • Non‑discrimination for exercising your rights.

To exercise these rights, contact us using the details in Section 1. We will verify your request as required by law. You may use an authorized agent to submit a request on your behalf.

10. Your Rights Under the Nigeria Data Protection Act (NDPA 2023)

sumu is provided by Sumu Labs, established in Nigeria, and our processing of personal data is subject to the Nigeria Data Protection Act 2023 (the "NDPA"). We process personal data on the lawful bases set out in the NDPA, principally the performance of our contract with you, our legitimate interests, compliance with a legal obligation, and, where stated in this Privacy Policy, your consent.

As a data subject under the NDPA, you have the right to:

  • be informed about how and why your personal data is processed;
  • access the personal data we hold about you;
  • rectify personal data that is inaccurate, and complete data that is incomplete;
  • request deletion of your personal data where the conditions of the NDPA are met;
  • object to processing, and to request restriction of processing, in the circumstances the NDPA provides;
  • data portability: to receive your personal data in a structured, commonly used, machine‑readable format, and to have it transmitted to another data controller where technically feasible;
  • withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us using the details in Section 1. If you believe we have processed your personal data unlawfully, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).

11. Children's Privacy

sumu is not directed to children under the age of 16, and we do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to sumu or to legal requirements. We will publish the updated version in the App and on our website with a new effective date. Where changes are material, we will notify you by an appropriate means. Please review this Privacy Policy periodically.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us at privacy@getsumuapp.com.

Effective Date: August 2026