Draft for legal review
The text below is a working draft that describes how SumWize handles data today. It has not been legally reviewed and is not yet the final privacy notice: the owner's legal review will complete it, including the details marked [to be completed].
1. Who we are
SumWize is an online bookkeeping service for companies in Cyprus. The organisation responsible for your personal data, its address and its contact for data protection questions: [to be completed].
2. Data we use to provide the service
Your account: your name, email address, language, a protected (hashed) version of your password, your two-step sign-in settings and your appearance preferences.
Your company's books: the records, documents, contacts and settings that you and your colleagues add. We store and process them to provide the service to your company, and only people your company has given access can see them.
Legal basis and roles for this data (for example, the contract with your company): [to be completed].
3. Essential security and operational records
To run the service and keep it secure, we always keep some records, whatever you choose about product analytics: sign-ins and other security events (with the time, IP address, browser and device type), your active sessions, and error reports from the servers.
These are used only to operate, protect and fix the service, and are kept separate from product analytics. Ended sessions are deleted after 90 days by default. Retention periods for the other records: [to be completed].
4. Optional product analytics
Purpose: to see which screens are used, where setup is left unfinished, which screens are slow, how often imports fail or documents can't be read (by general reason), when screens hit errors, and which help guides are opened, so we can improve SumWize.
Legal basis: your consent. It is off unless you choose "Allow product analytics", at registration or later under Privacy and analytics in your account menu. Choosing neither option, or "Don't allow", leaves it off, and declining never limits what you can do.
What is collected: only a fixed list of events, each with set values: the screen as a template (such as /app/sales/[id], never the record), a time band, a general error reason, a help guide's name or a setup step number. Never names, email addresses, amounts, tax or VAT numbers, IBANs, document contents, anything you type, or your questions to Ask AI.
Pseudonymisation: events carry no name, email, user id or company. Each event carries a code that changes every day, made one-way from your user id and a random daily key; each key is deleted after two days, after which that day's codes can no longer be linked to anyone.
Retention: events are deleted automatically 13 months after they were recorded. They are collected and stored by us, with no third-party trackers, no advertising and no session recording. Our staff see only weekly totals, and totals from fewer than five people are hidden.
Withdrawal: you can change your choice at any time under Privacy and analytics in your account menu. Collection stops as soon as you save. Events already collected can't be linked to you, so they can't be picked out individually; they are deleted when they reach 13 months. Every choice you make is recorded, with the date and the version of the explanation you saw.
5. AI processing
AI reading of documents and the AI model behind Ask AI are off by default. Data goes to an external AI provider only when both of these are true: we have approved that provider for that kind of data, and your company's owner has switched the AI feature on. Many Ask AI questions are answered from your books or the help without any AI provider.
When an AI provider is used, it receives only what the task needs: for example, the document being read or the question asked, with the context needed to answer it. We do not use your data to train AI models, and where requests go through a routing service we instruct it not to collect or keep the data for its own purposes.
The approved providers, where they process data, and the safeguards for transfers outside the EU: [to be completed].
6. Your rights
You can download a copy of your personal data from My security, ask us to correct it, and ask for your account to be closed. Where processing is based on consent, you can withdraw it at any time without affecting what was done before.
You can also complain to the Commissioner for Personal Data Protection in Cyprus. How to contact us about your rights: [to be completed].