Data processing agreement

Version 1.0, 6 November 2026.

1. Who and what

This agreement is between you, the customer who opens a workspace in Sumly (the controller), and the provider of Sumly (the processor):

Primož Cigoj s.p.
Cesta Andreja Bitenca 68, 1000 Ljubljana, Slovenia
Tax and VAT number SI45382263
Registration number 8856516000, Slovenian business register (AJPES), since 24 April 2021
Privacy and anything else: [email protected]

It is part of the terms and is accepted with them, by creating an account or using Sumly; no signature is needed. Where it and the terms differ about personal data, this agreement wins.

Data about the people who hold a Sumly account (their names, e-mail addresses and billing) is not covered here: for that Primož Cigoj s.p. is the controller, as the privacy page explains.

Sumly reads your payment providers and app stores, counts the visitors on your sites and apps, and shows you the result. In doing so it processes personal data on your behalf, as follows.

Subject and purpose: to show you and your team your revenue, customers and visitors, to answer your questions in Ask and over MCP, and to send the reports, notifications and monthly packages you turn on.
People concerned: your customers and buyers, the visitors to your sites and apps, and your app's users.
Duration: for as long as your workspace runs, and then until its data is deleted, as in section 6.
Kinds of data: customers' names, e-mail addresses, countries and payments as your providers return them; visitors' pages, referrers, campaign tags, country and city, device, browser and a random id (no IP address is stored); app users' ids and events your apps or server send.
Special categories: none are asked for. Do not send any.

2. What the processor does

Processes the data only on your documented instructions: these are the terms, this agreement and what you do in Sumly. If an instruction seems to break data protection law, we tell you.
Does not sell the data, use it for advertising, or train models on it.
Makes sure everyone who can reach the data is bound to keep it confidential.
Keeps the security measures in section 5.
Helps you answer requests from the people concerned (to see, correct, export or delete their data), as far as Sumly can.
Helps you with security, breach notices, impact assessments and consulting a supervisory authority, as far as it concerns Sumly.
Tells you of a personal data breach that touches your data without undue delay after we learn of it, with what we know then and more as we learn it.
Gives you what you need to show this agreement is kept, and allows audits as in section 7.

3. Sub-processors

You allow us to use the sub-processors listed on the sub-processors page. Each is bound by a written agreement with the same data protection duties as this one. Today they are:

Hetzner Online GmbH (Germany (EU)): the server that runs the site, the app's API, the visit collector and the databases.
Cloudflare, Inc. (Global network; United States company): dNS and the network in front of the site and the collector.
Mailgun Technologies, Inc. (EU region): e-mail: sign-in codes, team invitations, the reports you turn on and the monthly package to your accountant.
OpenAI, L.L.C. (United States): ask, the chat on the site.
Google LLC (Firebase Cloud Messaging) (United States): the app's notifications on Android.
Apple Inc. (Apple Push Notification service) (United States): the app's notifications on iPhone and iPad.

Your own payment providers and app stores are not sub-processors: Sumly only reads your data from them, with keys you give it. The same holds for any place you tell Sumly to send something, such as your own Discord channel.

Before we add or replace a sub-processor we say so on the sub-processors page at least 30 days ahead. If you object for a good reason and we cannot meet it, you may end the agreement and leave.

4. Outside the EU

The data is kept in Germany. Where a sub-processor in the United States handles it, the transfer rests on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

5. Security

The measures in place are described on the security page, and include:

read-only keys wherever the provider offers them, encrypted in the database with AES-256 and used only on the server;
HTTPS only, with HSTS, behind Cloudflare; the server in Germany, backed up every night to a separate machine, each backup kept up to 30 days;
sign-in with Google, a one-time code or Sign in with Apple, with no passwords stored;
roles and access by company or project for your team, and OAuth 2 for AI assistants;
no IP address stored for visitors, and no cookie without consent in the EU, the EEA, the UK and Switzerland.

We may improve these measures; we will not lower their level.

6. At the end

When you delete a project, a workspace or your account, its data is deleted at once. Raw visits are deleted after 25 months in any case. Before you delete, you can export your revenue and payments to CSV.

When a trial or a plan ends unpaid, the workspace locks:

That day: it becomes read-only. Nothing more is read from your providers, no visit is counted and nothing is sent. You and your team can still look at what is there and choose a plan.
A week before, and the day before, its data goes: the owner gets an e-mail.
Day 30: its projects and everything read for them are deleted. Your account and team stay, so a plan chosen later starts clean. Choosing a plan before then stops the clock.

Copies in the nightly backups are gone within 30 days, as the backups are replaced.

7. Audits

Ask us in writing how we keep to this agreement and we answer in writing within 30 days. If that is not enough, you or an auditor bound to confidentiality may audit us once a year, at your cost, with 30 days' notice, in a way that does not reach other customers' data.

8. Liability and law

Liability under this agreement follows the terms. Slovenian law applies, and the courts in Ljubljana decide disputes, without taking away what the GDPR gives the people concerned.

Questions about this agreement: [email protected].