Privacy

What Sumly is

Sumly shows the revenue and visitors of a person's own projects on one screen. It is used by the people who own those projects and by the people they let in. There is no public sign-up.

Who is responsible

Primož Cigoj, Slovenia runs Sumly and is the controller of the data described here. Write to [email protected] about anything on this page.

What we keep about you

• Google sign-in. Your e-mail address, name and profile picture, as Google shares them, and Google's id for your account. We ask Google for nothing more (the scopes are openid, email and profile) and never see your password.
• Sign-in by e-mail. If you sign in with a code instead of Google, we send a six-digit code to your address and keep only its hash, with the time and IP address of the request, for one day.
• Team. If an owner added you, your e-mail address, what you may do, which projects you see, who added you and when you last opened Sumly.
• Session. A session cookie, a CSRF token and a "remember me" cookie keep you signed in. Your light or dark choice stays in your browser.
• Server logs. IP address, browser, time and page of each request and error reports, for up to 30 days.

The numbers an owner connects

Owners connect their own Stripe accounts with read-only keys, and their own OpenPanel analytics. Sumly reads subscriptions, payments, fees and balances from Stripe, including the name and country of each paying customer, and daily visitor counts from OpenPanel. Keys are encrypted on our server and are never shown again. For the customers in that data the owner is the controller and Sumly processes it only to show it to them and their team.

Google user data

Sumly uses Google data only to sign you in and to show your name and picture inside Sumly. It is not sold, not shared with anyone, not used for advertising and not used to train AI models. Sumly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting ChatGPT, Claude or another assistant

You can connect an assistant that speaks MCP by signing in to Sumly from it and pressing Allow. It then gets an access token for your account, valid for 30 days and renewed for up to 180. When it asks a question we receive the tool's name and its arguments (such as a project name or a date range), answer from the projects you see, and keep which tool was used, when and from which app for 180 days, not what you asked. The tools only read: an assistant cannot change anything in Sumly or Stripe. What the assistant does with the answers and with your conversation falls under its provider's own privacy policy. Disconnect it any time under your avatar › Connect an assistant, which revokes its tokens at once.

Who processes it

• Hetzner Online GmbH, Germany: the server and database.
• Cloudflare, Inc.: DNS and the network in front of the site, which sees each request's IP address.
• Google: sign-in.
• An e-mail provider: sending sign-in codes and team invitations.
• OpenAI: the chat under Ask. Your question and the numbers the tools return for it (which can include customer names and countries) are sent to OpenAI's API to write the answer; OpenAI does not train on API data. Chats stay in your account until you delete them.
• Stripe and a self-hosted OpenPanel: only to read the owner's own data, as above.

Cloudflare and Google are in the United States; transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long

Your account stays while you have access. When an owner takes you off the team you lose access at once; ask and we delete your account the same day. When an owner removes a Stripe account or disconnects OpenPanel, its key and the data read with it are deleted.

Your rights

You can ask to see, correct, export or delete what we keep about you, and object to how it is used. You can also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec) or the authority where you live.