Sub-processors
Last updated 6 November 2026.
Every outside service that handles personal data for Sumly: what it does, what it receives and where it runs. The data is kept in Germany. We say so here at least 30 days before we add or replace a sub-processor, as the data processing agreement says.
Sub-processors
These handle the personal data in your workspace (your customers, your visitors and your team) on our behalf. Each is bound by a written agreement with the same data protection duties as our data processing agreement.
The server that runs the site, the app's API, the visit collector and the databases.
Receives: All of it: workspace data and every visit and event.
DNS and the network in front of the site and the collector.
Receives: Every request passes through it, with the IP address and user agent. Nothing is stored there.
E-mail: sign-in codes, team invitations, the reports you turn on and the monthly package to your accountant.
Receives: Recipients' addresses and what the mail carries, which for a report or a package includes customers' names, countries and payments.
Ask, the chat on the site.
Receives: The question and the numbers the answer needs, which can include customer names and countries. Not used for training.
The app's notifications on Android.
Receives: The notice itself, such as a sale's amount, project and country, and the phone's push token.
The app's notifications on iPhone and iPad.
Receives: The notice itself, such as a sale's amount, project and country, and the device's push token.
Services for our own data
These handle data we control ourselves, about the people who hold a Sumly account. They are not sub-processors; the privacy page explains how that data is handled.
Billing for Sumly's own plans.
Receives: The account holder's name, e-mail address, country and payment details. Card numbers stay with Stripe.
Sign in with Google, and Search Console when an owner connects it.
Receives: The account holder's name, e-mail address and Google id; the owner's own Search Console numbers.
Sign in with Apple in the app.
Receives: Apple's id for the account and the e-mail address the person chooses to share.
Our own notification channel for new sign-ups and support messages.
Receives: The account holder's or writer's name, e-mail address and message.
Your own payment providers and app stores are not on this list: Sumly only reads your data from them, with keys you give it. Nor is any place you tell Sumly to send something, such as your own Discord channel.
Where a service in the United States handles the data, the transfer rests on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.