Overview
Sumart, Inc. ("Sumart," "we," "us," or "our") operates the Sumart personal finance platform, available at sumartinc.com and through our mobile applications. Sumart helps users track budgets, monitor credit health, set savings goals, and connect financial accounts.
This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and what rights you have over your data. By using Sumart, you agree to the practices described in this policy.
🔒 Our core commitment: Sumart never sells your personal or financial data to third parties, never uses your data for advertising purposes, and never shares your bank credentials with anyone. Your financial data is used only to provide and improve the Sumart service.
Information We Collect
Information you provide directly
| Data Type | Examples | Why We Collect It |
|---|---|---|
| Account information | Name, email address | Create and manage your account |
| Financial data (manual) | Income, bills, budget entries, savings goals | Power your dashboard and financial tracking |
| Subscription information | Plan type, billing cycle | Manage your subscription via Stripe |
| Support communications | Messages sent to support@sumartinc.com | Respond to your questions and requests |
Information collected automatically
| Data Type | Examples | Why We Collect It |
|---|---|---|
| Usage data | Features used, pages visited, session duration | Improve the product experience |
| Device information | Browser type, operating system, screen size | Ensure compatibility and performance |
| Log data | IP address, access times, error logs | Security monitoring and debugging |
Information we do NOT collect
- We do not collect your Social Security Number (SSN)
- We do not collect your date of birth
- We do not currently collect or store bank account credentials — Sumart does not yet offer bank connectivity (see Section 3, "Planned Feature")
- We do not collect payment card numbers — these are handled entirely by Stripe
Plaid & Financial Account Connection (Planned Feature)
This feature is not yet available. Sumart plans to offer optional bank account connection via Plaid Technologies, Inc. ("Plaid") in a future release. Automatic bank syncing is not currently active — today, Sumart account holders enter their bills, balances, and credit information manually.
When this feature launches, Sumart will use Plaid to establish and maintain bank connections on your behalf. Plaid is a financial data network used by thousands of apps including Venmo, Robinhood, and Acorns. Sumart will never see or store your bank username or password — you would enter your banking credentials directly into Plaid's secure interface, not Sumart's.
This section will be updated with full details on data collected, usage, and account disconnection once Plaid connectivity is live. In the meantime, no bank credentials, account numbers, or transaction data are collected via Plaid, because the integration does not yet exist in the app.
Plaid's own privacy practices
Once available, your use of Plaid will also be governed by Plaid's Privacy Policy, available at plaid.com/legal/privacy-policy.
How We Use Your Data
We use the information we collect for the following purposes:
Service delivery
- Provide and operate the Sumart platform
- Calculate your Sumart Score™ and financial health metrics
- Power your budget dashboard, goal tracking, and transaction history
- Process your subscription payments via Stripe
- Send transactional emails (receipts, bill reminders, account alerts)
Product improvement
- Analyze how features are used to improve the product
- Identify and fix bugs and performance issues
- Develop new features based on user behavior patterns
Security and compliance
- Detect and prevent fraudulent or unauthorized activity
- Monitor for security threats and incidents
- Comply with applicable laws and regulations
- Enforce our Terms of Service
Communications
- Respond to your support requests
- Send product updates, new feature announcements, and financial tips (you can opt out at any time)
- Send important account and security notifications (these cannot be opted out of as they are essential to the service)
🚫 What we never do with your data: We do not sell your data to advertisers, data brokers, or any third parties. We do not use your financial data to serve you targeted advertisements. We do not share your individual data with other Sumart users.
Data Sharing and Third Parties
We share your data only in the following limited circumstances:
| Party | What We Share | Why |
|---|---|---|
| Plaid Technologies (planned, not yet active) | Account connection tokens | Retrieve your financial account data on your behalf — once bank connectivity launches |
| Stripe, Inc. | Email, subscription plan | Process subscription payments and manage billing |
| Google Firebase | All user data | Authentication, database storage, and cloud functions |
| Sentry (Functional Software, Inc.) | Device/browser type, error diagnostics, plan tier | Error monitoring, to detect and fix bugs — no financial figures are included |
| Anthropic, PBC (Claude API) | The financial data needed to generate the specific insight you request | Power Sumart's AI-driven financial coaching features (Pro and Premium plans) |
| Firebase Analytics | Anonymized usage behavior | Product analytics and improvement |
| Law enforcement / legal | As required by law | Legal obligations, court orders, or to protect rights |
| Business successors | All user data | In the event of a merger, acquisition, or sale of assets — you will be notified |
AI-Powered Financial Insights
Sumart's Pro and Premium plans include AI-generated financial coaching features, such as spending summaries and personalized recommendations. To generate these insights, relevant financial data from your account is sent to Anthropic's Claude API for processing. This data is used solely to generate the response shown to you and is not used by Anthropic to train their models. We do not send your name, email, or account credentials as part of this process — only the financial figures needed to produce the specific insight you requested.
All third-party service providers are contractually required to protect your data and may only use it to perform services on our behalf. They are not permitted to use your data for their own marketing or to sell it to others.
Data Retention and Deletion
How long we keep your data
- Active accounts: We retain your data for as long as your account is active and for a reasonable period afterward to allow account reactivation
- Cancelled accounts: Upon cancellation, your data is retained for 30 days to allow you to reactivate your account, then permanently deleted
- Financial transaction data: Retained for the duration of your active account to power historical views and reporting
- Support communications: Retained for up to 2 years for quality and compliance purposes
- Anonymized/aggregated data: May be retained indefinitely as it cannot be linked back to any individual user
Requesting deletion
You may request deletion of your account and all associated personal data at any time by emailing support@sumartinc.com with the subject line "Delete My Account." Full instructions are available on our Account Deletion page.
We will confirm receipt of your request within 5 business days and complete the deletion within 30 days. We will send a confirmation email once deletion is complete.
⚠️ Please note: Some data may be retained beyond the 30-day period if required by law (for example, records of financial transactions may be subject to regulatory retention requirements) or to resolve outstanding disputes or enforce our agreements.
Security
Protecting your financial data is our highest priority. We implement the following security measures:
- Encryption in transit: All data transmitted between your device and Sumart is encrypted using TLS 1.2 or higher. HTTPS is enforced across all Sumart web properties.
- Encryption at rest: All data stored in our database (Google Firestore) is encrypted at rest using AES-256 encryption by Google Cloud Platform.
- Financial information: Account balances, bills, and credit data you enter directly, subscription payment data (via Stripe)
- Access controls: Access to systems containing user data is restricted to authorized personnel only and protected by phishing-resistant multi-factor authentication.
- Secure infrastructure: We use Google Firebase, which maintains SOC 2 Type II, ISO 27001, and PCI DSS certifications.
- Regular reviews: We conduct regular reviews of our security practices and access controls.
While we implement strong security measures, no system is completely immune to security threats. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.
Cookies and Analytics
Cookies we use
Sumart uses cookies and similar tracking technologies for the following purposes:
| Type | Purpose | Can You Opt Out? |
|---|---|---|
| Essential cookies | Keep you logged in, maintain your session and preferences (theme, settings) | No — required for the service to function |
| Analytics cookies | Understand how features are used, which pages are visited, session duration | Yes — see below |
Firebase Analytics
We use Firebase Analytics (provided by Google) to understand how users interact with Sumart. This helps us improve the product. Firebase Analytics collects anonymized, aggregated behavioral data — it does not collect your name, email, or financial data.
To opt out of Firebase Analytics data collection, you can adjust your browser's privacy settings or use a browser extension such as the Google Analytics Opt-out Browser Add-on.
No advertising trackers
Sumart does not use advertising cookies, ad networks, or cross-site tracking. We do not use your behavior data to serve you ads anywhere on the internet.
Marketing Communications
With your consent, we may send you emails about:
- New Sumart features and product updates
- Financial tips, budgeting advice, and credit improvement guides
- Special offers or promotions for Sumart subscription plans
- Monthly financial summary digests
Opting out
You can unsubscribe from marketing emails at any time by:
- Clicking the Unsubscribe link at the bottom of any marketing email
- Adjusting your notification preferences in Sumart Settings → Notifications
- Emailing privacy@sumartinc.com with the subject "Unsubscribe"
Opting out of marketing emails will not affect transactional emails such as receipts, bill reminders, or security alerts — these are essential to the service and cannot be disabled.
Your Privacy Rights
Regardless of where you live in the United States, you have the following rights regarding your personal data:
| Right | What It Means |
|---|---|
| Right to Access | Request a copy of the personal data we hold about you |
| Right to Correction | Request that we correct inaccurate or incomplete data |
| Right to Deletion | Request that we delete your personal data (subject to legal retention requirements) |
| Right to Portability | Request your data in a portable, machine-readable format |
| Right to Opt Out | Opt out of marketing communications at any time |
| Right to Non-Discrimination | Exercise your privacy rights without receiving a degraded level of service |
To exercise any of these rights, contact us at privacy@sumartinc.com. We will respond within 30 days. We may need to verify your identity before processing certain requests.
California Privacy Rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights.
Categories of personal information we collect
In the past 12 months, we have collected the following categories of personal information as defined by the CCPA:
- Identifiers: Name, email address, user ID
- Financial information: Account balances, bills, and credit data you enter directly; subscription payment data (via Stripe). Bank account data via Plaid is not yet collected — that feature is planned but not active.
- Internet activity: Usage behavior, pages visited within the app
- Inferences: Financial health score and metrics derived from your data
We do not sell your personal information
Sumart does not sell personal information to third parties as defined under the CCPA. We do not share personal information with third parties for cross-context behavioral advertising.
Your California rights
As a California resident you have the right to:
- Know what personal information we collect and how it is used
- Delete personal information we have collected (with certain exceptions)
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information (not applicable — we do not sell data)
- Non-discrimination for exercising your CCPA rights
- Limit use of sensitive personal information
To submit a California privacy rights request, email privacy@sumartinc.com with the subject "California Privacy Request." You may also designate an authorized agent to make a request on your behalf.
Children's Privacy
Sumart is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18.
If you are a parent or guardian and believe your child under 18 has created a Sumart account or provided us with personal information, please contact us immediately at privacy@sumartinc.com. We will promptly delete the account and all associated data.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:
- Update the "Last Updated" date at the top of this page
- Send an email notification to all registered users
- Display a notice within the Sumart app
Your continued use of Sumart after a policy update constitutes your acceptance of the revised policy. If you disagree with any changes, you may close your account at any time.
Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:
Sumart Privacy Team
Bank account connectivity via Plaid is a planned feature and is not yet active — this section will apply once that integration launches.