Sumcase — Privacy Policy
Last updated: August 8, 2026
This policy explains what personal information Sumcase ("we") collects, why, who it is shared with, and the rights you have. It is written to comply with Canada's PIPEDA and with provincial private-sector privacy laws where they apply (including Quebec's Law 25 for Quebec residents). By using Sumcase you consent to the practices described here.
1. Information we collect
Account data: your email address and, if you register with a password, that password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your verified email address from Google and nothing else — no contacts, no profile data. We deliberately collect no name, phone number, or profile information. Session data:a signed authentication cookie ("et_session") that keeps you logged in — we use no advertising or cross-site tracking cookies. Receipts: the files you upload and the fields extracted from them (vendor, date, amounts, taxes, location, payment method, receipt number). Receipts can themselves contain personal information (e.g. a name or address printed on an invoice) — upload only what you are entitled to. Billing: your customer identifier with our payment processor, subscription status, billing period, and a history of subscription and payment events. Your card number goes directly to the payment processor and never touches our servers. Preferences: your settings (currency, country and province/state, language, theme, table layout, categories). Demo use: if you try the public demo without an account, the uploaded file is processed once to show the extracted fields and is not stored; we process your IP address to rate-limit the demo and protect the Service. Technical logs are kept by our hosting provider for security and debugging.
2. How we use it
To operate the Service: authenticate you, store and display your receipts, extract receipt fields with AI, convert foreign-currency amounts using published reference exchange rates (no personal data is involved in rate lookups), detect duplicate uploads (via a mathematical fingerprint of each file), enforce free-allowance and usage limits, process subscription payments, prevent fraud and abuse, and provide support. We do not sell or rent your personal information, use it for third-party advertising, or use your receipts to train AI models.
3. Who processes your data (service providers)
We share data only with a small number of vetted service providers (subprocessors) acting on our behalf, strictly to run the Service. They fall into these categories: a cloud hosting provider (running the application), a database, file-storage and authentication platform (holding your account, receipts and files), an AI document-processing provider (receipt content is sent to its API to extract the fields), a payment processor (handling subscriptions — your card details go to them directly and never touch our servers), a transactional email provider(account emails such as password resets), and — where you choose to use them — optional Google sign-in and an embedded map of a receipt's extracted address. Each provider processes data only on our instructions, under contractual security and confidentiality commitments. As a security measure we do not publish the identity of individual providers here; the current subprocessor list is available on request at support@sumcase.com. Some providers are located outside Canada (primarily in the United States); by using the Service you acknowledge that your information may be stored and processed in those jurisdictions, where it may be subject to local law.
4. Retention
Your data is kept for as long as your account exists. Deleting a receipt deletes its stored file and extracted data. Deleting your account deletes all account data — receipts, files, projects, and settings. After account deletion we retain a minimal permanent billing ledger: your email address, subscription and payment events (start, renewal payments, failed payments, cancellation, status changes), and your customer reference with our payment processor. We keep this to meet legal and tax record-keeping obligations, prevent free-allowance abuse, resolve billing disputes, and honour subscriptions already paid for (if you re-register with the same email during a paid period, your access resumes). Backups held by our infrastructure providers expire on their standard schedules.
5. Security
All traffic is encrypted in transit (TLS). Receipt files live in a private storage bucket accessible only through our server. Passwords are hashed by our authentication provider; API keys and secrets are stored in a managed secret vault. Access to production data is limited to the operator of the Service. No system is perfectly secure — if we learn of a breach creating a real risk of significant harm, we will notify affected users and the authorities as required by applicable law.
6. Your rights
You may access, correct, export, or delete your personal information. Most of this is self-serve: receipts and fields are editable in the app, and account deletion is in Settings. For anything else — including questions, complaints, or a written access request — contact the person responsible for the protection of personal information at privacy@sumcase.com. You may also complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator (in Quebec, the Commission d'accès à l'information).
7. Children
The Service is a business tool and is not directed to minors. Do not use Sumcase if you are under the age of majority in your jurisdiction.
8. Changes
We may update this policy; material changes will be announced in-app or by email before they take effect. The "last updated" date above always reflects the current version.
9. Contact
Privacy officer: privacy@sumcase.com · General support: support@sumcase.com