Sumly Privacy Policy

Last Updated: September 14, 2026 The Privacy Policy describes how Sumly Inc. (“we” or “us”) handles the personal information we collect in connection with our websites, desktop application, and mobile application (collectively, the “Services”), including how we collect, use, and share personal information, and the choices we offer that affect our use of personal information. This Privacy Policy applies to any Services provided by Sumly that link to this Privacy Policy. Personal Information We Collect We collect the following categories of personal information. - Account information. This includes your name, username, contact information (including email, phone number, and address), and password. - Survey information. This includes any information you provide in response to our onboarding survey, including your occupation, location, marital status, dependents, income range, tax filing status, financial goals, and demographic information. - Bank account information. If you connect your bank account to the Services, we may access your bank account number and your past transactions, deposits, withdrawals and balances associated with the account. We obtain this bank account information through Plaid Inc. (“Plaid”), our third-party financial data network provider, on a read-only basis. When you connect an account, you provide your login credentials directly to Plaid or your financial institution, not to Sumly, and Plaid then transmits your account and transaction data to us. Plaid’s collection and use of your information is governed by Plaid’s End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy. - Payment information. This includes your name, payment card information, billing information you use to subscribe to the Services. Payment card transactions are processed by our third-party payment processor, Stripe, Inc. (“Stripe”); we do not store your full payment card number on our systems. Stripe’s processing of your information is governed by Stripe’s Privacy Policy, available at https://stripe.com/privacy. - Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise. Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with our Services, such as: - Device data, such as your computer’s or mobile device’s operating system, manufacturer and model, browser type, IP address, unique identifiers, language settings, mobile device carrier, and general location information such as city, state or geographic area; and - Usage data, such as pages or screens you viewed, how long you spent on a page, browsing history, and access times, and page clicks, page scrolls, and page element interactions. How We Use Personal Information We use personal information for the following purposes: - To provide the Services. This includes administering your account on the Services; providing you with access to the Services; performing bookkeeping, expense categorization, tax estimation, and tax return preparation and filing services, including through the licensed tax professionals and other contractors we engage to provide these services; communicating with you and responding to any inquiries you may have; and analyzing your use of the Services to allow us to evaluate and improve the Services. Improving, developing, and benchmarking our Services. We may use personal information to analyze and improve the Services, identify trends, and operate and expand our business activities. We may also create aggregated, anonymized, or other de-identified statistics, which we may use for lawful business purposes, including for analytics, forecasting, and strategic planning. - To send you marketing communications. We may send you information about our Services, including by email, text message, or other channels. To unsubscribe, please follow the instructions on the communication. - For compliance and protection, including to enforce any applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of our Services, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity. How We Share Personal Information We may share personal information with: - Financial service providers. We may share information with accountants and other financial service providers that you authorize to choose to connect to your account. For example, if you choose to connect with an accountant through the Services, we share your personal information with the accountant. We also share your personal information, including your financial account data and tax information, with the licensed tax professionals, bookkeepers, and other contractors we engage to provide bookkeeping, tax preparation, and tax filing services to you. Where required by applicable law (including 26 U.S.C. § 7216 and its implementing regulations), we will obtain your consent to use or disclose your tax return information before doing so. Service providers. We share personal information with companies and individuals that provide services on our behalf or help us operate our Services or our business. These service providers include hosting services, communications, data and cyber security services, billing and payment processing services, fraud detection, investigation and prevention services, analytics, email and communication distribution and monitoring services, and customer relation management systems. - Authorities and others. We may share personal information with law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate. - Business transferees. We may share personal information with acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, Sumly (including, in connection with a bankruptcy or similar proceedings). Your Privacy Choices - Unsubscribe from direct marketing communications. You may opt out of marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communication we send you. You may continue to receive service-related and other non-marketing communications. Access your account. You may access your personal information through your account on the Services. In some instances, you may also have the ability to correct personal information that is out of date or inaccurate, or to delete personal information that is no longer needed for a permitted purpose. Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to "Do Not Track" or similar signals. To find out more about "Do Not Track," please visit https://www.allaboutdnt.com. State Privacy Rights. Depending on where you live, you may have additional rights regarding your personal information under applicable state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”) and comparable laws in other states. These rights, and our related obligations, apply only to the extent we qualify as a “business” (or the equivalent) that is subject to the applicable law and your personal information is not otherwise exempt. Subject to certain exceptions, these rights may include the right to (i) request access to and a copy of the personal information we have collected about you; (ii) request correction of inaccurate personal information; (iii) request deletion of your personal information; (iv) request information about the categories of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it; and (v) opt out of the “sale” of your personal information or the “sharing” of your personal information for cross-context behavioral advertising, and limit the use of sensitive personal information, in each case where applicable. The personal information we collect includes identifiers, financial information, commercial information, internet or other network activity information, geolocation data, and inferences, and certain of this information (such as your financial account and transaction data) may constitute “sensitive personal information.” To the extent we “share” personal information for cross-context behavioral advertising through advertising cookies, pixels, or similar technologies on our websites, you may opt out by adjusting your cookie preferences or contacting us at support@getsumly.com. To exercise any of these rights, contact us using the information in the “Contact Us” section below. We will verify your request as required by law before responding, and we will not discriminate against you for exercising your rights. Gramm-Leach-Bliley Act. Certain information we collect is “nonpublic personal information” subject to the Gramm-Leach-Bliley Act (the “GLBA”). We collect, use, and disclose that information to provide the financial, bookkeeping, and tax services you request and to administer your account. We disclose it only to our service providers and others as needed to provide those services, to process or service your transactions, at your direction, or as otherwise permitted by law, and not for their own marketing. We maintain administrative, technical, and physical safeguards designed to protect it. Because this information is collected and processed pursuant to the GLBA, it may be exempt from certain state privacy laws. Data Security We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information. Data Retention. We retain personal information for as long as necessary to provide the Services; to comply with our legal, tax, accounting, and regulatory obligations (which, for certain tax and financial records, may require multi-year retention); to resolve disputes; and to enforce our agreements. When personal information is no longer needed for a permitted purpose, we will delete or de-identify it in accordance with our retention practices and applicable law. Children Our Services are not intended for use by children. The Services are intended only for individuals who are at least 18 years of age, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information through our Services from a child without the consent of the child’s parent or guardian as required by law, we will endeavor to delete it. Changes to This Privacy Policy We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy. We may also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail (if you have an account where we have your contact information) or another manner. Contact Us You can reach us by email at support@getsumly.com or by mail at the following mailing address: 69 Charlton St., New York, NY 10013