Privacy policy

Sumzy is published by Romain Lourenco, a sole proprietorship (micro-entreprise) registered in France (SIRET —), who is the data controller. Contact: romainlourenco.rl@gmail.com.

We only collect what Sumzy needs to work:

• Account: your name, email address and password (stored as a bcrypt hash, never in clear text). Accounts are created by an administrator: there is no public sign-up.
• Security log: for each sign-in attempt, its date, IP address, browser (user agent) and result.
• Your products: the names, website URLs and icons you add.
• Connection details: the API keys, tokens and settings of the services you connect (Stripe, PayPal, Umami, PostHog, Google…). Secrets are encrypted with AES-256-GCM before being stored.
• Metrics: daily aggregated numbers (revenue, visitors, page views, users, ratings…) fetched from those services. They describe your products, not individuals: Sumzy never imports the personal data of your visitors or customers.

If you use Sign in with Google to connect Google Analytics or Search Console, Sumzy asks for the following permissions, all read-only:

• Your email address (openid, email): to show which Google account is connected.
• Google Analytics, read-only (analytics.readonly): to list your GA4 properties and read the daily totals of active users, sessions, page views and new users of the properties you select.
• Search Console, read-only (webmasters.readonly): to list your sites and read the daily clicks, impressions and average position of the sites you select.

Sumzy stores the email of the Google account, an encrypted refresh token and the daily totals above. It never modifies anything in your Google accounts and reads no other data.

Google user data is only used to show your dashboard to you. It is not sold, not shared with third parties, not used for advertising and not used to train AI or machine-learning models. Nobody reads it, except with your consent (for support), for security reasons or when the law requires it.

Sumzy’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a Google account at any time in Settings: Sumzy then revokes its access with Google and deletes the token. You can also remove Sumzy from your Google account permissions.

Your data is only used to provide Sumzy: syncing your sources at fixed times each day, showing your dashboard and protecting your account (security log, signing out other devices). No profiling, no advertising, no resale.

We do not sell or rent your data. It is stored on the servers of OVH SAS (2 rue Kellermann, 59100 Roubaix, France), in France, within the European Union.

To fetch your metrics, Sumzy sends requests to the services you connect, with the credentials you provided. Each of these services processes data under its own privacy policy.

Data may only be disclosed to an authority when the law requires it.

• Account, products, connections, metrics and security log: as long as your account exists.
• Deleting a source or a product deletes its data and credentials. Deleting your account deletes everything attached to it.
• Sync journal (technical errors): 60 days.

Traffic is encrypted (HTTPS). Passwords are hashed with bcrypt, connection secrets and Google tokens are encrypted with AES-256-GCM, and each customer can only access their own data.

Under the GDPR you can access, correct, export or delete your data, and object to or restrict its processing. Write to romainlourenco.rl@gmail.com: we reply within one month.

If you believe your rights are not respected, you can file a complaint with the CNIL, the French data protection authority.

Sumzy only uses two strictly necessary cookies: sumzy_session (keeps you signed in) and sumzy_locale (remembers your language). No analytics, advertising or tracking cookies.

When this policy changes, we update the date at the top of this page and notify you by email of any significant change.