Clear about your data.

Who we are

Sumlino operates the Sumlino website, account service, Chrome extension, and client workspace from South Carolina, United States. For privacy questions or requests, contact sumlino.contact@gmail.com.

This notice covers Sumlino as it is offered today. Sumlino controls information used to manage your account and run the service. When you use it for a client or employer, that organization may control the client information you provide. Only add information you are authorized to use.

What we process

Account and sign-in

Name, email address, account and provider identifiers, session information, and security signals. Clerk handles authentication; your chosen sign-in provider handles its own sign-in screen.

Your client workspace

Recognized company name and identifier, supported page address, last-seen time, client picture selection, notes, to-dos, reminders, and shortcut preferences. These are associated with your signed-in account so the workspace can be available on another device.

On-page accounting helpers

Readable bank-feed rows, selected totals, bank text, journal-entry fields, financial reports, and reconciliation rows are processed locally. Imported reconciliation CSV files stay local. These tools do not upload the books or post accounting entries. The History shortcut opens QuickBooks’ own categorization history on request.

Settings and drafts

Helper preferences, reconciliation decisions, and unfinished voice drafts use your Chrome profile’s storage. Temporary tab references stay local. Unsaved typed drafts can be lost when their panel closes.

Operation and support

Request and security metadata, including IP addresses and timestamps, may be processed by our hosting and authentication services. Transcription request counts enforce usage limits. If you email us, we receive the message and contact details you send.

Financial information you choose to include in a saved note, to-do, support message, or voice recording follows that feature’s processing described here. It does not stay local merely because it came from an accounting page.

Optional QuickBooks connection

If you connect a company through Intuit, Sumlino stores its company identifier, your account association, the saved-client link you confirm, and encrypted access and refresh credentials on the server. Your QuickBooks password is entered with Intuit, not Sumlino. This connection is separate from the extension’s local on-page helpers.

The initial live-company pilot is read-only and restricted to approved accounts and companies. When you request a review, our backend reads company information, accounts, expenses and relevant preferences from QuickBooks to display records and prepare previews. These may include payees, descriptions, dates, amounts and account references. Vercel processes these requests; Neon stores the connection and client association. Records read to display a review or preview are not stored as copies, and fetched accounting records are not sent to Deepgram, OpenAI or TypeSafe. Saved client reports are the exception described below. Sanitized operational logs may contain request category, status and Intuit trace identifiers, not accounting response bodies or credentials.

Client reports are available only where enabled for an account. When you save a report, Sumlino stores the statement figures read from QuickBooks for that report, its earlier versions, the notes and figures you type, its review, approval and sent status, and the recipient you record when marking it sent. Report settings you save are stored too: firm name, preparer, logo, targets and account mapping. Neon stores them with your account and client. Approved or sent reports are kept as records and are not changed by later edits. To remove them, use our data-request instructions.

Disconnect in the dashboard to stop Sumlino access. On a confirmed disconnect, we revoke the stored authorization and remove its encrypted credentials from the active connection record. If revocation cannot be confirmed, we block further reads and retain encrypted credentials for an explicit retry; you can also remove the app in QuickBooks. The company association and operational metadata may remain with your workspace, and backups follow their retention lifecycle. Disconnecting does not delete your QuickBooks records or saved Sumlino notes. For account-wide removal, use our data-request instructions.

Intuit’s Accounting API permission includes writes, but Sumlino’s live pilot does not expose accounting updates or deletions. Any future expansion will require separate activation, appropriate notice, and review of the selected changes.

Voice notes and tasks

Recording starts when you invoke it and permit microphone access. An indicator shows that recording is active. The shortcut uses temporary access to the webpage to show the recorder and detect key release; your audio, transcript, and client list are not shared with that webpage.

Voice transcription, optional text cleanup, and optional interpretation are disabled by default and may be enabled for an approved pilot. When transcription is enabled, audio goes through Sumlino’s authenticated server to Deepgram. Requests opt out of Deepgram’s model-improvement program. Deepgram states that opted-out audio and transcripts are retained only while processing; request metadata and usage logs remain available for 90 days, with summarized usage retained longer. See Deepgram’s data-handling information.

If optional cleanup is enabled, Sumlino sends the transcript to OpenAI to improve readability. If optional interpretation is enabled, Sumlino sends transcript text to TypeSafe’s Jev model to suggest a note or task, priority, and labels. Client matching also sends a limited list of saved client names and the selected client’s name. Temporary labels stand in for client identifiers; account identifiers, saved notes, contact details, page addresses, and accounting records are not attached from your workspace. Information you speak may still appear in the transcript. Recording time and timezone are used by Sumlino to suggest a due date and are not sent to these models.

OpenAI says API content is not used for training unless explicitly opted in. Although Sumlino requests no stored response, OpenAI may retain abuse-monitoring content for up to 30 days, with stated exceptions, and encrypted prompt-cache data for up to 24 hours. TypeSafe does not train on customer data without consent, but its standard terms permit retention and processing for service delivery, telemetry, abuse prevention, and legal purposes without a fixed deletion period. Zero data retention requires separate provider arrangements; Sumlino does not promise it for these optional stages. See OpenAI’s data controls, TypeSafe’s customer agreement, TypeSafe’s data-processing terms, and TypeSafe’s retention options.

Sumlino’s voice-processing endpoint does not log or persist audio or transcript content. Unfinished drafts, including audio and text, stay in your browser profile until saved, discarded, or signed out. Up to 20 drafts can be kept. You can review and edit the text, client, and suggested details before explicitly choosing Quick post, Save note, or Create to-do. A different or uncertain client requires confirmation. Saving stores the confirmed text and details with that client and removes the local recording. Suggestions do not save content, perform the task, or post accounting entries automatically.

Why we use it

We use this information to provide your workspace, recognize the current client, transcribe requested thoughts and provide optional cleanup and note or task suggestions, maintain sign-in, prevent abuse, provide support, and send essential service messages. New accounts may receive a welcome email through Resend. Creating an account is not permission for unrelated marketing.

Where European or UK data-protection law applies, our legal bases for account and service administration are performance of our agreement with you; legitimate interests in security, reliability, and responding to requests; and applicable legal obligations. Where consent is required, we request it for the relevant activity and you can withdraw it. For client information handled on an organization’s behalf, that organization is responsible for its lawful basis and instructions.

Who helps us operate

• Clerk: account authentication and session security, including security services used in its sign-in flow.
• Vercel: hosting and backend request processing.
• Neon: account-scoped workspace storage and encrypted QuickBooks connection credentials.
• Intuit: authorization and accounting data access when you connect a QuickBooks company.
• Deepgram: audio transcription when enabled.
• OpenAI: optional transcript cleanup when enabled.
• TypeSafe: optional note, task, client, priority, and tag suggestions when enabled.
• Resend: transactional email delivery.
• Google: delivery and storage of messages sent to our support email.

We disclose information to service providers as needed for these functions, and when required by law or necessary to protect rights and security. Sumlino does not sell personal information or share it for targeted advertising. We do not use the accounting helpers to build advertising profiles or make decisions with legal or similarly significant effects about you.

International use

Sumlino is based in the United States. Our service providers may process information in the United States and other countries, whose laws may differ from yours. Contact us for information about the processing locations and transfer arrangements applicable to your use.

If your organization requires a data-processing agreement, a particular hosting region, or specific international-transfer safeguards, contact us before uploading client information so we can confirm whether Sumlino can meet those requirements.

Retention and deletion

Saved workspace information remains associated with your account while you use the service, unless you delete it or request removal. You can delete individual notes and to-dos in the extension. We keep account, security, and support records only for the service, security, dispute-resolution, or legal purposes for which they are needed; retention depends on the type of record and those obligations.

Clearing extension storage or uninstalling removes local information, but does not delete your server-stored workspace. Signing out clears local voice drafts. Account-wide deletion is handled through a request to us; removing an authentication account alone is not confirmation that all workspace records have been removed. Backups and legally required records may remain for their applicable retention period.

Your choices and rights

Depending on where you live, you may request access, correction, deletion, a copy of your information, restriction of processing, or objection to certain uses. You may withdraw consent where processing relies on it, without affecting earlier lawful processing. You may also complain to your local data-protection authority. We do not discriminate against you for exercising applicable privacy rights.

Use our data-request instructions or email sumlino.contact@gmail.com. We may need to verify your identity and authority, and will respond within the time required by applicable law. If information belongs to a client or employer, we may need to coordinate with that organization.

Cookies, children, and changes

See Cookies & device storage for sign-in and browser-storage details. We do not use advertising cookies or marketing analytics on the current website. Because we do not track users across websites for advertising, Do Not Track and Global Privacy Control signals do not change a sale or advertising-sharing practice.

Sumlino is for adults using professional accounting workflows, and is not directed to children under 18. Contact us if a child has supplied personal information so we can address it.

We will update this notice when practices change, revise the effective date, and provide additional notice where required.