Privacy Policy

Suma ("we", "us", "our") takes your privacy seriously. Suma is a self-employment tax companion built for UK sole traders, freelancers and landlords, and by its nature it handles some of your most sensitive information: your income, your expenses and your dealings with HM Revenue & Customs ("HMRC"). This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

This policy applies to the Suma mobile app, the Suma backend services, our website at sumatax.co.uk (including the pre-launch waitlist) and our communications with you. It is written for visitors to our website, people on our waitlist, and our prospective and existing customers, and it replaces the pre-launch privacy policy previously published on our website.

In short: your data is used to run Suma for you and to meet our legal obligations — nothing more. We never sell your personal data, we never share it with advertisers (the only advertising-related processing we do is optional, consent-based measurement on our website), and we do not allow AI providers to train their models on your data.

Suma is operated by Suma Tax Ltd, a company registered in England and Wales with company number 17245779. Our registered office is 16 Crown Farm Close, Coventry, CV3 3JY, England.

For the purposes of UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018, together "UK GDPR"), we are the data controller of the personal data described in this policy: we decide what personal data we collect, how it is processed and who it is shared with. Where you enter information about other people into Suma — for example, your clients' details on an invoice — see section 7.

You can contact us at any time by emailing support@sumatax.co.uk, including for any data protection question or to exercise your rights.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC160054.

When we say "personal data", we mean any information that relates to and identifies you, directly or indirectly — from the obvious (your name, email address, National Insurance number) to the less obvious (a device identifier, an IP address, or a pattern of transactions that could only be yours). "Processing" means anything we do with that data: collecting it, storing it, using it, sharing it or deleting it.

We collect personal data from the following sources:

• Directly from you — when you create an account, enter income and expenses, photograph receipts, record mileage, create invoices, use voice entry, contact support, or join our waitlist.
• Automatically from your device — technical information generated by using the app or visiting our website, such as device model, operating system version, app version, IP address and diagnostic logs. When you use HMRC features, we also read specific device information that HMRC legally requires (see section 5).
• From HMRC — when you connect your HMRC account, we retrieve information HMRC holds about you that is relevant to the service, such as your Self Assessment obligations, submitted figures, tax calculations and account balances.
• From Apple and RevenueCat — confirmation of your subscription status, product, trial and renewal dates when you purchase Suma Pro through the App Store. We never receive your payment card details.

We rely on the following lawful bases under UK GDPR:

• Contract (Article 6(1)(b)): when you create a Suma account you enter into a contract with us, and most of our processing is necessary to deliver the service you have asked for.
• Legal obligation (Article 6(1)(c)): some processing is required by law — most notably the fraud prevention information that HMRC legally requires all Making Tax Digital ("MTD") software to send with every API request, and our own tax, accounting and record-keeping obligations.
• Legitimate interests (Article 6(1)(f)): we process some data to secure, maintain and improve the service, prevent misuse, and understand how Suma is used. Where we rely on this basis we have assessed that our interest is legitimate, the processing is necessary for it, and it does not override your rights. You can object at any time (see section 14).
• Consent (Article 6(1)(a)): where the law requires it — for example the waitlist, marketing communications, advertising cookies on our website, and optional device permissions such as the camera, microphone, location and push notifications — we ask for your consent first, and you can withdraw it at any time.

If you do not provide data we need: where we need personal data to perform our contract with you or to comply with a legal obligation and you choose not to provide it, we may not be able to offer you the relevant feature — for example, we cannot provide HMRC features without your National Insurance number and the legally required fraud prevention data. We will tell you at the time if this is the case.

Categories of data

• Account and contact details: your email address, which is how you sign in to Suma. We use passwordless one-time codes, so we never collect or store a password. We may also hold your name and business details (such as trading name, business start date and the nature of your self-employment) where you provide them.
• Tax identifiers: your National Insurance number and, where relevant, your Unique Taxpayer Reference. These are required to interact with HMRC's APIs on your behalf.
• Financial and tax data: the income and expense records you enter, receipts you photograph or upload, invoices you create in Suma (including your clients' names and contact details), property income where you use landlord features, your tax calculations and estimates, and the obligations, calculations and submissions we retrieve from or send to HMRC when you connect your HMRC account.
• HMRC connection data: when you connect Suma to HMRC, HMRC issues us access tokens that allow Suma to act on your behalf. These tokens are encrypted at rest using AES-256 encryption and are never shared with anyone other than HMRC.
• Fraud prevention data: HMRC legally requires all software that connects to its MTD APIs to submit certain technical information with each request, including device identifiers, device make and model, operating system details, IP addresses, screen properties and timestamps. We collect this from your device only for requests made to HMRC and pass it to HMRC as required by law. We cannot offer the HMRC features of Suma without it.
• Mileage and location data: if you use mileage tracking, we process the trips you record — including the route, distance, date and the HMRC mileage rate applied — and store the route as evidence for your mileage claim. Location access is only used when you record a trip, is controlled by the location permission on your device, and can be switched off at any time in your device settings. You can also log mileage manually without granting location access.
• Technical and usage data: device and app version information, diagnostic logs and audit records of key actions in your account (for example, when a submission was made to HMRC). We use these to keep Suma secure, investigate problems and maintain an accurate record of tax-relevant events.
• Subscription data: your subscription status, product, trial and renewal dates. Payment for Suma Pro is taken by Apple through the App Store — we never see or store your card details.
• Communications data: what we learn from emails and support conversations between you and us, and your marketing preferences.
• Waitlist data: if you join our waitlist, the email address you submit, which we use to email you about Suma's launch, early access and any founding-member offer. Every email includes an unsubscribe link and you can withdraw your consent at any time.
• Website visitor data: when you visit sumatax.co.uk we collect limited technical information — page URL, referrer, approximate location, device type, operating system and browser version — through Vercel Web Analytics and Speed Insights, which provide aggregated, cookie-free statistics that do not identify you across websites. If (and only if) you accept advertising cookies, we also use the Meta Pixel as described in our Cookie Policy.

How each purpose maps to the data and lawful basis

Change of purpose: we will only use your personal data for the purposes we collected it for, unless we reasonably consider we need it for another purpose compatible with the original one. If we ever need to use your data for an unrelated purpose, we will tell you first and explain the lawful basis, and where consent is required we will ask for it.

We do not ask for, and do not want, any special category data (information about your health, religion, trade union membership, sex life or sexual orientation, or racial or ethnic origin) or criminal offence data. However, because Suma stores whatever you choose to record, your financial records could incidentally reveal such information — for example, an expense at a pharmacy, a trade union subscription or a donation to a religious organisation. We do not analyse your records to infer any of these things, we do not use them for any purpose other than providing the service to you, and where such data is incidentally present we process it only on the basis of your explicit consent given by choosing to record it, or as necessary for legal claims. Please do not enter special category information into free-text fields unless it is genuinely needed for your records.

Some Suma features involve other people's personal data — most obviously your clients' names, addresses and email addresses when you create and send invoices. For that information, you are the controller and we act as your processor: we host and process it only to provide the invoicing features to you. You are responsible for ensuring you are entitled to give us that information and that the people concerned know how their data is used. If someone contacts us about data you control, we will refer them to you and assist you as reasonably needed.

• Waitlist: emails about launch, early access and founding-member offers are sent only with your consent, and every email has an unsubscribe link.
• Existing customers: once you are a Suma customer we may email you about Suma features, tips and offers similar to what you already use, relying on the "soft opt-in" permitted by UK e-privacy law. You can opt out at any time via the link in any email or in the app, and we will stop immediately.
• What we will never do: we will not sell or rent your details to anyone, send you third-party marketing, or make marketing phone calls or texts. Opting out of marketing never affects service emails we must send (such as security notices, receipts or changes to these policies).

Suma includes optional AI-assisted features: automatic expense categorisation, receipt capture and voice entry. We have designed these to minimise the data that leaves your device:

• Receipt capture: text is extracted from your receipt photos on your device using Apple's on-device recognition. Only the extracted text — not the image itself — is sent to our AI provider to be turned into a structured expense.
• Voice entry: your speech is transcribed and the resulting text is sent to our AI provider to extract the transaction details. Where the app needs to ask a clarifying question, a short spoken response may be generated by the provider.
• Categorisation: transaction descriptions may be sent to our AI provider to suggest an expense category.

These requests are processed by OpenRouter, Inc. and the underlying model provider (currently OpenAI) acting as our processors. We do not permit our AI providers to use your data to train their models. AI suggestions are exactly that — suggestions. Nothing is saved to your records or sent to HMRC without your review and confirmation.

We do not make any decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. AI features only ever make suggestions which you review and confirm; tax estimates are calculations you can inspect (Suma's tax breakdown shows the working); and no feature of Suma approves, declines, scores or profiles you. If this ever changes, we will update this policy first and tell you, and you will have the rights UK GDPR provides in relation to automated decisions, including the right to human intervention.

We may create anonymised or aggregated data from usage of the service — for example, statistics about how many users complete a submission in a given month, or aggregate patterns in feature usage. This data does not identify you and cannot reasonably be linked back to you, so it is not personal data, and we may use and share it (for example in product decisions or investor materials) without restriction. We follow ICO anonymisation guidance and never publish anything that could re-identify an individual.

We never sell your personal data. We share it only with the following categories of recipient:

• HMRC: when you connect your HMRC account and instruct Suma to retrieve information or make a submission, we exchange your tax data and the legally required fraud prevention data with HMRC. HMRC is a separate data controller of the information it receives; its privacy notice is available on GOV.UK.
• Service providers (processors): trusted suppliers who process data on our behalf under contracts containing UK GDPR-required protections, listed below. They may only use your data to provide their service to us.
• Your invoice recipients: if you create and share an invoice, the details on that invoice are shared with the client you choose to send it to.
• Professional advisers: our lawyers, accountants, auditors and insurers, where necessary and under duties of confidentiality.
• Authorities: regulators, courts, law enforcement or other authorities where we are legally required to disclose, or where disclosure is necessary to protect our rights, your vital interests or the safety of others. We will challenge requests we consider excessive and, where lawful, tell you about them.
• Business transfers: a buyer or successor if we sell, merge or reorganise our business, in which case this policy would continue to protect your data and we would notify you of any change of controller.

Our service providers

This list reflects our providers at the date of this policy. We may add or change providers as the service evolves; material changes will be reflected in an updated version of this policy, and a current list is available from us on request.

We aim to keep your data in the UK or EEA wherever possible. Where a provider processes your data outside the UK — typically in the United States — we ensure an adequate level of protection through one or more of: the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, the "UK-US Data Bridge", where the provider is certified); the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; and additional technical safeguards such as encryption in transit and at rest. You can contact us for more information about the safeguards applying to a specific transfer.

Because Suma exists to help you keep the records the law requires you to keep, our default retention periods follow HMRC's record-keeping rules:

Where you ask us to delete your account, we may retain limited data where we must do so to comply with a legal obligation, resolve disputes or enforce our agreements — and only for as long as those purposes require. We may also anonymise data instead of deleting it, after which it no longer identifies you. Deleting tax records may affect your own record-keeping obligations to HMRC, so we recommend exporting your records first (see section 16).

• All data is encrypted in transit using TLS and encrypted at rest.
• HMRC access tokens are additionally encrypted at the application layer using AES-256-GCM.
• Sign-in uses one-time email codes, so there is no password to steal or reuse. Sessions on your device are stored in the secure system keychain.
• Access to your records is isolated per user at the database level, and key actions on your account are recorded in an audit log.
• Access to production systems is restricted to authorised personnel on a need-to-know basis, and our internal processes follow the principle of least privilege.
• Receipts and invoices are stored in private storage accessible only via short-lived signed links generated for you.

No system can be guaranteed 100% secure. We have procedures in place to detect, investigate and respond to suspected personal data breaches. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required, and if the risk is high we will also tell you directly without undue delay, including what happened and what we are doing about it.

Your records are yours. Suma's export features let you download your data — including your transactions and Self Assessment summaries — at any time, in commonly used formats, without needing to ask us. We encourage you to export and keep your own copies of anything you are legally required to retain, particularly before deleting records or your account.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you, together with information about how we use it (commonly called a subject access request).
• Rectification — ask us to correct inaccurate or incomplete data. You can edit most of your records directly in the app.
• Erasure — ask us to delete your data. Note that we may need to retain some data to meet legal obligations, and deleting tax records may affect your own record-keeping obligations to HMRC.
• Restriction — ask us to limit how we use your data in certain circumstances, for example while a dispute about accuracy is resolved.
• Portability — receive the data you have provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another provider where technically feasible.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time (which we will always honour).
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email support@sumatax.co.uk. We may need to verify your identity before acting on a request — usually by confirming access to the email address on your account. We will respond within one month; if a request is complex we may extend by up to two further months, in which case we will tell you within the first month. Exercising your rights is free, although we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF), although we would appreciate the chance to address your concern first.

Suma is designed for people running a business and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Our website and app may contain links to third-party websites and services — for example GOV.UK, HMRC sign-in pages, or App Store pages. This policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to read the privacy notice of any site you visit; in particular, when you sign in to HMRC through Government Gateway you are on HMRC's service and subject to HMRC's privacy notice.

We may update this policy from time to time as Suma evolves — for example, if we add new features such as bank account connections, we will update this policy first and, where the changes are significant, tell you in the app or by email before they take effect. The version number and date at the top of this policy tell you when it was last changed, and previous versions are available on request.

Suma Tax Ltd, 16 Crown Farm Close, Coventry, CV3 3JY, England. Company number 17245779. Email: support@sumatax.co.uk.