Clear, purpose-bound, verifiable.

1. Controller

The controller responsible for processing personal data on this website and in Sumaro is:

Please send privacy requests to info@elevatescale.io. Further details about the provider can be found in the legal notice.

2. Visiting the website

When a website is visited, technically necessary connection data is generated, such as IP address, time, requested page and browser information. It is needed to deliver the page, detect errors and fend off attacks. Hosting is provided by Vercel (see section 7); the specific retention periods are currently being reviewed.

3. Sign-up and trial

For an account, we process at least an email address, login credentials and information about the workspace created. Email verification protects against accounts being opened under someone else’s address. No payment details are required during the free trial.

4. Using the product

You determine through your entries which business and personal data is processed in Sumaro. This may include client master data, invoice and estimate contents, receipts, messages, bank transactions and activity data. For data of your own clients, you generally remain responsible yourself.

5. Subscription

If you take out a subscription after the trial, contract, billing and payment status data is processed. Payments are processed via Stripe (see section 7). Information on the legal basis and on transfers to third countries is currently being reviewed and will be added here.

6. Audience measurement

Audience measurement via Google Analytics only starts after your explicit consent through the notice at the bottom of the page. Without consent, no measurement data is collected. You can withdraw your consent at any time with effect for the future.

7. Service providers we use

To operate Sumaro, we use the following service providers as processors. They process data only on our instructions and only for the purpose stated in each case.

• Vercel – hosting and delivery of the website and the application.
• Supabase – authentication, database and file storage.
• Stripe – processing of the subscription and payment after the trial.
• OpenAI (OpenAI, L.L.C., USA) – Sumaro's AI features: answers from the assistant Ari based on your data in Sumaro, reading receipts (including attachments from the connected mailbox), turning voice recordings into text, estimate and invoice texts, and the text of the morning brief. Only what a request needs is sent. According to OpenAI, data sent via its API is not used to train its models. If you add your own OpenAI key, processing runs through your own OpenAI account.
• ElevenLabs – reading the morning brief aloud; only the text of the brief is sent.
• Enable Banking (Enable Banking Oy, Finland) – retrieving account transactions and balance when you connect your bank and authorise this at your bank; read-only.
• Email service provider – sending system and receipt emails and retrieving the monitored mailbox for the receipts inbox.
• Google Analytics – audience measurement, only with your explicit consent.

Some of these providers also process data outside the EU. The specific recipients per environment, the respective safeguards for transfers to third countries and the retention periods are currently being reviewed and will be added here.

8. Your rights

Subject to the statutory requirements, you have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection. You can also withdraw consent at any time with effect for the future. The competent supervisory authority at the controller’s registered office is the Commissioner for Personal Data Protection in Cyprus; regardless of this, you can also contact the supervisory authority at your place of habitual residence. You can reach us with requests at info@elevatescale.io.