SumSwift Privacy Policy

Last updated October 23, 2026.

This policy explains what personal information SumSwift Technologies Inc. ("SumSwift", "we", "us"), a British Columbia corporation, collects, why, who we share it with, where it's stored, how long we keep it, how we protect it, and your rights. It covers the SumSwift website at sumswift.com, the SumSwift app on the web and on iPhone, and everyone who uses them: business owners, accountants and bookkeepers, staff and employees.

We're committed to the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the privacy laws of British Columbia, Alberta and Quebec (including Quebec's Law 25), and the privacy laws of the US states where they apply to us.

Person in charge of privacy: Liam Davidson, Founder. Email hello@sumswift.com.

1. Our role

For your account and your use of SumSwift, SumSwift is responsible for your personal information, as this policy describes.
For personal information inside a business's records (for example its customers, suppliers, employees, donors or tenants), the business that uses SumSwift decides why it's collected and how it's used. SumSwift processes it on that business's behalf and only to provide the service, as our Terms of Service set out. If your information is in a business's books and you have a question about it, contact that business; we'll help them answer you.

2. What we collect

Information you give us

Account details: your name, email address and password (stored only as a one-way scrambled hash, never the password itself). If you turn on two-step sign-in, the secret key for your authenticator app.
Business details: the business's name, what it does, country and province or state, business type, tax settings and registration numbers, owners' names and ownership shares, and the name, address and logo on your invoices.
Your records: bank, card and loan statements, receipts and bills, invoices and estimates, payroll reports, trips, inventory and other records you upload or enter, plus exports from QuickBooks, Xero, Sage or Wave.
Questions and messages: what you ask Ask Swift, and messages you send us through the app or by email.
Payment details for your SumSwift plan are collected by Stripe. We receive your name, billing address, card brand and last four digits, and payment status, never your full card number.

Information from services you connect (only if you choose to connect them)

Your bank, through Plaid: account names and types, the last digits of account numbers, balances and transactions. Never your bank password, and SumSwift can't move money. See section 6.
Your inbox (Gmail or Outlook): see section 5 for exactly what we read and keep.
QuickBooks Online (Intuit): your company's name, currency, list of accounts, and the transactions, customers, suppliers, items and attachments SumSwift creates or updates there for you.
Online stores and payment services (such as Shopify, Square, Amazon, eBay, Etsy, WooCommerce, Squarespace, Wix, PayPal, Walmart, Clover, Lightspeed and TikTok Shop): store details, orders, refunds, payouts and fees, products and stock counts. Order records can include your customers' names and the places they ship to; we use them only to keep your books.
Stripe ("Pay now"): if you set up online payments, the status of your Stripe account and the payments, fees, refunds and payouts on it.
Sign in with Google, if you use it: your name, email address and profile picture.

Information about other people in your records

Your records include names of people and businesses you pay or who pay you, your customers' and suppliers' contact details if you add them, your employees' pay and contact details, and, for some businesses, donors, tenants or trust clients. We use it only to keep your books and to do what you ask (for example, emailing your customer an invoice). SumSwift doesn't store social insurance numbers, social security numbers or other government identification numbers of people you pay: when you build a slip file, the number you type stays on your device.

When your customer accepts an estimate online: the name they type, their signature, the date and time, a scrambled form of their internet address and their browser type, kept as a record of their agreement.

Information collected automatically

Cookies and similar storage: see section 9.
Change history: a record of changes to the books (who changed what, and when), visible to you and the people you share with.
Email and notification records: what SumSwift sent for you, to whom, when, and whether it bounced, so the same message isn't sent twice and problems can be fixed.
Error reports: when something goes wrong in the app, the error, the page and your browser type.
Usage limits: how much AI processing an account used, to manage costs and prevent abuse.
iPhone: a notification token if you allow notifications. Face ID is checked by your phone; SumSwift never receives it.
Server logs: internet address, browser and the request made, kept by our hosting provider for security.
Visit counts: Vercel Web Analytics, which uses no cookies and doesn't follow you to other sites. It records the page (never secret links such as sign-in, payment or receipt links), the site you came from, your country, and your browser and device type.

3. How we use it, and why

We use personal information only for these purposes, with your consent (express consent for financial information, which we treat as sensitive) or as the law otherwise allows:

To provide the service: read and sort transactions, check them against your bank's balances, match receipts, bills and payments, estimate taxes, and prepare your books, reports and files.
To run your account: sign you in (including emailing 6-digit codes), take payments, give the people you choose access, and send the emails and notifications that come with the service, such as sign-in codes, receipts, a reminder on the 1st to bring in last month's statements, notices that something is waiting on you, approval requests to your team, and "you got paid" notices.
To act for you: send the invoices, estimates, statements and reminders you ask SumSwift to send.
To keep SumSwift secure: prevent fraud and abuse, enforce usage limits, investigate problems and keep records of access.
To support you and improve SumSwift: answer your messages, fix errors, and understand which features are used, using information that doesn't identify you wherever we can.
To sort transactions better for everyone: when you tell SumSwift what a merchant is, that choice is pooled with other businesses' choices for the same merchant. Only the merchant's name, the category and how many businesses chose it are kept, never amounts, dates, account details or which business chose it. A merchant is used only once at least 5 businesses sorted it and nearly all agree, and payments to people are never pooled.
To meet legal obligations: tax, accounting and corporate records, and responding to lawful requests.

What we don't do. We don't sell or rent personal information, share it for cross-context behavioural advertising, use advertising trackers, or use your records or Gmail data to train AI models. If we ever want to use personal information for a new purpose, we'll ask first.

You can withdraw consent at any time (see section 12), subject to legal or contractual restrictions. Some information is needed to provide SumSwift, so withdrawing consent to it may mean we can't keep providing the service.

4. Automated decisions and AI

SumSwift uses software and AI to sort transactions, match receipts and payments, flag possible double charges and risky bills, write monthly summaries and answer questions. These decisions affect your books, not your rights as a person. You can see and change every one of them in the app, and anything SumSwift isn't sure about is asked or listed for you. You can ask what information was used and how a decision was reached, and ask a person to review it, by writing to hello@sumswift.com.

Our AI provider is Anthropic, PBC (in the United States), which provides the Claude models. Only the content needed for each task is sent, for that task. Under Anthropic's commercial terms, it processes this data on our behalf, doesn't use it to train its models, and keeps it only for a limited time for safety and abuse monitoring.

5. Gmail and Outlook

If you connect your inbox, SumSwift finds your receipts and bills there so you don't have to forward them.

What we access: read-only access to your messages (Google's gmail.readonly scope; Microsoft's Mail.Read). SumSwift can't send, delete, move or change your email.
What we look at: the sender, subject, date, a short preview and attachment names of messages received since the start date shown in the app. Messages that look like a receipt or bill (for example an order receipt or an invoice) are opened and read.
What we keep: only receipts and bills, meaning that email's text and attachments, which are saved with your receipts and read by our AI provider to record the vendor, date, amounts and taxes. For every other message we keep only a note that SumSwift already looked at it (an internal message identifier, never its content), so it isn't looked at twice.
Who sees it: you and the people you give access to your books. It's processed by the service providers in section 7 that store and read receipts (Supabase, Vercel and Anthropic) and by no one else.
What we never do: use your email for advertising, sell it, use it to train AI models (ours or anyone's), or let any person read it except with your permission, for security purposes, to comply with the law, or (in aggregate, without identifying anyone) for internal operations.
Disconnecting: you can disconnect your inbox at any time in the app (Connections), or remove SumSwift's access from your Google or Microsoft account. When you disconnect, we revoke our access with Google, delete our access tokens and the notes of messages looked at. Receipts and bills already brought in stay in your books as your records until you delete them.

Google's rules. SumSwift's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Bank connections through Plaid

SumSwift uses Plaid Inc. ("Plaid") to gather your data from financial institutions. By connecting a bank, you grant SumSwift and Plaid the right, power and authority to act on your behalf to access and transmit your personal and financial information from your financial institution, and you agree to your personal and financial information being transferred, stored and processed by Plaid in accordance with the Plaid End User Privacy Policy.

SumSwift receives account names and types, the last digits of account numbers, balances and transactions. We never see or store your bank password. The access token Plaid gives us is stored encrypted with our own key on top of database encryption. When you disconnect a bank, we tell Plaid to end our access and delete the token; transactions already brought in stay in your books.

7. Who we share it with

People you choose: accountants, bookkeepers, staff and employees you give access to, with the access you choose (employees see only their own pay). If you signed up through an accountant's link or invitation, that accountant can see your name, email and that you signed up, and sees your books only if you choose to share them.
Your customers and team: what you send them through SumSwift, such as an invoice.

Service providers that process information for us, under written agreements that limit their use of it to providing their service to us and require them to protect it:

Provider	What for	Where
Supabase	Database, file storage and sign-in	Canada (Montréal)
Vercel	Hosting the website and app, and counting visits	Canada (Montréal) for app servers; pages delivered worldwide
Anthropic	AI reading, sorting, summaries and answers	United States
Resend	Sending and receiving email	United States
Google	Our own email, Sign in with Google, and Gmail if you connect it	United States and worldwide
Microsoft	Outlook, if you connect it	United States and worldwide
Stripe	Payments to SumSwift, and Pay now payments to your own Stripe account	United States and Canada
Plaid	Bank connections, if you connect a bank	United States and Canada
Intuit	QuickBooks Online, if you connect it	United States and Canada
Store and payment platforms	The stores and payment services you connect	United States, Canada and worldwide
Expo and Apple	Notifications to the iPhone app, if you allow them	United States
GitHub	Storing our encrypted nightly backups	United States
Cloudflare	The "are you human" check on sign-in pages, when it's on	United States and worldwide
jsDelivr	Delivering the barcode scanner's code, if you use the scanner on the web	Worldwide

Legal reasons: when the law requires it (for example, a court order or a lawful request from a tax authority), or when needed to protect the rights, property or safety of SumSwift, our customers or others. Where allowed, we'll tell you first.
Business transfer: if SumSwift is merged, sold or reorganized, personal information may pass to the new owner, who must continue to protect it as this policy describes. We'll tell you before that happens.

8. Where information is stored

Your records and books are stored in Canada (Montréal). Some service providers in section 7 process information in the United States or elsewhere, where it may be accessible to courts, law enforcement and national security authorities under those countries' laws. Before sending personal information outside Canada (or outside Quebec, for Quebec businesses), we assess its sensitivity, the purpose, the protections the provider applies and the laws where it will be processed, and we only use providers whose agreements require them to protect it to a standard comparable to ours.

9. Cookies and local storage

We don't use advertising or tracking cookies. We use:

Name	Why	How long
Supabase sign-in cookies (sb-…)	Keep you signed in	Until you sign out or they expire
kept_ref	Remembers the accountant whose link you used	90 days
kept_partner	Remembers that you're joining as an accountant	Until you finish joining, at most 7 days
kept_plan	Remembers the plan you picked before signing up	Until sign-up, at most 7 days
kept_commerce, kept_qbo, kept_mail	Secure the connection of a store, QuickBooks or an inbox	15 minutes

Your browser also keeps a few settings on your device, such as light or dark mode, the business you last opened and your current conversation with Ask Swift. You can clear cookies and site data in your browser at any time; you'll be signed out.

10. How long we keep it

Information	How long
Your books, records, files and settings	While your account is open, until you delete them
A business or account you delete	Deleted at once from our systems; copies in encrypted backups are gone within 30 days
Bank, inbox, QuickBooks and store connections	Access tokens deleted when you disconnect or delete the account
Records of payments to SumSwift	Six years after the end of the tax year they relate to, as tax law requires
Messages you send us	Until we no longer need them to help you, and no more than three years after your last message
Error reports	90 days
Server logs	Kept by our hosting provider for a short time, generally no more than 30 days
AI usage totals	Kept as cost totals with no detail of what was processed

Free-month fingerprints: if we offer a free first month, for each bank or card account read during it we keep a one-way scrambled code (made from the bank's name, the kind of account and its last 4 digits, which can't be turned back into them), the statement's dates and its opening and closing balances, so the same account can't get another free month. They contain no account number, transaction or name, and we keep them only while we offer a free month.

Where the law requires us to keep information longer (for example, for a legal claim or investigation), we keep it only as long as required.

11. Security

Information is encrypted in transit (TLS) and at rest. Tokens for connected services are encrypted again with our own key.
Each business's books are separate, and the database itself enforces who can see what, including for accountants, staff and employees.
Sign-in requires a password of at least 10 characters and a confirmed email; you can add two-step sign-in, and accounting firms can require it for their team.
AI use is rate limited and capped per account.
Access to customer data inside SumSwift is limited to SumSwift's founder, and only to support you or fix a problem.
Our nightly backups are encrypted (AES-256) before they're stored, and kept for 30 days.

No system is perfectly secure. If there's a breach of security safeguards involving your personal information that creates a real risk of significant harm, we'll notify you and the privacy regulators as the law requires, and we keep a record of every breach. If you think your account has been compromised, email hello@sumswift.com at once.

12. Your rights and choices

In the app, any time: see, correct and download your information (reports, spreadsheets, the year-end package, a QuickBooks export, or one file with all your records); remove anyone's access; disconnect any connected service; stop reminder emails (the link in each one, or Account settings); delete a business or your whole account.

By asking us: you can ask whether we hold personal information about you, for a copy of it (in a structured, commonly used format where the law gives that right), to correct it, to delete it, or to withdraw consent. Depending on where you live, you may also have the right to know how it was used and disclosed, to have an automated decision reviewed by a person, and to opt out of the sale or sharing of personal information (we don't sell or share it) or of profiling with legal effects (we don't do that). Write to hello@sumswift.com. We'll confirm your identity before acting, answer within 30 days (or tell you why we need longer, as the law allows), and won't treat you differently for using your rights. If we can't do what you ask, we'll explain why. An authorized agent may make a request for you with proof of your authorization. If you live in a US state with an appeal right and we decline your request, reply to our answer to appeal, and we'll respond within the time the law requires.

Complaints: please contact us first. You can also complain to the Office of the Privacy Commissioner of Canada, or your provincial regulator (the Office of the Information and Privacy Commissioner for British Columbia or Alberta, or the Commission d'accès à l'information du Québec), or, in the United States, your state attorney general.

13. Emails from SumSwift

We send emails that come with the service (sign-in codes, receipts, reminders and notices about your books). We send other messages, such as news about SumSwift, only with your consent or where Canada's anti-spam legislation allows, and each one has a working unsubscribe link. Every email from us identifies SumSwift and how to reach us.

14. Children

SumSwift is for businesses and adults. Accounts are only for people who have reached the age of majority, and we don't knowingly collect personal information from children for their own use of SumSwift. A business's payroll records may include young employees; that information is handled as part of the business's records (section 1).

15. Changes to this policy

We'll post any change here with a new date. For material changes, we'll email you or tell you in the app before they take effect, and we'll ask for your consent where the law requires it.

16. Contact

SumSwift Technologies Inc., British Columbia, Canada. Person in charge of privacy: Liam Davidson. Email: hello@sumswift.com.