Legal

Privacy Policy

Last updated: September 7, 2026

Sumptus Technologies LLC (“Sumptus,” “we,” “us”) provides an expense-verification platform. This policy explains what data we collect, why, and the choices you have.

Contents

Information we collect
How we use information
Automated analysis & AI
Client verification data
How we share information
Data retention
Deleting your account
Security
Your rights
Children
Contact

1. Information we collect

We collect information you provide directly and information generated as you use the service:

Account & company data — name, work email, company name, role, and team membership.
Expense data — receipt images, merchant, amount, date, party size, category, and the text you enter.
Location data — your device’s precise GPS location at the moment you capture a receipt, used to corroborate that the receipt matches the merchant location. Location is read only at capture time, never in the background. You can decline location access and still use the app.
CRM data — when you connect a CRM (Salesforce, HubSpot, Pipedrive), contact, deal, and meeting metadata used to match expenses to relationships.
Verification responses — a client or counterparty’s yes/no confirmation and its timestamp.
Usage & device data — app version, device type, and diagnostic logs used to keep the service reliable.

2. How we use information

To operate the service: capture, score, route, and store expenses and their audit trail.
To verify expenses by contacting the relevant client or counterparty on your behalf.
To generate compliance scores and reports against your organization’s policy.
To secure the platform, prevent fraud, and meet legal obligations.

3. Automated analysis & AI

Sumptus uses automated processing to score expenses against your organization’s policy. To do this, receipt details (such as merchant, amount, category, and the notes you enter) and, where relevant, the business context of a meeting are sent to our AI provider, Anthropic, which processes them on our behalf to return a compliance assessment. This data is not used to train third-party models.

For expense verification, Sumptus may also look up publicly available professional information about a business contact you name (for example, to confirm a stated name, company, or role using public web sources). We use this only to help assess whether a claimed meeting is genuine, and we do not build marketing or advertising profiles from it. Automated scores assist human reviewers in your organization; they do not by themselves make final decisions about you without the ability for a person to review.

4. Client verification data

A core feature of Sumptus is independently confirming a meeting with the client or prospect involved. When you submit an expense, we may send that person a one-time request (in-app, email, or SMS) asking them to confirm or deny the meeting. We collect their response and the time it was given. We do not require the recipient to create an account, and we do not use their contact details for marketing.

Within your organization — managers, finance, and administrators see the expenses and verification results relevant to their role.
Service providers (sub-processors) — a limited set of vendors process data on our behalf under contract, and only to deliver the service:
- Supabase — application database, authentication, and file storage.
- Anthropic — AI compliance scoring and identity checks (see section 3).
- Resend — transactional and verification email delivery.
- Twilio — SMS verification delivery, where SMS verification is enabled.
- Sentry — crash and error diagnostics.
Legal — where required by law or to protect rights and safety.

These providers act as processors on our instructions. We do not sell personal information, and we do not share it with third parties for their own independent use or for advertising.

6. Data retention

We retain expense and audit-trail records for as long as your organization’s account is active, and thereafter as needed to meet the retention periods your compliance obligations require. Because expense records belong to your employer, they may be kept in your organization’s books after your personal account is closed — see section 7.

7. Deleting your account

You can permanently delete your account at any time from within the app: Settings → Delete account. When you do, we remove your login and personal profile (name, email, and device push token). The expenses you previously submitted remain on your organization’s books for their financial records, but are anonymized — disassociated from you and relabeled so they no longer identify you.

No longer have the app? Email dcharles@sumptus.co from the email address on your Sumptus account with the subject “Delete my Sumptus account.” We’ll confirm the request and delete your account within 30 days, with the same result as deleting it in the app.

If you are the only administrator of a company that still has other members, you’ll be asked to promote another administrator first so the organization isn’t left without one. You can also email dcharles@sumptus.co for help closing an entire company account.

8. Security

We encrypt data in transit and at rest, enforce role-based access, and follow the practices described on our Security page. No system is perfectly secure, but we work to protect your data proportionate to its sensitivity.

9. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. You can delete your account in-app as described above, or contact us to exercise any other right, and we will respond within the timeframe the applicable law requires.

10. Children

Sumptus is a workplace tool intended for use by businesses and their employees. It is not directed to children, and we do not knowingly collect personal information from anyone under 16.

11. Contact

Questions about this policy or your data? Reach us at info@sumptus.co or via our contact page.