Sumchat Privacy Policy

Effective date: September 27, 2026 · Version 1.0

This policy describes Sumchat, including its personal Google Workspace connection and current service providers.

This Privacy Policy describes how Kaitlian LLC ("Sumchat," "we," "us"); 2108 N St #17084, Sacramento, CA 95816; collects, uses, and shares personal information. It covers:

• our own sites (sumchat.ai, app.sumchat.ai, sumchat.link, and related Sumchat-operated pages);
• the Sumchat platform; workspaces, Agents, and the services around them; and
• websites our customers publish through Sumchat; with an important caveat: on those sites, the customer who operates the site is responsible for your data, and we process it on their behalf. See Section 3.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use your content to train AI models.

1. Information we collect

Account and workspace information. When a workspace is created or you join one: your name, verified phone number, any email address you provide, workspace name, membership, brand access, and settings. We keep sign-in and invitation records to establish and protect access.

Workspace content. The content of your workspace: personal and group conversations with Agents, files, sites and applications and their data, media projects, schedules, Agent memory, messages and attachments sent or received through Sumchat, and call transcripts from the voice features. This is your (or your workspace's) content; we process it to provide the service, and Section 4 describes the narrow ways we use it.

Connections. When you connect third-party services (Google Workspace or social accounts), we store the credentials needed to act on your instructions, in a least-privilege custody design in which agents and site code never see raw secrets. What we receive from a connected service depends on the access you grant it.

Billing information. Our payment processor, Stripe, collects your payment card details directly; we never receive full card numbers. We keep records of purchases, payment receipts, prepaid ledger, and usage metering (priced in dollars).

Communications with us. Support requests, bug reports, and correspondence.

Automatic collection. Server logs (IP address, request metadata, timestamps) for security and operations; aggregate, per-site request counts for traffic panels and metering. Our own sites and the platform use only essential cookies; sign-in/session cookies and equivalent; and we do not use third-party advertising trackers, third-party analytics pixels, or session-recording tools on Sumchat surfaces.

Voice. If you use voice features, audio is streamed to our real-time voice provider to conduct the call and is processed into the conversation's transcript. Calls the platform handles disclose recording at the start of the call.

2. How we use information

We use personal information to: provide, secure, and operate the Services; execute your and your Agents' instructions; process payments and meter usage; provide support; send service and account notices (and, for waitlist contacts, the updates you asked for); investigate abuse and enforce our Acceptable Use Policy; and comply with law.

We do not use customer content to train machine-learning models, and our model providers are contractually prohibited from doing so with your content. We may use de-identified, aggregated operational data (for example, feature usage rates) to improve the Services.

Google Workspace data

Google access requires team review of your requested email followed by your own Google sign-in and consent. We save the request and review decision. The personal connection supports Calendar, Docs, Sheets, Slides, Tasks, and Drive files created by or specifically made available to Sumchat. We do not request Gmail, Google Photos, or unrestricted Drive access. Tokens remain in server-side credential storage and are not sent to the AI model or your browser.

We use Google content to perform the work you request. Relevant content and results can enter your private assistant conversation and saved work. Your Google connection is not automatically shared with workspaces or groups. Content you ask us to share goes to the recipients and services needed for that request. Disconnecting stops future access, but does not automatically delete content already copied into your work or access-review records.

Our Google Workspace privacy disclosure explains the data accessed, its use, service providers, retention, and disconnection in more detail. Sumchat's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy. We do not use or transfer Google user data, including raw, aggregated, anonymized, or derived information, to create, train, or improve foundational or generalized AI/ML models. Provider security retention and application memory are distinct from model training; we do not represent these services as having zero data retention.

Disconnect at Google Workspace or revoke access in your Google Account. Contact privacy@sumchat.ai to request deletion of previously stored content.

3. Published customer sites: who is responsible

Websites published through Sumchat are operated by our customers. If you visit a customer's site, create an account on it, submit a form, or transact there, the customer is the business responsible for your personal information, and their privacy policy; not this one; governs. Sumchat processes that data as the customer's service provider/processor: we host it, we don't sell it, we don't use it for our own purposes beyond operating the platform, and we return or delete it per our customer agreements.

Where we provide authentication or receive an abuse report, we process that information to provide access or investigate the report. Contact abuse@sumchat.ai to report a hosted site.

If you want to exercise privacy rights for data a customer's site holds about you, contact the site operator; if you can't reach them, contact us at privacy@sumchat.ai and we will pass your request to the customer and assist as their processor.

4. When we share information

We share personal information only with:

• Subprocessors; the infrastructure and service providers we use to run Sumchat (hosting, AI model inference, voice, message delivery, payments, social publishing, telephony). The current list, and what each does, is at /legal/subprocessors. Each is bound by contract to process your data only for the services they provide us.
• Third parties you direct. When you or your Agents (at your direction) send a message, publish a site or post, place a call, or connect a service, the content necessarily goes to its recipients and to the services you chose.
• Law and safety. We disclose information if required by law or legal process, or when necessary to prevent serious harm, investigate fraud or abuse, or protect our rights and those of our customers. Unless legally prohibited, we notify affected customers of legal demands for their workspace content.
• Corporate transactions. If Sumchat is involved in a merger, acquisition, or asset sale, personal information may transfer with the business, subject to this policy's commitments.

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months.

5. Your rights and choices

Access, correction, deletion, portability. Contact privacy@sumchat.ai to request a copy of your personal information, correct it, export your content, or request deletion of an account or workspace. We respond within the time applicable law requires and verify requests using your verified Sumchat identity. An authorized agent may submit a request with proof of authorization. We do not discriminate against you for exercising privacy rights. Removing workspace membership alone does not delete your personal account or its records.

Opt-out preference signals. Because we do not sell or share personal information, there is nothing to opt out of; we treat a Global Privacy Control signal as confirmation of that choice, and if our practices ever change, we will honor GPC as an opt-out where the law requires.

Do Not Track. Our sites respond to DNT the same way: we do not track visitors across third-party websites over time, so there is no cross-site tracking to disable. We also do not permit third parties to collect personal information about your activity over time and across different websites through Sumchat's own sites.

Email. Service and account notices are part of operating the Services. Anything promotional includes an unsubscribe.

6. Retention

We keep personal information for as long as needed for the purposes above: workspace content for the life of the workspace (plus a post-termination export window and standard backup cycles, after which it is deleted); account records and billing ledgers for the period tax and accounting law requires; security logs for a bounded operational window; waitlist information until you're onboarded or ask to be removed. Saved conversation context and memory follow the retention and deletion of the account or workspace to which they belong. Disconnecting a service is separate from requesting deletion.

7. Security

We build for isolation: authenticated people and workspace permissions govern access to shared application storage. Private work, assigned brands, group work and personal Google connections have separate access checks. Connection credentials remain in server-side custody. Data is encrypted in transit and at rest, and access is least-privilege. No system is perfectly secure; if a breach affects your unencrypted personal information, we will notify you as required by law ; for California residents, within 30 days of discovery, per Civil Code §§ 1798.29/1798.82.

8. Children

Sumchat and our sites are for business use and are not directed to children under 13; we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact privacy@sumchat.ai and we will delete it. Customer sites are subject to the same rule under our AUP.

9. Where we operate

Sumchat is operated from the United States, on infrastructure that may process data at edge locations worldwide (our hosting provider is a global network). If you access the Services from outside the U.S., your information is processed in the U.S. and wherever our subprocessors operate, under the safeguards in our Data Processing Addendum.

10. California disclosures (CCPA)

For California residents, in the categories of the CCPA: we collect identifiers (name, phone number, email, IP address), commercial information (purchases, billing ledger), internet activity (service logs and in-product activity), audio (voice-feature calls), professional information (workspace and role), and inferences only insofar as Agent memory contains notes about your work preferences; in each case from you, your workspace, or your use of the Services, for the business purposes in Section 2. We disclose them only as described in Section 4 (service providers and the parties you direct). We do not sell or share personal information, and we do not collect or process sensitive personal information for the purpose of inferring characteristics. You have the rights to know, access, correct, delete, and port, and to not be discriminated against, exercisable as described in Section 5. Statistics about requests received are available on request. We are a service provider with respect to customer workspace content and customer sites' end-user data.

11. Changes to this policy

We will post changes here with a new effective date, and for material changes we will notify account or workspace owners through verified contact details or in-product at least 14 days in advance. Prior versions are available on request.

12. Contact

privacy@sumchat.ai · Kaitlian LLC, 2108 N St #17084, Sacramento, CA 95816