Privacy Policy

Last updated: October 27, 2026

This policy explains what data Sumaro (the "app") collects, what we use it for and how we protect it. The app is operated by David Villatoro, in the Commonwealth of Virginia, United States.

1. What data we collect

Account data: your email address and your password (the password is stored encrypted; we cannot see it).
Documents you upload: invoices or receipts as a PDF or a photo. Before a photo is uploaded, the app shrinks it on your phone so it takes up less space.
Extracted data: vendor, date, total amount, tax, category, whether it is business or personal, and a summary of each document.
Payment and subscription data: your plan (Free or Pro), your subscription status, the identifiers Stripe gives us for your account and subscription, and any credit packs you bought before. Your card details are handled by Stripe; we do not see or store them.
Plan usage: how many receipts you analyzed in the month and, if you have any, your balance of previously purchased credits.
Basic technical data that our providers record automatically, such as IP address and browser type, for security and operation.

2. What we use your data for

To create and manage your account.
To analyze your documents and show you the results.
To charge your subscription, keep track of the receipts you use each month and of your credits, and let you manage or cancel your subscription.
To send you necessary emails (account confirmation, receipts, important notices).
To prevent fraud and keep the app secure.

We do not sell your data and we do not use it for advertising.

3. Who we share your data with

Only with the providers we need to make the app work:

Google (Gemini API): receives the document (PDF or photo) to read it and extract the data. We use Google's paid plan, under which Google does not use your documents to train its AI models.
Supabase: stores your account, your extracted data, the photo or PDF of each receipt (in a private folder), your plan and your payment history.
Stripe: processes card payments, charges the monthly subscription and gives you the page to manage or cancel it.
Render: hosts the app on the internet.

Your accountant (only if you ask): if you use the "Send to my accountant" button, we create a private link that expires after 30 days. Anyone with that link can view and download the receipts you marked for taxes for that year (data and photos), so share it only with your accountant.

We may also share data if the law requires it (for example, a court order).

4. How long we keep your data

PDF files and photos: we keep the photo or PDF of each receipt along with its data, so you can view it later as proof. It is stored in a private folder: only you can see it from your account, through a link that expires after 10 minutes. You can delete just the photo or the whole receipt at any time from your history, and it is deleted right away. If you delete your account, we also delete your photos.
Extracted data and account: kept while your account is active, so you can see your history.
Payment records: may be kept for up to 7 years for tax and accounting obligations.

5. Your rights

You can ask us at any time to:

See a copy of your data.
Correct inaccurate data.
Delete your account and your data (except payment records the law requires us to keep).

Write to us at davidspaint10@gmail.com from your account's email. We respond within 30 days. If you live in California or another state with its own privacy laws, you have these same rights and we will not treat you differently for using them.

6. Security

We use encrypted connections (HTTPS), encrypted passwords and access controls on the database. No system is 100% secure, but if a security problem affecting your data occurs, we will notify you as required by law.

7. Cookies

The app only uses the storage in your browser that is needed to keep you signed in, remember your language and keep a copy of the app so it opens quickly on your phone. We do not use advertising or tracking cookies.

8. Minors

The app is not directed at anyone under 18, and we do not knowingly collect data from minors.

9. Changes to this policy

If we make important changes, we will notify you by email or in the app.

10. Contact

Privacy questions: davidspaint10@gmail.com