Privacy policy
Last updated 12 November 2026
Draft for review. This document hasn't been checked by a solicitor yet and [bracketed] details are placeholders.
Short version: we collect what we need to run Sumsational, we don't sell it, we don't use it to train AI models, and you can ask us about it any time. Bookkeeping data is sensitive, so we treat it that way. The long version is below.
1. Who's responsible
Positive Mind Success Limited (Clyde Offices, 2nd Floor, 48 West George Street, Glasgow, G2 1BP, company number SC590201) is the controller of the personal data described in this policy. We're registered with the Information Commissioner's Office (ICO registration number ZB348984). Questions or requests: chris@positivemindsuccess.com.
2. Two different roles
This policy covers personal data we decide how to use: people who visit sumsational.com, ask for a beta invite, or have a Sumsational account.
Our customers also keep their records in Sumsational: bank lines, customers and suppliers, invoices, receipts and, if they run payroll, details of their employees. For that data the customer (or their accountant) is the controller and we're their processor: we only handle it on their instructions, under our Data Processing Addendum. If you're a customer, supplier or employee of a business that uses Sumsational, that business is the right place to start, and we'll help them answer you.
3. What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Beta invite requests: name, email, whether you run a business or a practice, what you use for the books now | To send your invite and plan the beta | Legitimate interests (ask us to remove you any time) |
| Account details: name, email, password (stored hashed), the businesses you can open and your role in each | To create and run your account | Contract |
| Usage and technical data: IP address, browser, pages used, error logs, the audit trail of changes to the books | To keep the service secure, keep an accurate record and fix bugs | Legitimate interests; legal obligation (accounting records) |
| Support conversations and emails with us | To help you and keep a record | Legitimate interests; contract |
We don't sell personal data, we don't build advertising profiles, and we don't use account or customer data to train AI models.
4. Bank connections
When you connect a bank or payment provider, it shares read-only account details and transactions with us at your request. We never see your banking password. Access keys and tokens are encrypted at rest, tied to your business, and used only to fetch your transactions. Disconnect at any time and we stop.
5. AI features
When Sprocket reads a receipt or suggests where a bank line goes, the content needed for that task is sent to an AI model provider to produce the result. We use providers that don't train their models on API data. A person always confirms before anything is posted to the books. [CONFIRM EACH PROVIDER'S DATA RETENTION TERMS BEFORE LAUNCH.]
6. Cookies
sumsational.com sets no cookies and doesn't track you. The app uses only strictly necessary cookies to keep you signed in and to complete bank connections. See our Cookie Policy.
7. Who we share it with
We use trusted service providers (sub-processors) to run Sumsational. They may only use the data to provide their service to us, under contracts that protect it.
| Provider | What for | Where |
|---|---|---|
| [HOSTING PROVIDER] | Servers that run the app and database | [LOCATION] |
| Cloudflare, Inc. | DNS and network protection; file storage (R2) for receipts | EU / USA |
| Resend, Inc. | Sending account emails (invites, password resets) | USA |
| Anthropic PBC | AI models (Claude) that read receipts and suggest categories | USA |
| [OTHER AI MODEL PROVIDERS, e.g. via OpenRouter, IF USED] | AI models | USA |
| TrueLayer Ltd (when Open Banking switches on) | Read-only Open Banking connections to UK banks | UK / EU |
When you choose to file with HMRC or Companies House, we send them what the filing needs, on your instruction. We may also share data if the law requires it, to protect our rights or users' safety, or with a buyer if our business is sold (they'd be bound by this policy).
8. International transfers
Some providers are outside the UK. Where data goes to a country without UK “adequacy”, we rely on safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.
9. How long we keep it
- Beta invite requests: until you're invited and set up, you ask us to remove you, or 2 years after our last contact.
- Accounting records: UK law expects businesses to keep them for at least 6 years, so we keep the books for as long as the account is open and help you take a copy before it closes. [CONFIRM CLOSURE AND EXPORT PROCESS BEFORE LAUNCH.]
- Account data: while your account is open, then deleted after closure. Backups roll off within 90 days.
- Security logs: up to 12 months.
10. Security
Each business's books are separated at the database level, connections are encrypted, passwords are hashed, bank keys are encrypted at rest, and backups are encrypted. Our Safe as houses page has the details. No system is perfect; if something goes wrong that affects you, we'll tell you and the ICO where the law requires.
11. Your rights
You can ask to see, correct, delete, restrict or move your personal data, object to how we use it, and withdraw consent at any time. Email chris@positivemindsuccess.com; we'll reply within a month. If you're unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.
12. Changes
If we change this policy in a way that matters, we'll tell account holders by email and update the date at the top.