sumqo

Sumqo Privacy Policy

Effective date: October 21, 2026 · Version 2026-10-21

This Privacy Policy explains how Vifros Corp, a Florida corporation ("Vifros Corp," "we," "us," or "our"), operating the Sumqo cloud accounting and bookkeeping service (the "Service"), collects, uses, discloses, and safeguards information in connection with the Service. "Sumqo" is a product and brand of Vifros Corp (Vifros Corp d/b/a Sumqo).

This Policy applies to information we process as part of providing the Service to our customers, their authorized users, and the customers, vendors, contractors, and signers those customers interact with through the Service. It should be read together with our Terms and Conditions. For much of the financial and business data uploaded to the Service, our customer is the controller (or business) and Vifros Corp acts as a processor (or service provider) that handles such data on the customer's behalf and on its instructions.

Sumqo is currently a beta (early-access) service. Our data practices described here apply during the beta.

1. Information We Collect

We collect the following categories of information:

  • Account and identity information. Information you provide when you register and administer an account or workspace, such as your name, business name, email address, role, telephone number (if provided), authentication credentials, two-factor settings and trusted devices, the versions of the Terms and beta notice you accepted and when, and plan details.
  • Business and financial data you upload (Customer Data). The accounting and bookkeeping data that you and your authorized users enter, upload, import, or generate in the Service, which may include invoices, estimates, expenses, bills, bank and card statements and their transactions, reconciliation records, journal entries, financial reports, budgets, time entries, customer, vendor and worker details, imported QuickBooks data, receipts, contracts and other supporting documents.
  • Tax identification numbers. Where you or your vendors use the W-9 and 1099 features, the Service collects taxpayer identification numbers (EIN or SSN) and related tax classification details. Tax identification numbers are encrypted at rest with a dedicated key, are shown masked in the Service except where the document itself requires the full number, and are never included in email bodies.
  • Information about your customers, vendors and signers. Names, email addresses, phone numbers, postal addresses, and messages of the people you invoice, pay, or send documents to. When you give them portal access or send them a contract to sign, we also collect their sign-in codes, the times they sign in (with the IP address and browser information of the device), the documents they view, the messages they send you, and, for electronic signatures, the signer's name, email, IP address, device and browser information, signature image or typed signature, and a time-stamped audit trail of the signing process. When someone opens a link you shared (for example an invoice link), we record when it was viewed and the IP address and browser information of the device.
  • Email delivery and engagement events. When the Service sends email on your behalf (invoices, statements, reminders, payment receipts and notices, pay stubs, portal codes, contract requests, briefings), we record delivery outcomes (delivered, bounced, complained) and keep a record and a copy of each email sent. Unless the workspace owner turns it off in Settings → Email ("Track email opens and link clicks", on by default), invoices, statements, reminders, receipts, payment notices, pay stubs, briefings and similar emails also contain a small tracking image and links routed through the Service, so we record, for each recipient, whether and when the message was opened and which links were clicked, together with a shortened IP address (the last part of the address is removed before it is stored) and the browser information of the device that opened it. Turning tracking off also stops recording opens and clicks of emails sent earlier. Our own subscription and billing emails to you are never tracked. This information is shown to you in the Service so you know what happened to what you sent.
  • Payroll and worker information. If you use the payroll features, your employees' names, email and postal addresses, pay rates, pay and withholding details (including Form W-4 inputs) and the last four digits of their Social Security numbers; the Service does not store employees' full Social Security numbers in payroll records. Contractors are recorded as vendors, and their taxpayer identification numbers are handled as described in the next item.
  • Check printing. If you print checks, the bank routing and account numbers printed on them and the signature images of the people authorized to sign; both are encrypted at rest and shown masked except where they are printed or deliberately revealed by an authorized user.
  • Receipts sent by email. If you forward receipts to your workspace's receiving email address, we receive the whole email message; its attachments are added to your documents and the raw message is deleted after thirty (30) days.
  • Subscription billing. When you pay for a Sumqo plan, your card or other payment details are entered on Stripe's pages and processed by Stripe, Inc. ("Stripe") as our payment processor. We receive and keep the plan, the price, the billing period, the status of each charge, a Stripe customer reference and links to the invoices Stripe issues; we do not store your card details. We also keep a record of your consent to the Subscription and Billing Terms (the version, the time, the email address of the person who accepted and the IP address) for at least three (3) years.
  • Online payments your customers make. If you accept online payments for your invoices, your customers enter their card or bank details on Stripe's pages. For that payer data Stripe acts as an independent controller under its own privacy policy, not as our processor. We receive only what your bookkeeping needs: the payer's name and email, the amount, the date, the payment status, the invoice it paid, and the card brand and last four digits. We never receive or store full card or bank account numbers.
  • Usage, log, and device data. Technical information generated when you use the Service, such as IP address, device and browser type, operating system, access timestamps, pages and features used, referring pages, and diagnostic and error logs. We use this information primarily for security, fraud prevention, troubleshooting, and improving reliability.
  • Support and chat. Messages you send us through the support chat, contact form, or support tickets, the name and email address you give us (visitors who are not signed in can chat without an account), and the details needed to answer them. When a signed-in user files a ticket, they can choose to attach technical details (the page they were on, a description of their browser, the app version, recent error messages shown on screen) and, if they tick it, a read-only snapshot of the one record on screen with tax identification numbers, bank details and access tokens removed. Support conversations are answered by people, not by AI.
  • API keys, webhooks and connected apps. If your workspace uses API keys or connected applications, a usage log of each request (the key or app, the address it came from, what was requested and the result) and a log of webhook deliveries.
  • The free invoice tool. The free tool that works without an account keeps what you enter in your own browser's storage on your device; it is not uploaded to us unless you later create an account and choose to import it. We only receive anonymous daily counts of page views, PDF downloads and saved drafts, which contain no personal information.
  • Cookies and browser storage. Essential session tokens and preferences stored in your browser to keep you signed in, remember your settings, and protect security. We do not use advertising or cross-site tracking cookies. See Section 12.

Other than the tax identification numbers described above, we do not intentionally collect special categories of personal data through the Service, and we ask that you not upload sensitive personal data except as necessary for ordinary bookkeeping purposes.

2. How We Use Information

We use information for the following purposes:

  • To provide, operate, maintain, and support the Service, including hosting and processing Customer Data on your behalf;
  • To power the automated and AI-assisted features you use, such as extracting details from receipts, bills, statements and tax forms, suggesting categories and matches, generating insights and briefings, drafting email text, the tax assistant, and answering questions in the assistant. These features run on AI models (currently Amazon Nova and Anthropic Claude models) provided through Amazon Bedrock in AWS regions in the United States. Customer Data sent to AI models is used only to produce the requested output for your workspace. Under AWS's terms for Amazon Bedrock, the model providers do not receive your prompts or outputs and do not use them to train their models, and we do not use Customer Data to train or fine-tune AI models; what the Service "learns" from your corrections (such as categorization rules) is stored as rules inside your own workspace. Assistant conversations are kept for thirty (30) days after the last message, and files the assistant generates for you for thirty (30) days;
  • To send email and deliver documents on your behalf to the customers, vendors, and signers you choose, and to report delivery and engagement events back to you;
  • To authenticate users, manage accounts, and secure the Service against unauthorized access, fraud, and abuse;
  • To charge for paid plans, send billing notices (receipts, renewal and price-change notices, failed-payment notices), and process optional online payments;
  • To provide customer support and respond to your requests;
  • To monitor, troubleshoot, and improve the performance, reliability, and features of the Service, including during the beta program;
  • To send transactional and service-related communications (such as account, billing, security, operational, and beta-program notices);
  • To comply with legal obligations, enforce our Terms, and protect the rights, property, and safety of Vifros Corp, our customers, and others; and
  • For other purposes disclosed to you or to which you consent.

We process Customer Data in accordance with our customer's instructions as set out in the Terms and this Policy. We do not use Customer Data for advertising and we do not sell Customer Data.

3. Legal Bases for Processing

Where data protection law (such as the EU/UK GDPR) requires a legal basis, we rely on one or more of the following, depending on the context:

  • Performance of a contract — to provide the Service to you under the Terms;
  • Legitimate interests — to secure, operate, and improve the Service, prevent fraud and abuse, and run our business, where not overridden by your rights;
  • Legal obligation — to comply with applicable laws, including tax, accounting, and recordkeeping requirements; and
  • Consent — where we ask for it for a specific purpose, which you may withdraw at any time.

Where we act as a processor on behalf of a customer, the customer is responsible for establishing the legal basis for the underlying processing of personal data contained in its Customer Data, including the data of its own customers, vendors, and signers.

4. How We Share Information; Sub-Processors

We do not sell personal information or Customer Data. We share information only as described below:

  • Service providers and sub-processors. We engage trusted third parties to perform functions on our behalf, including: Amazon Web Services (AWS) for cloud hosting, storage, and infrastructure, for sending transactional and service-related email (Amazon SES), and for running the AI models behind the assistant and extraction features (Amazon Bedrock); Stripe, Inc. as our processor to charge for Sumqo plans and, where you enable online payments, to process your customers' card and ACH payments (for your customers' payment details Stripe is an independent controller, see Section 1); and Intuit Inc. / QuickBooks to enable optional import of accounting data at your direction. These providers are authorized to use information only as necessary to provide their services to us and are bound by appropriate confidentiality and data protection obligations.
  • At your direction. When you send an invoice, statement, reminder, pay stub, portal invitation, or contract, we share the relevant data with the recipient you chose. When you enable an optional integration or connection (such as QuickBooks import, Stripe payments, your own SMTP email server, Slack, Microsoft Teams or Discord notifications, webhook endpoints, a calendar feed, an API key, or a third-party application such as an AI assistant you authorize to access your workspace), we share the relevant data with that service or application as needed to provide that functionality. Those recipients are not our sub-processors; your use of them is subject to their own terms and privacy policies.
  • Legal and safety. We may disclose information if required by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety, or to enforce our Terms.
  • Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy.

We do not sell your personal information or Customer Data, and we do not share it for cross-context behavioral advertising. You may request our current list of sub-processors by writing to info@vifros.com.

5. Data Retention

We retain account information and Customer Data for as long as your account is active or as needed to provide the Service, and thereafter as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Following termination, Customer Data remains available for export for thirty (30) days, after which the workspace is closed and its Customer Data retained as described below; it is erased on request, and we complete a verified erasure request within thirty (30) days. Our backups are kept for a limited period after which they are overwritten: point-in-time database recovery covers the most recent thirty-five (35) days, weekly backups are kept for ninety (90) days, monthly backups for one (1) year, and earlier versions of uploaded files for one hundred eighty (180) days. Operational logs, including the records of payment events Stripe sends us, are kept for up to two (2) years for security and troubleshooting. Subscription consent records are kept for at least three (3) years, also after you cancel, while the workspace exists. Audit trails of changes made in your workspace, electronic-signature audit trails, the record and copy of each email sent, items in "Recently deleted", and support conversations are kept for the life of the workspace. Some records expire sooner: individual email open and click events twenty-four (24) months after they happen (the summary on each sent email, such as the number of opens and the last time, stays with that email's record), assistant conversations and generated files after thirty (30) days, in-app notifications and API usage logs after ninety (90) days, webhook delivery logs after thirty (30) days, portal sign-in logs after one (1) year, raw emails forwarded to your receipts address after thirty (30) days, and one-time sign-in and verification codes within minutes.

When a workspace is deleted. An owner can delete a workspace from Settings → Workspace (see Section 15 of the Terms). It stays read-only for thirty (30) days. After its last day the workspace is closed: nobody can sign in to it, its pages and links stop working, its team's access ends and any remaining Sumqo subscription is cancelled. Its data is retained while Vifros Corp keeps it under this policy: its records and settings, its files, email and open/click records, support conversations with us, audit trails, and subscription and consent records. The owner (or the controlling customer) can ask us at info@vifros.com to restore the workspace or to permanently erase it. We complete a verified erasure request within thirty (30) days. Demo workspaces are erased automatically one day after they are deleted or expire. When a workspace is erased, we delete its records and settings, every version of its files, email and open/click records, support conversations with us, API keys and app connections, subscription and consent records, and the sign-ins of people who belong to no other workspace; afterwards we keep only: (a) Sumqo's own records of the fees we earned on its online payments, which include the business name; (b) totals counted across all workspaces, with this workspace's share removed; (c) a record that the workspace was closed and erased (when it was requested and completed, and by whom, as an internal identifier and a one-way hash of the requester's email address), with no other personal data, and the erasure request record, including the reference you gave us, for one (1) year; and (d) if a Sumqo administrator acted on the workspace, an internal record of which administrator did it. Copies in our database backups expire on the schedule above (at most one (1) year). Raw emails sent to the workspace's receipts address are deleted thirty (30) days after they arrived. As a processor, we will also delete or return Customer Data on the instruction of the controlling customer except where retention is required by law.

6. Security

We implement reasonable and industry-standard administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption in transit, encryption at rest, and an additional layer of field-level encryption, with keys managed in AWS Key Management Service, for tax identification numbers (including Social Security numbers), the bank account numbers and signature images used to print checks, authenticator-app secrets for two-factor sign-in, QuickBooks connection tokens, outgoing email server passwords, chat-notification and webhook addresses and secrets, and payment-platform secrets, optional two-factor authentication and trusted-device checks, an extra identity check before especially sensitive actions (such as revealing a tax identification number or exporting a full backup), sign-in rate limits, role-based permissions, logical separation of each customer's data in our multi-tenant environment, and audit logging. However, no method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. You are responsible for maintaining the security of your credentials and for configuring your account, user roles, and portal access appropriately. If we become aware of a security incident affecting your data, we will notify you as required by applicable law.

7. International Data Transfers

The Service is designed for businesses in the United States and is operated from infrastructure located in the United States (including the AI models described in Section 2), and information may be processed in countries other than the one in which you are located, which may have different data protection laws. Where we transfer personal data subject to the GDPR or other applicable law across borders, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or other lawful transfer mechanisms. You may request more information about these safeguards by contacting us at info@vifros.com.

8. Your Rights and Choices

Subject to applicable law and to your relationship with the controlling customer, you may have rights to access, correct, update, export, restrict, or delete personal information, and to object to certain processing. Account owners and administrators can access, correct, export, and delete much of the Customer Data directly through the Service's features, including full-workspace export and backup, and an owner can delete the whole workspace (see Section 5). If you are an individual whose personal data appears in a customer's Customer Data (for example, a customer, vendor, contractor, or signer of one of our customers), you should direct your request to that customer (the controller); we will assist our customers in responding to such requests as required. To exercise rights with respect to data for which we are the controller, contact us at info@vifros.com. We will respond within the timeframes required by applicable law and may need to verify your identity before acting.

Email tracking. Workspace owners can turn email open and link-click tracking off for their workspace in Settings → Email; it is on unless turned off. Recipients can prevent open tracking by disabling remote images in their email client. A recipient who wants their open and click records deleted should contact the business that sent the email; we will help that business respond.

9. GDPR — Notice for Individuals in the EEA and UK

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR, to the extent applicable: the right of access; the right to rectification; the right to erasure ("right to be forgotten"); the right to restrict processing; the right to data portability; the right to object to processing based on legitimate interests; and the right to withdraw consent where processing is based on consent. Where Vifros Corp acts as a processor, these rights are generally exercised through the controlling customer. You also have the right to lodge a complaint with a supervisory authority. The data controller for Customer Data is ordinarily our business customer; for personal data for which Vifros Corp is the controller, Vifros Corp is the controller. Our data protection contact is info@vifros.com.

10. CCPA / CPRA — Notice for California Residents

This Section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies. Much of the personal information we process is on behalf of our business customers, for whom we act as a "service provider" and which we process only pursuant to our contract with the customer.

Subject to applicable law and verification, California residents may have the right to: (a) know and access the categories and specific pieces of personal information we have collected; (b) request deletion of personal information; (c) request correction of inaccurate personal information; (d) opt out of the "sale" or "sharing" of personal information; and (e) limit the use of sensitive personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA. We will not discriminate against you for exercising your rights. Where we process personal information as a service provider, requests should be directed to the relevant business customer, and we will assist that customer as required. To submit a request relating to personal information for which we are the business, contact us at info@vifros.com.

11. Children's Privacy

The Service is intended for business and professional use by individuals who are at least eighteen (18) years of age. The Service is not directed to children or minors under eighteen, and we do not knowingly collect personal information directly from children under eighteen. If we become aware that we have inadvertently collected such information directly from a child in violation of applicable law, we will take reasonable steps to delete it.

12. Cookies and Similar Technologies

We use only essential cookies and browser storage necessary to operate the Service, including to authenticate users, maintain sessions, remember preferences, and protect security and integrity. We do not use cookies for advertising, profiling, or cross-site tracking, and we do not allow third-party advertising trackers on the Service. The Service itself does not set cookies; it keeps your sign-in token, your preferences (for example a collapsed menu or a remembered button choice), a support-chat session, a customer-portal session, and the data of the free invoice tool in your browser's local or session storage. Because these are required for the Service to function, disabling them through your browser may prevent you from signing in or using the Service. Email open tracking, described in Sections 1 and 8, uses a small image in the emails the Service sends on your behalf and is not a cookie.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Service, by email, or by other reasonable means, and we will update the "Effective date" and version above. Your continued use of the Service after the effective date of the updated Policy constitutes your acknowledgement of the changes, to the extent permitted by law.

14. How to Contact Us

For questions about this Privacy Policy or to exercise your privacy rights, please contact us at:

  • Vifros Corp (d/b/a Sumqo)
  • 9838 Old Baymeadows Rd #142, Jacksonville, FL 32256-8101, United States
  • Email: info@vifros.com
  • Fax: (904) 592-5384

Version 2026-10-21 · Powered by Vifros Corp