1. Who we are
Sumitt (ABN 30 808 946 085) is a sole trader based in Victoria, Australia (“we”, “us”, “our”). We make quoting, invoicing and job software for Australian trades. This policy covers the website, the web app and the mobile apps.
2. What we collect
- Your account: your name, business name, email, phone and password. Our login provider stores the password as a salted hash. We never see it.
- Your business profile: the details that print on your quotes. ABN, licence number, address, logo, insurance details, and the bank account, BSB and PayID your clients pay into.
- Your work: quotes, rates, measurements, scopes, packages, jobs, schedules, invoices, payments, claims, variations, timesheets, purchase orders, receipts, site photos and win or loss outcomes.
- Photo locations: if you tap Pin location on a site photo, we store the spot where it was taken. Your own screens show the exact spot. The evidence pack you give a client shows it only to about a kilometre.
- Your clients: the names, contact details and addresses you put on a quote. You choose what to enter, and you need a lawful basis to enter it. When a client accepts a quote or approves a variation, we record their typed name, their drawn signature if they add one, and the time. We also keep their browser details and a one-way code made from their IP address, never the address itself, and for a quote a fingerprint of the document they accepted. That record is their electronic signature under the Electronic Transactions Act, and it stays with the quote.
- Quote requests and bookings: when someone uses your public request or booking link, we store what they type and the photos they add, under your account.
- Your crew: if you send a worker a crew link, we store the name they give, their clock-on and clock-off times, and the notes and photos they add. The link shows them the job’s title and address. It is your job to tell your crew this happens.
- AI features: what you type to the Foreman, the AI Estimator and the Site Inspector, the variations you ask it to draft, the receipts you scan, and the photos you attach. Section 4 says what else goes to the AI provider.
- Business risk checks: the ABN, ACN or business name you check, and the public register facts we fetch about it. The sources are ABN Lookup, ASIC’s company dataset, the QBCC licence register and, where switched on, a commercial credit bureau. Where the ABN belongs to a person or sole trader, those facts are personal information about them. For a person we fetch only registration, GST, business-name and licence facts, never adverse flags, and you need a lawful basis to check them. We provide this as part of a paid service, so we treat ourselves as bound by the Australian Privacy Principles whatever our size (Privacy Act s 6D(4)(c)). How the band is worked out is at How risk checks work.
- Automated banding: the band on a risk check (Green, Amber, Red or “not enough information”) is produced only by a computer program applying the fixed rules published at How risk checks work. For a person or sole trader the personal information used is: ABN status and its start date, GST status, registered business names, the business’s state and postcode, and any public trade-licence listing. The band is information shown to the Sumitt user who ran the check. It does not decide anything about the person on its own. It can be disputed on the report, and a disputed fact is held back until it is reviewed.
- Payments: card payments are handled by Stripe. We never receive a full card number. For payouts we store your Stripe account id, not your card.
- A mate you refer: if you type a mate’s email on the refer-a-mate page, we keep it on your referral record so the reward can be matched when they sign up.
- Prospects: if you leave your email or mobile on one of our landing pages, we keep it so we can reply, with the page you came from. If you never sign up, it is deleted after 90 days.
- Usage and device data: browser or app version, device, IP address, the pages you use and error logs, to keep the service secure and working. Analytics is described in section 5.
3. How we use it
- To run the service: building, saving, sending and showing your quotes, invoices, jobs and schedule.
- To take deposits and payments through Stripe.
- To run your account, your free trial and your subscription. That includes a one-way hash of your signup email or phone, so one person gets one free trial (see section 7).
- To power the AI features you choose to use.
- To keep the service secure, find faults and stop abuse and fraud.
- To contact you about your account, billing, important changes or support. Account nudges can be switched off under Settings, Policies, or by the unsubscribe link in the email.
We do not sell your personal information. We do not use your quotes or your clients’ details to advertise to you.
4. AI features
AI features send your inputs to our AI provider, Anthropic (United States), to write a response. Under our API terms Anthropic uses them only to answer you, never to train its models. Some of those inputs are built for you from your account rather than typed by you:
- The Foreman reads your real numbers: open quotes, margins, win rates and unpaid invoices. When it talks about a client, it also gets that client’s name, their history with you, what they owe you, and the result of any risk check on their business.
- The customer brief writes a short profile of a client from their history with you: who they are, what they care about, and any risks. We keep that profile on the client’s record until you delete the client or your account.
- A quote request from your public link sends the customer’s description and photos, to draft the scope and lines.
- Scanning a receipt sends its photo, to read the supplier, the lines and the totals.
- Drafting a variation sends what you said about the change, the accepted quote’s scope and up to four site photos.
- The plain-English summary on a business risk report is written by fixed rules in our code, not by the AI provider.
- Each Foreman conversation is saved on your account, with the quote it was looking at, so you can pick it up again. We delete Foreman conversations and AI Estimator runs after 90 days.
Do not paste anything into an AI feature that you would not want a third party to process. AI output is guidance only and can be wrong. Checking it is your job.
5. Who we share it with
We share information only with the providers that run Sumitt. Each may use it only to provide their service to us.
- Supabase: our database, login and file storage, hosted in South Korea.
- Vercel: runs the app’s web servers, in South Korea. Vercel is a United States company, and its network passes the app’s pages through servers around the world.
- Stripe: card payments, payouts and subscriptions (United States).
- Anthropic: the AI provider, as described in section 4 (United States).
- Resend: sends our email (United States). Quote links, receipts and reminders in your name, account notices, and, if you switch it on, a weekly or monthly backup email to your login address with a zip of your whole account attached. Texting a quote opens your own phone’s Messages app, so no SMS provider sees your data.
- Apple: if you turn on push notifications in the iPhone app, the title and text of each notification pass through Apple’s push service. A notification can name a client or a worker, as in “Sam accepted your quote”. Notifications on Android and desktop carry no text at all; the app fetches it with your login.
- PostHog: product analytics, hosted in the United States. It receives the pages you view and the features you use, tied to your account id once you sign in. It never receives money figures, your clients’ names or emails, or the links in your quotes. Never sold, never used for advertising.
- Sentry: error monitoring, if we switch it on. An error report carries the screen and the action that raised it, and may carry your account id. Never your quote contents.
- The app stores: if you subscribe through the Apple App Store or Google Play, that store handles your purchase under its own terms.
- RevenueCat: manages subscriptions bought in the iPhone app (United States). It receives your account id and the purchase, never your quotes.
- Accounting software you connect: if you connect Xero (or QuickBooks, once it switches on), your invoices and client details go to that account at your direction, under that provider’s terms. Disconnect any time.
- Public registers and credit bureaus (business risk checks only): ABN Lookup, ASIC’s published company dataset and the QBCC licence register receive the ABN or ACN you look up. Where a commercial bureau is switched on for your account (Access Intell or CreditProtect, both registered recipients of ATO-disclosed business tax debts), it receives the ABN you check. None of them receives your quotes or your clients’ details.
We may also disclose information where the law requires it, or to protect our users, our rights or the public.
6. Where it is stored, and overseas processing
Your data is encrypted in transit and at rest. It is stored and processed outside Australia: the database, your files and the app’s web servers in South Korea, and payments, app subscriptions, AI, email and analytics in the United States. We take reasonable steps to make sure it is protected there to a standard like Australia’s. There is no Australian data residency yet.
If a data breach occurs, we assess it promptly. If it is likely to cause serious harm, we tell the people affected and the Office of the Australian Information Commissioner. That is what the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) requires of us.
7. How long we keep it
We keep your account and business data while your account is open, on any plan or none. Cancelling a subscription keeps your data. Deleting your account removes it. When you delete your account, everything goes: your profile, quotes, clients, jobs, invoices, payments, AI history and settings. We keep no copy of your invoices or payments, so download the bookkeeper pack from Reports first if you need the records for tax. Prospect details left on a landing page are deleted after 90 days if you never sign up. Foreman conversations and AI Estimator runs are deleted after 90 days.
One record outlives deletion: a one-way scramble (hash) of the email or phone you signed up with, and the date we first saw it. It stops a deleted account coming back for another free trial. We cannot read your address out of it, and we never use it to contact you or build a profile. We can only check whether an address given at signup matches it, which is the trial check itself, so we treat it as personal information. It holds nothing else: no name, no business, no activity. Under APP 11.2 we must destroy personal information we no longer need. We still need this one, for that one purpose, so it stays.
Business risk check facts are kept with the check they belong to, so your report reads as it did on the day, and they go when your account goes. If the Australian Business Register withdraws a record and tells us, we delete every copy we hold, across all accounts, and your reports show the fact as no longer available. You can dispute any fact on a report. While a dispute is open, the fact is held back from the band.
8. Your rights
Under the Australian Privacy Principles you can ask to see or correct the personal information we hold about you, and you can ask us to delete it. You can export your quotes and invoices at any time from Reports. To make a request, use the contact details below. If you are not happy with our answer, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
9. Account and data deletion
You can delete your account and its data at any time, from Settings or by email. See Delete your account and data for exactly what is removed, what stays, and how long it takes.
10. Cookies and local storage
We use essential cookies and your browser’s local storage to keep you signed in and to remember your settings. Three small first-party cookies record where you came from, so the right campaign or mate gets the credit: one for 30 minutes to carry you through sign-in, one for 7 days from a tagged link or a social highlight, and one for up to 60 days from a mate’s invite link. None is used for advertising. We use no third-party advertising cookies. You can clear this data any time from your browser or device settings; doing so signs you out.
11. Children
Sumitt is a business tool for adults (18+). It is not aimed at children, and we do not knowingly collect their personal information.
12. Changes to this policy
If we make a material change we update this page and, where it matters, tell you in the app or by email. The “last updated” date at the top always shows the current version.
13. Contact
Questions or requests about privacy? Email privacy@sumitt.com.au. You can also read our Terms of Service.