1. Who we are
Sumitt (ABN 30 808 946 085), based in Victoria, Australia (“we”, “us”, “our”), provides quoting, invoicing and business-management software for Australian trade contractors. This policy explains how we handle personal information when you visit our site, create an account, or use the app, on the web or via our mobile apps.
2. What we collect
- Account details: your name, business name, email, phone, and password. Passwords are handled by our authentication provider and stored only as salted hashes; we never see or store them in plain text.
- Business profile: details you enter to appear on your quotes, including ABN, licence number, address, logo, insurance details, and your bank account name/BSB/number for receiving deposits.
- Quote, job & pipeline data: the jobs, rates, measurements, scopes, packages, clients, schedules, invoices and win/loss outcomes you create.
- Your clients’ details: names, contact details and addresses you enter onto a quote. You decide what client information you put in, and you are responsible for having a lawful basis to enter it.
- AI inputs: when you use AI features (the Foreman, the AI Estimator and Site Inspector), the text you send is processed to generate a response. See “AI features” below.
- Business risk checks: if you use the business risk check add-on, the ABN, ACN or business name you enter and the public-register extracts we retrieve about that business (from ABN Lookup, ASIC’s company dataset, the QBCC licence register and, where switched on, a commercial credit bureau). Where the ABN belongs to an individual or sole trader, that extract is personal information about them; we retrieve only registration, GST, business-name and licence facts for individuals, never adverse flags, and you are responsible for having a lawful basis to check them. Because we provide this information as part of a paid service, we treat ourselves as bound by the Australian Privacy Principles regardless of our size (Privacy Act s 6D(4)(c)). How the band is worked out is published at How risk checks work.
- Automated banding: the band on a business risk check (Green, Amber, Red or “not enough information”) is produced solely by a computer program applying the fixed rules published at How risk checks work. The kinds of personal information used when the business checked is an individual or sole trader are: ABN status and the date it took effect, GST registration status, registered business names, the business’s state and postcode, and any public trade-licence listing. The band is information shown to the Sumitt user who ran the check; it does not itself decide anything about the individual, and it can be disputed on the report, after which the disputed fact is held back pending review.
- Payment information: card payments are handled entirely by our payment processor (Stripe). We do not receive or store full card numbers. For payouts, we store your payment-processor account identifier, not your card data.
- Usage & device data: basic technical information (browser/app version, device, IP address, pages used, error logs) to keep the service secure and working.
3. How we use it
- To provide the service: building, saving, sending and displaying your quotes, invoices and schedule.
- To process deposits and payments through our payment processor.
- To manage your account, your free trial and your subscription, including keeping a one-way hash of your signup email or phone so one person gets one free trial (see How long we keep it).
- To power the AI features you choose to use.
- To keep the service secure, diagnose problems and prevent abuse and fraud.
- To contact you about your account, billing, important changes, or support requests.
We do not sell your personal information, and we do not use your quote or client data to advertise to you.
4. AI features
When you use an AI feature, the relevant inputs (for example a job scope, a question to the Foreman, or details you provide) are sent to our AI provider, Anthropic, to generate a response. Under our API arrangement, these inputs are used only to produce your response and are not used to train the provider’s models. Don’t paste anything into AI features that you wouldn’t want processed by a third-party provider. AI output is guidance only and may be wrong. You remain responsible for checking it.
5. Who we share it with
We share information only with the service providers who help us run Sumitt, each bound to use it only to provide their service to us:
- Supabase: database, authentication and file storage (hosting your account and quote data).
- Stripe: payment processing and payouts (deposits, subscriptions).
- Anthropic: the AI provider that powers the AI features.
- Resend (email): to send quote links, reminders and account notices, in your name where applicable. (Texting a quote opens your own phone’s Messages app, so the SMS goes from you, on your number; no SMS provider receives your data.)
- PostHog: product analytics (US-hosted) covering pages viewed and features used, by visitors and account holders, tied to your account id once you sign in. Never sold, never used for third-party advertising.
- Sentry: error monitoring, meaning technical error reports (which may reference your account id, never your quote contents) so we can fix faults.
- The app stores: if you subscribe through the Apple App Store or Google Play, that store processes your purchase under its own terms and privacy policy.
- Accounting software you connect: if you connect Xero (or another accounting integration we offer), your invoices sync to that account at your direction, under that provider’s own terms. Disconnect any time.
- Public registers and credit bureaus (business risk checks only): the Australian Business Register (ABN Lookup web services), ASIC’s published company dataset and the QBCC licence register receive the ABN/ACN you look up; where a commercial bureau is switched on for your account (Access Intell or CreditProtect, both registered recipients of ATO-disclosed business tax debts), it receives the ABN you check. None of them receives your quote contents or your clients’ details.
We may also disclose information where required by law, or to protect our rights, users or the public.
6. Where it’s stored & overseas processing
Your data is stored on reputable cloud infrastructure, encrypted in transit and at rest. Some of our providers (including Stripe and Anthropic, and depending on configuration, Supabase) may store or process data outside Australia, including in the United States. Where data is handled overseas, we take reasonable steps to ensure it is protected to a comparable standard.
If a data breach occurs, we will assess it promptly and, where it is likely to result in serious harm, notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
7. How long we keep it
We keep your account and business data for as long as your account is active. If you cancel, we retain it for a reasonable period so you can return or export it, then delete or de-identify it, except where we are required to keep records by law (for example, tax and transaction records, which may be retained for up to 7 years).
One record deliberately outlives account deletion: a one-way scramble (hash) of the email address or phone number you signed up with, and the date we first saw it. We keep it so a deleted account can’t be re-created to claim another free trial. We can’t read your address out of it and we never use it to contact you or build a profile, but we can check whether an address given to us at signup matches one, which is exactly how the trial check works, so we treat it as personal information rather than anonymous data. It holds nothing else: no name, no business details, no activity. Under APP 11.2 we must destroy or de-identify personal information once it is no longer needed for a purpose we may use it for; this record is still needed for that purpose, which is why it stays.
Business risk check extracts are kept with the check they belong to, so your report stays readable as it was on the day, and are deleted with your account. If the Australian Business Register withdraws a record and tells us, we delete every copy we hold of it, across all accounts, and your reports that relied on it show the fact as no longer available. You can dispute any fact on a report; while a dispute is open the fact is held back from the band.
8. Your rights
Under the Australian Privacy Principles you can ask us to access or correct the personal information we hold about you, and you can ask us to delete it. You can export your quotes and invoices at any time. To make a request, contact us using the details below. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
9. Account & data deletion
You can delete your account and associated personal data at any time. See Delete your account & data for exactly what is removed, what we must retain, and how long it takes.
10. Cookies & local storage
We use essential cookies and your browser’s local storage to keep you signed in and to remember your preferences. If you arrive via a campaign or a mate’s referral link, we set a first-party cookie recording that source so the right campaign or referrer gets credited: 30 minutes for campaign links, up to 60 days for invite links (so your mate’s invite still counts if you sign up later). It is not used for advertising. We do not use third-party advertising cookies. You can clear this data any time from your browser or device settings (doing so will sign you out).
11. Children
Sumitt is a business tool intended for adults (18+). It is not directed at children and we do not knowingly collect their personal information.
12. Changes to this policy
If we make material changes we will update this page and, where appropriate, let you know in the app or by email. The “last updated” date at the top always shows the current version.
13. Contact
Questions or requests about privacy? Email privacy@sumitt.com.au. You can also read our Terms of Service.