Privacy policy
This application helps authorized staff manage customer-initiated inquiries for nonmedical appointment businesses. The operator is Ask Sumi, LLC. The fictional sample workspace uses sample customer conversations.
Information processed
When you authorize a live connection, Sumi processes account identifiers, display names, granted permissions, authorization tokens, and the conversations or channel content you ask it to retrieve. Facebook connections process the selected Page identity, Page-scoped customer identifiers and Messenger inquiries. Threads connections process profile identity, granted access, approved text and publication results. WhatsApp connections process the authorized business account and phone identifiers, display number, customer phone numbers, messages, timestamps, signup consent, registration and delivery status. Registration PINs are transmitted to Meta for registration and are not stored. Instagram and X connections support messaging; YouTube supports comments, source video/channel context and approved uploads; TikTok supports your basic profile and videos. Twilio supports SMS inquiries; we process sender and recipient phone numbers, message bodies, message identifiers, consent/opt-out events and delivery results. We also store business information you enter, reply drafts, content drafts and copywriting briefs, workflow status and an activity trail.
How we protect your data
Sumi uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Sumi's access at any time from the Google security settings page. These safeguards apply to Google and YouTube user data, including authorization tokens, connected channel information, retrieved comments, and video upload information, as well as other connected-account data processed by Sumi.
- Encryption in transit: The public Sumi application uses HTTPS, and Google authorization and YouTube API requests use HTTPS to protect data while it travels over the internet.
- Protection of stored credentials: Google access and refresh tokens are encrypted with AES-256-GCM before storage in the application database. The encryption key is held in server configuration and is not sent to the browser. This credential encryption does not mean that every stored comment or application record is individually encrypted.
- Workspace access controls: Access to live workspace data requires an authenticated, unexpired session. Server-side queries restrict access to the workspace associated with that session. Session identifiers are stored as hashes on the server; production sign-in cookies use Secure, HttpOnly and SameSite protections and expire after 12 hours.
- Restricted infrastructure access: The application database and job queue are not published as public services in our deployment. Server-side credentials are used for application access. Browser-origin checks help reject unauthorized cross-site changes, and API responses are marked not to be cached.
- Retention and removal: We limit storage and provide disconnect and deletion controls as described below. These controls reduce retained data and remove local access when you disconnect an account or delete your workspace.
Voice calls and recording choices
When voice is enabled for your business, Twilio handles the call and plays an AI and recording notice. Pressing 1 authorizes short recordings for Groq Whisper transcription and OpenCode Go / DeepSeek V4.1 Flash replies, summaries and staff coaching. Pressing 0 or providing no consent routes to a person without Sumi recording. You can ask for a human or say stop recording during a recorded turn; the current turn must first be transcribed to detect the request. Human transfers are not recorded by Sumi. Local transcripts, summaries and coaching expire within seven days and can be deleted from the Voice tab after the call ends. Audio is processed in memory, and Sumi requests Twilio recording deletion after processing or failure. Failed deletion is retried; until confirmed, Twilio may retain the recording. Minimal encrypted callback credentials can remain for one day after local deletion, and unresolved recording-deletion credentials remain until deletion succeeds. Provider retention, backups and processing terms apply separately; Sumi does not claim to delete provider logs or backups immediately.
TikTok Business Messaging
When separately approved and enabled, Sumi processes the authorized Business Account identity, encrypted access and refresh tokens, customer and conversation identifiers, names, incoming messages, approved text replies, timestamps, opt-out state and provider send results. TikTok Messaging data is stored separately in encrypted application records and is not sent to Sumi’s AI providers. A staff member reviews every reply. Message content expires within 30 days; disconnect removes local Messaging data and requests token revocation. Delete a conversation in the TikTok messages tab to remove its local content and suppress reimport for 30 days using a non-readable conversation fingerprint. Download conversation provides a copy of the displayed local data. TikTok retains its own messages and service records.
AI processing
When you request a reply, content or setup proposal, the relevant business facts, copywriting brief, inquiry text and any image you attach may be sent to OpenCode Go (Anomaly Innovations, Inc.), which routes it to OpenAI, L.L.C. for processing by the gpt-6-luna model, using a project-local Pi agent. OpenCode states that its models are hosted in the United States, that this model's inputs are not used for training, and that OpenAI retains abuse-monitoring logs for up to 30 days; see OpenCode's published data policy. AI assistance is available when enabled by the workspace operator. Processing live account content is disabled by default and requires the operator to establish the appropriate platform permissions and processing arrangements first.
This application does not train or fine-tune models on your data. Provider processing and retention are governed by the operator’s applicable provider agreements; provider retention may differ from Sumi’s retention periods. Text proposals require your approval before sending. Separately enabled voice responses follow the caller consent and escalation controls described above.
Hosting and service providers
This temporary review application is hosted by Bold Software, Inc. (exe.dev), which processes application requests and stores application records on our behalf. The current application server and database are in Tokyo, Japan. exe.dev also uses US-based logging services and infrastructure subprocessors. See exe.dev’s subprocessor list for its published providers. Hosting locations are separate from the operator’s business address. We will update these disclosures when the production hosting or processing arrangements change.
Storage and retention
For separately enabled Facebook Page image posts, Sumi validates the approved JPEG and transfers it directly to Facebook without retaining the image bytes in the database. For Threads image posts, explicit approval includes a temporary public image link so Threads can fetch the JPEG. Anyone with that link can fetch the image while active. Threads staging expires within 24 hours and is removed sooner after confirmed publication, terminal failure, cancellation before the publish request, disconnection or workspace deletion. A lost response may leave staging until expiry. Approval metadata, the content hash and provider identifiers remain with the draft. Local cleanup does not delete provider containers or published posts; manage those copies on Facebook or Threads.
For Instagram image publishing, you explicitly approve the exact image and caption and a temporary public media link so Instagram can fetch the image. Sumi stores the JPEG for at most 24 hours, removing it sooner after confirmed publication or failure, account disconnection, or workspace deletion. Anyone who obtains that link can fetch the image while it is active. Publication status, approval metadata and a content hash are retained with the draft. Deleting Sumi data does not remove a published Instagram post.
Saved content drafts are deleted 30 days after their last edit and are removed when you delete the workspace. Saving a draft does not publish it. An explicitly approved X post is sent to X when publishing is enabled. For an image post, Sumi validates a temporary local JPEG and transfers the image directly to X; image bytes are removed locally after validation/request processing and not stored in the database. X retains media under its policies; its publication attempt and identifier are recorded. Deleting Sumi data does not delete the platform copy. Approved consumer TikTok and YouTube video bytes are sent to those platforms; Sumi validates temporary media locally and records the upload hash, metadata, approval and provider status. YouTube resumable-session URLs are encrypted until the video identifier is confirmed. Video bytes are not retained in the application database. Delete uploaded videos separately in the destination platform, such as YouTube Studio.
Application records are stored in Postgres. Connection tokens are encrypted. JetStream carries job identifiers, not conversation text or images. Uploaded image payloads are removed from the job record after processing. Sample workspaces expire after one day; inactive live workspaces and their content expire after 30 days. Session access expires after 12 hours. You may delete your workspace sooner using the in-app controls.
Message history is limited to 30 days, including within active conversations. Social account metadata and tokens expire after 30 days unless refreshed or reauthorized; an expired connection must be reconnected. Platform revocation and deletion requirements take precedence. The operator must also establish appropriate retention and deletion for production backups before public use.
Pending Facebook authorization is encrypted and expires after ten minutes. Meta webhook deduplication and WhatsApp delivery records expire after 30 days. Facebook and Threads public text publication requires approval of the exact text and destination; the approval and provider identifiers remain with the draft for up to 30 days. Disconnect removes the local channel grant, cached conversations and its text drafts. WhatsApp disconnection does not close the business account, unregister the phone or cancel provider billing. Remove the business integration in Meta settings as well. An incoming service inquiry permits a relevant response; it does not authorize marketing.
Sharing and control
Data is used to provide the features above. Sumi does not sell data or use it for advertising audiences. You can disconnect a platform, revoke its access, and delete your local workspace records. A platform may retain its own copy of messages you sent.
For Google authorization, you can also remove access in your Google account permissions. Sumi’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. YouTube use is also subject to the YouTube Terms of Service and Google Privacy Policy.
TikTok Business content
When separately enabled and authorized, Business content access reads your owned posts and their public comments. Read-only comment results are displayed without saving comment text on the server. Preparing a staff-written reply stores the parent context and exact approved reply encrypted for up to 30 days, along with its delivery attempt. Uncertain delivery is not automatically retried. This does not enable DMs or AI processing of Business comments.
Business publishing uses a separate media-hosting flow. You explicitly approve temporary publicly accessible, unguessable media links so TikTok can fetch the original files. Anyone with a link can retrieve the file while active. Unused staged files expire after 24 hours. Files bound to an active or uncertain publishing task remain until its outcome is resolved, subject to account and workspace deletion; confirmed terminal tasks retain files for at least the 30-minute provider-fetch window before cleanup. Drafts and associated publication records expire 30 days after the last draft edit. Disconnecting Business content removes its local grant, staged files and reply records. Local deletion does not remove posts or replies already held by TikTok; manage those in TikTok.
Mobile information and consent
Mobile numbers and SMS opt-in or consent information are not sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. We use service providers such as Twilio to deliver and operate your requested messaging service. Any enabled model processing is limited to preparing the requested reply, as described above. SMS frequency varies with your inquiry; message and data rates may apply. Reply STOP to opt out or HELP for help.
SMS consent events and delivery records expire after 30 days. A keyed, non-readable contact fingerprint and suppression status are retained after disconnect or workspace deletion to prevent unwanted texting if the sender is reconnected. Only an authenticated customer opt-in message changes an existing opt-out; ordinary messages do not reset it. Twilio and carriers maintain their own opt-out records and message retention.
Cookies
A necessary HttpOnly session cookie keeps you signed in. Sumi does not install advertising pixels or analytics trackers.
Operator contact
Ask Sumi, LLC
support@asksumi.ai