Effective: 31 October 2026
SumAI is a product of SUM AI LTD, a private limited company registered in England and Wales with company number 17488020. Registered office: 29 Morrison Street, London, England, SW11 5LR.
1. About this policy
This policy covers the company website at sumaigroup.ai and the SumAI application at sumllm.ai, including Google Drive, Gmail and the Brain. Contact ajeyanth.ananthajeyasri@sumaigroup.ai for privacy questions, support or data requests.
SUM AI LTD ("we", "us") is the controller for account, enquiry and service-security information. Where an organisation instructs SumAI to process its content, the organisation determines that processing and its agreement with SumAI governs the respective data-protection responsibilities. Information in connected files or emails may concern people who do not have a SumAI account.
2. Information and purposes
We process account/contact details, authentication and security records; your prompts, uploads, conversations and generated answers; and content you connect. Connected content includes file or message text, selected attachments, titles, senders/recipients, dates, labels and source references. The Brain stores evidence passages, extracted facts, entities, relationships, summaries and embeddings used for search and future answers. These derived records can contain personal or confidential information.
We use this information to run accounts, respond to enquiries, ingest selected sources, retrieve relevant evidence, generate and review answers, preserve useful workspace knowledge, and protect and maintain the service. Account/service processing may be necessary to perform a contract with you; business communications, administration and security rely on legitimate interests in providing and protecting the service; specific legal duties rely on legal obligation. Where consent is the applicable basis, you may withdraw it. An organisation is responsible for its lawful instructions and relevant notices to people mentioned in its content. Google authorisation does not by itself establish a legal basis for every use of personal data.
Providing connected content is optional; without it, the corresponding source-based features cannot work. SumAI supplies AI assistance rather than making decisions with legal or similarly significant effects on your behalf. Do not use AI output as the sole basis for such a decision.
3. Google Drive and Gmail
- Drive:
https://www.googleapis.com/auth/drive.readonlyallows reading and downloading files available to the connected Google account. SumAI uses folder/file metadata and selected source content to ingest documents and provide answers with evidence. - Gmail:
https://www.googleapis.com/auth/gmail.readonlyallows reading mailbox content and settings. SumAI uses labels, messages and optional attachments selected through its filters to provide email-based answers and citations.
These are account-wide read-only grants. SumAI's folder, label, date and sender selections control what it processes; they do not narrow Google's token permissions. The connectors cannot send email or edit your Google files through these scopes. Google handles sign-in; SumAI does not receive your Google password. Encrypted OAuth credentials can permit continued access until disconnected or revoked.
Selected content is copied into SumAI storage and may remain after processing. Workspace access is governed by SumAI's permissions and does not automatically mirror each Google file's sharing rules. Connect only content you are entitled to process and share with the selected workspace and AI services.
4. AI providers and other recipients
OpenAI processes text for embeddings and knowledge extraction. The default Normal answer workflow uses OpenAI and Anthropic; reviewers can receive retrieved evidence and generated answers. Depending on the model/workflow, context may also go to Google Gemini, xAI, Microsoft Azure-hosted models, or SumAI-hosted models on Modal. Optional external research or verification can send queries or claims to Exa, Tavily or hosted web-search services. Not every provider receives every source, but derived answers and conversation history can carry source information between processing steps.
AWS hosts the application storage and processing infrastructure. A website hosting provider receives ordinary website request data. Authorised workspace members can access information according to the workspace's access controls. Service providers process information needed for the features they deliver; disclosures required by law and necessary security handling may also apply.
AI processing does not mean zero retention. OpenAI's standard API abuse-monitoring retention can be up to 30 days, with exceptions; stored Responses application state is separate. Anthropic's standard API retention is 30 days with safety, legal and feature exceptions. Paid Gemini terms exclude prompt/response use for product improvement but permit security-related retention. Other routes have service-specific terms. We do not promise that all providers have identical retention or that every request is immediately erased. Contact us for information about the processors applicable to your use.
5. Google API Limited Use
The use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. This covers derived evidence, embeddings and knowledge as well as original content.
Google data may be used only for the disclosed, permitted user-facing features. It must not be sold, used for advertising or creditworthiness, or used to train general-purpose AI models. Transfers and human access must remain within Google's permitted exceptions, including authorised feature delivery, necessary security handling and legal requirements. A broad licence in a service agreement does not override these restrictions. Connecting Google does not establish that Google has verified or endorsed SumAI.
6. Storage, retention and deletion
SumAI stores source bodies, evidence and graph/search data, encrypted connector credentials, processing jobs and checkpoints, conversations and usage/security records. Its primary live application stores use encryption at rest, with encrypted transport configured for service connections. This is not end-to-end encryption or a guarantee that every historical copy has identical protection.
Brain records and historical answers have no general automatic expiry. They remain available for the requested ongoing knowledge features until separately removed; selecting a date range controls ingestion, not retention. Account, processing and security records are retained according to the service purpose, request handling and applicable legal obligations. Backup/provider copies have separate retention arrangements. The primary database's seven-day automated backup setting is not a deletion deadline for manual snapshots, other stores or provider records.
Disconnecting Google stops future connector access; it does not erase previously stored content, derived knowledge or earlier answers. You can also revoke access through Google Account connections. Drive and Gmail share the same OAuth application, so revocation may affect both.
To request access, export, correction or deletion, email the contact above, identifying your SumAI account and the source/workspace concerned. Do not email passwords, tokens or unnecessary private content. We may need to verify your identity and, for organisational content, work with the relevant administrator/controller. There is no complete self-service Google Brain erasure control. Older derived records can require operator assistance and a wider agreed scope; no unrelated workspace data should be erased without appropriate authority. Backup, historical and provider copies require separate handling. We will explain the applicable scope, timing and any lawful retention; disconnect is not confirmation that your deletion request is complete.
7. International processing
The primary application infrastructure is in AWS's London region, but AI, hosting and support services can process information outside the UK, including in the United States and other provider locations. We do not promise UK-only processing.
OpenAI, Anthropic and paid Gemini publish data-processing terms with UK transfer provisions. The applicable contract, service and destination determine the safeguard for a particular transfer; a provider name alone is not proof of UK residency or zero retention. Contact us for details or a copy of the safeguards applicable to your processing. Restricted transfers must have an applicable adequacy basis or appropriate contractual safeguards, with assessment where required.
8. Your rights and website use
Depending on the circumstances, you may request access, correction, erasure, restriction or portability, and withdraw consent where relied on. You may object to processing based on legitimate interests, and to direct marketing at any time. These rights have legal conditions; requests are handled under applicable statutory deadlines, generally one month subject to lawful extensions. You may complain to the Information Commissioner's Office or your relevant regulator.
The marketing website contains no analytics or advertising tracker code. It loads Google Fonts, and hosting services receive ordinary connection/request information. The application uses essential authentication cookies and local interface settings. SumAI is intended for professional use, not as a children's service.
Material changes to data use will be explained through an updated notice and, where required, renewed consent. See the Terms of Service for service conditions.