Sumus

Privacy Policy

Last updated: October 13, 2026

This Privacy Policy explains how Sumus ("Sumus," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our website, create or join a workspace, use AI agents and related tools, connect a computer or third-party service, purchase a subscription, or contact us. It should be read together with our Terms of Service.

In this Policy, the "Service" means the Sumus website, applications, workspaces, AI agents, connected tools, and related services. "Service Content" means messages, prompts, files, instructions, outputs, agent memory, and other content processed through the Service.

1. Information we collect

The information we collect depends on how you use the Service.

Account and profile information

We collect information used to create, secure, and manage your account, such as your name, email address, profile image, authentication identifiers, sign-in method, language preference, and account settings. Our authentication service may provide us with information associated with the account you use to sign in. Signing in does not by itself give an agent access to other services associated with that account.

We also maintain session and security information that may include sign-in time, IP address, browser or device information, and records used to authenticate requests and detect unauthorized access.

Workspace and collaboration information

We collect workspace and group names, membership, roles, invitations, sharing choices, agent profiles and settings, member usage information, and records of actions taken in a workspace. If you join a workspace provided by an employer, client, team, or other organization, that organization and its authorized administrators may manage membership, permissions, agents, usage limits, and information made available through the workspace.

Messages, files, and task information

We process the information you and other authorized participants provide to the Service, including messages, prompts, task instructions, attachments, feedback, conversation history, and AI-generated outputs. We also process information that agents create or retrieve while carrying out authorized tasks, such as tool activity and results, browser content, screenshots, downloaded files, generated files, scheduled-task records, and agent memory.

Agents may retain context, files, or memory so that work can continue across conversations. A conversation view is not necessarily a separate storage environment for the agent. You should only provide information that you have the right to use and share.

Connected services and computers

When you connect a third-party account or service, we process information needed to identify and manage the connection, record your permissions and approvals, and perform actions you request. Depending on the task, this may include account metadata and content retrieved from or sent to the connected service.

If you connect a computer for use with local agents, we process information such as the computer name, operating system, runtime version, connection status, available agent software and models, assigned agents, and task delivery results. Local agents may use files, applications, accounts, and credentials available on that computer within the permissions you grant. Native local-agent sessions and working files may remain on the connected computer, while Sumus stores information needed to route tasks and maintain the Service's conversation history.

Billing and transaction information

We collect plan, subscription, invoice, transaction, payer, and credit-usage information. Payments are completed through a payment service provider. Sumus does not store full payment-card numbers or card security codes.

Support and communications

We collect the information you provide when you contact us, including your contact details, the content of your request, attachments, and information needed to investigate or resolve it.

Technical, usage, and analytics information

We automatically collect information about how the Service is accessed and used, such as IP address, device and browser characteristics, page visits, referring pages, campaign information, feature interactions, error and diagnostic information, and security events. We may also collect limited interaction-replay information as described in Section 7.

2. How we obtain information

We obtain information:

  • directly from you when you create an account, provide Service Content, connect an account or computer, make a purchase, change settings, or contact us;
  • from other workspace participants when they invite you, mention you, share content with you, or use collaborative features;
  • from services and accounts that you choose to connect or authorize;
  • from agents, models, tools, and execution environments when they perform requested tasks; and
  • automatically through the website, applications, cookies, logs, and similar technologies.

Some information is required to provide a requested feature. For example, we need account information to authenticate you and task content to carry out a task. If required information is not provided, the relevant feature may not work. Optional profile, connection, or task information can generally be withheld by not using the related feature.

3. How we use information

We use personal information to:

  • create, authenticate, secure, and administer accounts;
  • create and operate workspaces, groups, permissions, invitations, and collaboration features;
  • receive instructions, run AI agents, generate responses, use authorized tools, and deliver task results;
  • maintain conversation history, agent memory, files, backups, and other continuity or recovery features;
  • connect accounts and computers and carry out actions that users authorize;
  • provide subscriptions, measure usage, allocate credits, process payments, and maintain transaction records;
  • provide support, investigate errors, and communicate about the Service;
  • monitor reliability, prevent fraud and abuse, enforce our terms, and protect users and the Service;
  • understand how the Service is used, improve product experience, and measure the effectiveness of public advertising; and
  • comply with applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, these activities may be necessary to provide the Service you request, comply with legal obligations, or pursue legitimate interests such as security, support, and product improvement. Where we rely on consent, you may withdraw it as described in Section 12. Withdrawing consent does not affect processing that was lawful before withdrawal.

4. AI agents, models, and automated processing

To carry out a task, Sumus may send relevant Service Content to AI model, computing, browser, storage, and tool services. The information sent depends on the agent, model, tool, connection, and task. It may include your prompt, relevant conversation context, attachments, agent instructions and memory, content retrieved from an authorized source, and tool results.

Different models and tools may be provided under different accounts, configurations, retention terms, and data-use terms. A model or tool selected or connected by you or your organization may therefore handle information differently from another model or tool. Local execution does not necessarily mean that all task information stays on the connected computer: a local agent may send information to the model or service configured for that agent.

AI systems generate outputs through automated processing. Sumus may use automated systems to route tasks, enforce access and usage limits, detect abuse, identify possible security issues, and support service operation. Where applicable law provides a right concerning a decision based solely on automated processing that produces legal or similarly significant effects, you may contact us to exercise that right. The Service is not designed to make such decisions on Sumus's behalf about users.

5. Collaboration, workspace visibility, and organizational accounts

Sumus is designed for collaboration. Service Content may be visible to other people and agents according to the workspace, group, conversation, sharing, and permission settings in effect when the content is used.

  • Content in a shared group or thread is available to its authorized participants.
  • Content shared with an agent may be used by that agent across authorized work and may be included when it communicates with another participant, agent, tool, or destination as part of an authorized task.
  • Workspace owners and administrators can manage membership, roles, agents, usage, and other workspace settings. Depending on the feature and their authorization, they may also have access to workspace activity and content.
  • A participant who receives or exports content may retain a separate copy. Removing the original content does not automatically remove copies held by other participants or external services.

If an organization provides or manages your workspace, it may have its own rules and privacy responsibilities. Questions about the organization's use of information should be directed to that organization. You may still contact Sumus about processing for which Sumus is responsible.

6. How we disclose information

We disclose information only as needed for the purposes described in this Policy.

Service providers

We use service providers that support functions such as authentication, infrastructure, data storage, AI models, cloud and local task execution, browser automation, connected-account access, payments, analytics, advertising measurement, communications, and customer support. They receive the information reasonably necessary to perform their functions and are subject to applicable contractual or other protections.

People and organizations you choose to work with

We disclose content and account or workspace information to participants, workspace administrators, agents, connected services, and other recipients as directed by your actions, permissions, and authorized tasks. If you follow an external link, interact with an external site, or send information to a third party, that party's own terms and privacy practices apply.

Legal, safety, and business purposes

We may disclose information when we reasonably believe disclosure is required by law or legal process; is necessary to protect the rights, safety, and security of users, Sumus, or others; is needed to investigate fraud, abuse, or violations of our terms; or is necessary to establish, exercise, or defend legal claims.

We may also disclose information to professional advisers under appropriate duties of confidentiality or as part of a merger, financing, acquisition, reorganization, sale of assets, or similar transaction, subject to applicable protections and notice requirements.

We do not sell personal information for money. We do not provide message or file contents to third parties for their own targeted advertising. Some privacy laws define "sale," "sharing," or targeted advertising more broadly; you may contact us regarding rights that apply where you live.

7. Cookies, analytics, advertising measurement, and interaction replay

We use cookies, browser storage, and similar technologies to keep you signed in, protect sessions, remember preferences, maintain workspace choices, understand use of the Service, and measure public advertising and conversions.

Our analytics may record page views, navigation, feature interactions, account registration, message submission milestones, checkout activity, verified purchases, device or browser information, and related identifiers. Advertising measurement may use campaign or click identifiers and transaction information such as amount, currency, and a transaction reference. Our configured analytics events are not intended to include message bodies, attachment contents, passwords, authentication tokens, or full payment-card details.

Interaction replay helps us diagnose navigation and usability problems. We configure private text and form inputs to be masked and restrict unnecessary capture. Public website and pricing content may remain visible in a replay. Masking reduces exposure but does not make all technical metadata anonymous, and a replay service may still receive information such as page location, device details, and interaction timing.

You can manage cookies through your browser and may use available content-blocking or privacy controls. Blocking cookies or storage that are necessary for authentication or preferences may prevent parts of the Service from working. Browser controls do not delete information already collected or records needed to provide the Service.

8. Data security

We use technical and organizational measures designed to protect personal information against unauthorized or accidental access, use, alteration, loss, and disclosure. Depending on the system and information involved, these measures include authenticated access, workspace and role-based permissions, encrypted network transmission, protection of stored credentials, separation of customer workspaces, logging and monitoring, backups and recovery controls, security review processes, and confidentiality requirements for personnel authorized to handle information.

Agents can use tools and communicate with external systems, so security also depends on the permissions, accounts, instructions, recipients, and services selected for a task. Review access before connecting an account or computer, grant only the permissions needed, and avoid providing passwords or other unnecessary sensitive information in messages or files.

No service, storage system, or transmission method can guarantee absolute security or prevent every attack, error, or vulnerability. If you believe your account or information may have been compromised, contact support@sumus.im promptly.

9. International processing

Sumus and the services used to provide the Service may process information in countries or regions other than where you live. The location depends on the infrastructure, model, tool, connected service, support, and analytics functions involved. Those locations may have data-protection laws that differ from those in your jurisdiction.

Where required, we use contractual or other lawful safeguards for international transfers. You can contact us for more information about safeguards relevant to your use of the Service.

10. Retention and deletion

We retain information for as long as reasonably necessary for the purposes described in this Policy, including providing and securing the Service, maintaining account and workspace continuity, processing transactions, resolving disputes, enforcing agreements, and meeting legal obligations. Retention varies by data type and context:

  • account, workspace, conversation, file, memory, and task information may be retained while the relevant account, workspace, agent, or feature remains active;
  • transaction, credit, tax, and accounting information may be retained for financial, dispute, and legal requirements;
  • security, diagnostic, and abuse-prevention records may be retained long enough to investigate events, protect the Service, and maintain an appropriate audit history;
  • analytics and interaction-replay information is retained according to operational settings and applicable provider arrangements; and
  • backups and recovery copies may remain for a limited period after active information is removed and are deleted or overwritten through normal recovery cycles.

There is no single retention period for all Sumus information. A workspace backup or recovery period is not a promise that all conversations, billing records, analytics, or provider-held information are deleted on the same schedule.

Deleting or archiving an agent, conversation, file, or workspace may not immediately remove related information from backups, security records, transaction records, recipients' copies, a connected computer, or an external service. Disconnecting a service prevents future authorized use through that connection but does not automatically delete information already retrieved or sent.

You may request account closure or deletion by contacting support@sumus.im. We may verify your identity, clarify workspace ownership or the records involved, and retain information where permitted or required for security, legal, financial, or dispute-resolution purposes.

11. Your responsibilities and choices

You can choose what information to provide, which workspaces to join, which agents and models to use, which accounts or computers to connect, and what permissions to grant. You can use available account and workspace settings to manage certain profile, membership, connection, and sharing information.

You are responsible for keeping your account and connected computers secure, reviewing agent access, and ensuring that you have authority to provide personal information about other people. Revoking access at a connected service may not delete Sumus records, cancel a subscription, or remove information already processed as part of a task.

If you receive access through an organization, some choices may be controlled by its workspace owner or administrator. Leaving a workspace does not necessarily delete content that forms part of the organization's shared records.

12. Your privacy rights

Depending on your location and applicable law, you may have rights to:

  • know whether we hold personal information about you and how it is used;
  • request access to, correction of, or a copy of personal information;
  • request deletion of personal information;
  • object to or request restriction of certain processing;
  • withdraw consent where processing relies on consent;
  • request transfer of information in a portable format where applicable;
  • exercise applicable rights concerning targeted advertising, sale, or sharing; and
  • complain to a relevant data-protection authority or appeal a decision on a request.

To submit a request, email support@sumus.im, preferably from the email associated with your account. Describe the request and the information concerned. Do not send us your password or full payment-card details. We may request information reasonably necessary to verify your identity, authority, account, or relationship to the relevant workspace.

Rights are subject to applicable exceptions. For example, we may need to retain certain information to comply with law, protect other people, preserve the integrity of shared workspace records, complete a transaction, or establish or defend legal claims. We will respond within the period required by applicable law and explain any material limitation or refusal. We will not discriminate against you for exercising a protected privacy right.

13. Children

The Service is intended for people who are at least 18 years old and able to enter into the Terms of Service. It is not directed to children. If you believe a child has provided personal information without the authorization required by applicable law, contact us so that we can investigate and take appropriate action.

14. Changes to this Policy

We may update this Policy as the Service, our practices, or applicable requirements change. We will publish the updated Policy on this page and change the "Last updated" date. Where required by applicable law, we will provide additional notice or request consent before a material change takes effect.

15. Contact us

For privacy questions, requests, or concerns, contact support@sumus.im.