Privacy Policy

Last updated: April 2026

1. Who we are

SumoStudy is operated by SumoTech Ltd (Company No. 12045570), registered in England and Wales. We are the data controller for personal data collected through the app.

2. Data we collect

• Account data: email address and login/session identifiers
• Learning data: vault subscriptions, study progress, streaks, and answer history
• Billing data: subscription status and Stripe customer/payment references
• Technical data: device/browser metadata and error logs needed to operate the service

3. How we use data

• Provide and secure your account
• Deliver core learning features, including spaced repetition and progress tracking
• Process subscriptions and prevent fraud
• Maintain reliability, troubleshoot issues, and improve the product
• Meet legal and regulatory obligations

4. Third-party service providers

We use the following third-party services to operate SumoStudy:

• Stripe — payment processing and subscription management
• Resend — transactional email delivery (e.g. account verification)
• Sentry — error tracking and application monitoring
• PostHog — product analytics to understand feature usage

Each provider is bound by appropriate data processing agreements. We do not sell personal data to any third party.

5. Legal basis (UK GDPR)

We process data under: contract (to provide the SumoStudy service), legitimate interests (service security and improvement), legal obligation (tax, accounting, and compliance requirements), and consent where required by law.

6. Data retention and deletion

We retain account and learning data while your account is active. After account closure, we may retain certain data for a limited period as required by legal, tax, fraud prevention, and dispute handling obligations. You may request deletion of your data at any time (see Your Rights below).

7. Your rights (UK & EU GDPR)

Under UK GDPR and EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request that we limit processing of your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. You may also lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your rights have not been respected.

8. Security

We apply technical and organisational controls to protect personal data, including access controls, encrypted transport (HTTPS), and secure credential storage. No online service can guarantee absolute security, but we take data protection seriously.

9. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via email or an in-app notification. Continued use of SumoStudy after such notification constitutes acceptance of the updated policy.

10. Contact

SumoTech Ltd
Company No. 12045570
Registered in England & Wales
[email protected]