Privacy Policy

We’re Sumvin Inc (“Sumvin,” “we,” “us,” or “our”), a company incorporated in Delaware, United States. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our website at sumvin.com (the “Site”).

This policy covers information collected through the Site only, including our email signup, waitlist, contact form, and newsletter. It is drafted to comply with the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the EU/UK General Data Protection Regulation (“GDPR”), the UK Privacy and Electronic Communications Regulations 2003 (“PECR”), and other applicable data protection laws.

For the purposes of the EU GDPR and UK GDPR, Sumvin Inc is the data controller responsible for your personal data. Our contact details for data protection matters are set out in the Contact section below.

You have control over your personal information. Here’s what you can do, depending on where you are.

Respond to enquiries

Process and reply to contact form submissions.

Waitlist management

Manage your place on our waitlist and notify you when the platform launches or when early access becomes available.

Newsletter

Send you our newsletter and related communications. You can unsubscribe at any time using the link in each email or by contacting hello@sumvin.com.

Site analytics

Understand how visitors use the Site, identify technical issues, and improve the user experience. Analytics data is processed in aggregate where possible.

Security

Detect and prevent unauthorized or malicious access to the Site infrastructure.

Legal compliance

Respond to lawful requests from authorities and comply with applicable laws.

Where required by applicable law (including the GDPR), we identify a lawful basis before processing personal data:

Consent

Newsletter subscription, marketing communications, and non-essential cookies. You can withdraw consent at any time without affecting the lawfulness of prior processing.

Performance of a contract

Waitlist signup and management. When you ask to join our waitlist, processing your name and email address is necessary to perform what you’ve requested, namely holding your place and notifying you when the platform launches or early access becomes available.

Legitimate interests

Responding to contact form submissions and monitoring site security (detecting malicious access). Server-side analytics that do not use cookies or track individuals (e.g. aggregate page view counts from server logs) are processed under legitimate interests. Cookie-based analytics require consent and are not processed under this basis. In each case, we have assessed that these interests do not override your rights.

Legal obligation

Where processing is required by law (e.g. responding to a court order).

No. We do not use automated decision-making or profiling (as defined in GDPR Article 22) that produces legal or similarly significant effects on you. If this changes in the future, we’ll update this policy and provide information about the logic involved, the significance of the processing, and its anticipated consequences.

We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising. We share personal information only in these limited circumstances:

Service providers

Third parties that operate the Site on our behalf, including our website hosting provider, email delivery platform, and analytics provider. We enter into data processing agreements (as required by GDPR Article 28) with each provider that processes personal data on our behalf. These agreements require providers to process data only on our documented instructions, implement appropriate security measures, and delete or return data upon termination. A current list of subprocessors is available on request at hello@sumvin.com.

Legal requirements

When required by law, regulation, legal process, or governmental request, including responding to subpoenas and court orders.

Business transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred to a successor entity. We’ll notify you before your data becomes subject to a different privacy policy.

With your consent

In any other circumstances where you’ve given us explicit consent.

We keep your personal information for as long as we need it for the purpose it was collected, and then securely delete or anonymise it. The table below sets out our retention periods. We do not retain data on the basis of undefined or open-ended business purposes.

Under the UK GDPR (Article 7(1)), PECR (Regulation 22), and the CCPA/CPRA, we need to be able to demonstrate that valid consent was obtained for marketing communications and non-essential data processing. We keep records of:

What was consented to

The specific processing activity (e.g. newsletter subscription, marketing emails).

When consent was given

The date and time of the consent action.

How consent was given

The method used (e.g. checkbox on signup form, double opt-in email confirmation) and the version of the consent language presented at the time.

Identity of the consenting individual

The email address or other identifier associated with the consent.

Withdrawal records

If you withdraw consent (opt out), we record the date and method of withdrawal. Withdrawal takes effect immediately: we stop sending newsletters and marketing emails within 24 hours of receiving an opt-out request, consistent with PECR Regulation 22(3) and UK GDPR Article 7(3).

These records are retained for six years from the date of consent or withdrawal (whichever is later), consistent with the ICO’s guidance on demonstrating compliance and applicable limitation periods.

Strictly necessary cookies

Required for the Site to function (session management, security, load balancing). These can’t be disabled as they’re essential to site operation. They don’t require consent under PECR or the ePrivacy Directive.

Analytics cookies

Help us understand how visitors interact with the Site (e.g. pages visited, session duration). Only deployed with your consent. You can opt out via our cookie banner or your browser settings.

Marketing cookies

Used to measure newsletter and campaign effectiveness. Only deployed with your prior consent.

Non-essential cookies are not deployed until you’ve provided affirmative opt-in consent through our cookie banner. Strictly necessary cookies are deployed on page load without consent, as permitted by PECR Regulation 6(4) and the ePrivacy Directive. Consent preferences are collected through our cookie banner and recorded as described in Consent records above.

We honour Global Privacy Control (GPC) signals as a valid opt-out request under CCPA/CPRA.

You can manage cookie preferences at any time through our cookie banner or your browser settings. Disabling analytics cookies may reduce our ability to improve the Site but won’t affect core functionality.

We use technical and organisational measures to protect your personal information, including:

• encryption of data in transit (TLS 1.2+);
• access controls limiting who can view personal data;
• regular review of our security practices; and
• use of reputable, security-audited hosting and email providers.

No system is completely secure. We use commercially reasonable measures to protect your data but can’t guarantee absolute security. If a breach compromises your personal information, we’ll notify affected individuals and applicable regulators within the timeframes required by law: within 72 hours under the UK GDPR and EU GDPR, and without unreasonable delay under applicable US state breach notification laws, including California’s data breach notification law (Cal. Civ. Code § 1798.82).

Sumvin is based in the United States. If you access the Site from outside the US, your personal data will be transferred to and processed in the United States and, where applicable, other countries in which our service providers operate.

For transfers from the UK and EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Implementing Decision (EU) 2021/914);
• the UK International Data Transfer Addendum to the SCCs (issued by the ICO under S119A of the Data Protection Act 2018); or
• adequacy decisions where applicable.

We conduct transfer impact assessments where required to evaluate the legal framework in the recipient country, and implement supplementary measures (encryption, access controls) as appropriate.

The Site is not directed at anyone under the age of 18. We do not knowingly collect personal information from children under 13 (or under 16 where required by applicable law, including under the GDPR and UK GDPR). If we become aware that we’ve collected data from a child, we’ll delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@sumvin.com.

In addition to California, Sumvin recognises privacy rights under comprehensive state privacy laws currently in effect, including those in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states as their laws take effect. If you reside in one of these states, you generally have the right to: access, correct, and delete your personal data; opt out of the sale of personal data, targeted advertising, and certain profiling; and appeal a denial of a privacy request.

We do not sell personal data, engage in targeted advertising, or profile consumers in furtherance of decisions that produce legal or similarly significant effects. To exercise your rights, contact hello@sumvin.com. We’ll respond within the timeframe required by your state’s law.

Nevada: We do not sell covered information as defined under Nevada SB 220. You may submit an opt-out request to hello@sumvin.com.

We may update this Privacy Policy from time to time. If we make material changes, meaning ones that affect your rights, our processing practices, data retention periods, or legal bases, we’ll give you at least 30 days’ notice by email (if we have your address) or by prominent notice on the Site before the changes take effect. Minor changes like updated contact details or typo fixes may take effect upon posting.

The “Last updated” date in the masthead of this document reflects the most recent revision.

If you have questions about this Privacy Policy, want to exercise your rights, or need to make a complaint:

General enquiries

hello@sumvin.com

Legal

legal@sumvin.com

Privacy

hello@sumvin.com

Unsubscribe

hello@sumvin.com

If you’re in the UK, you can also lodge a complaint with the Information Commissioner’s Office (ico.org.uk). If you’re in the EU, you can lodge a complaint with your local supervisory authority.

March 2026 (v0.1)

Initial publication of website Privacy Policy covering data collected through sumvin.com (signup, waitlist, contact form, newsletter, analytics, and cookies). Compliant with CCPA/CPRA, UK GDPR, EU GDPR, and PECR.

April 2026 (v0.2)

Added CCPA category table, sensitive personal information statement, authorized agent process, right to limit disclosure, automated decision-making disclosure, data controller identification, EU/UK representation disclosure, expanded US state privacy laws section, physical mailing address for privacy requests, cookie details placeholder, and consistency fixes across contact emails.

April 2026 (v0.3)

Filled effective date and last updated date. Changed legal basis for waitlist processing from consent to performance of a contract (GDPR Art. 6(1)(b)). Updated retention table to reflect new legal basis. Replaced cookie audit placeholder with current-state disclosure. Updated version numbering to v0.3. Legal review pass for regulatory compliance.

Sumvin Inc · Privacy Policy (Website) · v0.3 · April 2026