Privacy policy

1. Scope

This policy applies to the Sumaty website, owner and staff dashboard, branch feedback pages, private complaint workflows, reporting tools, and related support communications.

A hospitality business using Sumaty controls the customer and branch information it submits to the service. Sumaty processes that information to provide the contracted product and support the business's service-recovery workflow.

2. Information we process

The information processed depends on how the service is used.

• Account and organization information, including names, work email addresses, a mobile number used to verify control during owner registration, roles, branches, and access settings.
• Private complaint details, including the guest's message, selected branch, timestamps, case history, and optional contact details supplied for follow-up.
• Review and reply workflow data obtained through official Google Business Profile access or entered through an approved manual workflow.
• Operational records such as assignments, approvals, response times, notifications, report snapshots, and audit events.
• Technical information needed for security and reliability, including session, device, request, and error data.

3. How information is used

Sumaty uses information only for legitimate product and operating purposes.

• Provide, secure, troubleshoot, and improve the service, including verifying control of the mobile number used during owner registration.
• Route complaints and reviews to authorized team members and support human-approved replies.
• Generate branch and organization reporting, alerts, and audit history.
• Respond to support, security, privacy, and legal requests.
• Prevent abuse, unauthorized access, scraping, fraudulent reviews, and policy-violating use.

4. Complaint contact details and marketing

Contact details submitted through a private complaint are used for complaint follow-up and service recovery. They are not treated as consent for marketing messages.

A business must obtain separate, explicit consent before using complaint contact information for advertising or promotional communication.

5. AI and external integrations

Package 1 provides manual reply workflows and does not include AI drafts. Editable AI response suggestions are included in Package 2. Package 2 may automatically publish only eligible validated replies after explicit organization-owner opt-in and under versioned rules, exception holds, audit evidence, idempotency controls, and kill switches.

Google access uses official APIs and OAuth authorization. Sumaty does not ask businesses for Google passwords and does not rely on production review scraping. Integration providers receive only the information needed to perform their service.

6. Sharing, retention, and security

Information may be shared with vetted hosting, email, monitoring, analytics, AI, and integration providers acting under appropriate service terms. Sumaty does not sell private complaint information.

Information is retained for the period needed to provide the service, satisfy contractual and legal obligations, resolve disputes, and maintain security records. Retention periods will be finalized before production launch.

Sumaty uses role and branch access controls, encryption where appropriate, audit records, and operational monitoring. No system can guarantee absolute security.

7. Choices, rights, and contact

Account administrators can update organization and team information through the dashboard. Guests and business users may contact the relevant business or Sumaty to request access, correction, deletion, restriction, or another applicable privacy right.

Requests are verified before action is taken. Some information may be retained where required for security, fraud prevention, legal obligations, or the establishment and defense of claims.

Form purpose notices

Contact details are used to coordinate the requested signup, pricing enquiry or trial, or to follow up on a complaint as explained at the relevant form. Optional complaint contact details do not authorize marketing. Terms acceptance, marketing permission and automation opt-in are recorded separately.