Privacy Policy

This policy explains how Sumzy (the AI review-summary plugin for WooCommerce, operated from sumzy.io by Flamboyant Flamingos SRL) handles data. It is written to describe what Sumzy actually does, not generic boilerplate.

These terms apply to the WooCommerce version of Sumzy. Use the platform toggle at the top of this page to switch to the Shopify Privacy Policy, which covers the Shopify app instead. The Shopify app reads reviews from a review provider (Judge.me) and is billed through Shopify, so its data flow differs from the WooCommerce plugin described here. Read the version that matches your install.

This document also incorporates two sections that previously stood as separate pages and now live here as anchored sections: the Sub-processors disclosure (GDPR Art. 28(4)) and the Data Processing Agreement (the GDPR Art. 28 controller-to-processor contract). Both retain their full legal effect. Links to /dpa and /subprocessors resolve to those sections.

There are two distinct relationships to keep separate:

1. Sumzy as a service to merchants (processor role). When a store installs Sumzy, the merchant is the data controller of its customers' reviews and Sumzy is a processor acting on the merchant's behalf. The legal terms of that relationship are in the Data Processing Agreement section below.
2. Sumzy as a website/account operator (controller role). For the merchant's own account, marketing, and support data we collect directly at sumzy.io, Sumzy is the controller.

In this document:

• 1. What review data leaves the store
• 2. What we retain
• 3. AI transparency
• 4. Account and site data
• 5. Sub-processors (summary)
• 6. Billing and Merchant of Record
• 7. International transfers
• 8. Retention periods
• 9. Data-subject rights
• 10. Children's data and automated decisions
• 11. Contact
• Sub-processors (full disclosure)
• Data Processing Agreement

1. What review data leaves the store, and what we do with it

In short. For each approved review, only the text, the star rating, and a coarse recency band leave your store. Never the reviewer's name, email, IP, or the exact date. The text goes to our backend and to Anthropic's Claude to make the summary, and is not used to train AI models. Sumzy keeps no raw review text.

This is the core of Sumzy, so we describe it precisely.

Sent from the store to Sumzy (over HTTPS, from a background job; never on a shopper page load):

• For each approved review: its text, its star rating (1 to 5, when present), and a coarse recency band derived from the review date (recent, older, or historical). The exact review date is never sent, only this coarse band.
• An opaque product reference (a numeric product id, not the product name or URL) so the summary maps to the right product.
• The merchant's configured output language and summary tone for the request.
• The plugin's license key (sent as a bearer token over TLS) and the site URL, for authentication and entitlement checks. The license key is stored only as a hash at rest (see §2); it travels in the request itself to authenticate the call.

Deliberately NOT sent: the reviewer's name, email, or IP address; the exact review date; the product title; the verified-purchase flag; or any WooCommerce customer, order, billing, or shipping identifier. The reviewer is never identified as a structured field; only the review's free text, its rating, and a coarse age band leave the store.

What happens to the review text:

1. The Sumzy backend (hosted on Railway, United States) receives the review text.
2. It is sent to Anthropic's Claude API (United States) to generate a structured summary. Under Anthropic's commercial API terms, this input is not used to train AI models.
3. The summary is returned; Sumzy runs a PII scrub over the summary text, the aspect labels, and the per-aspect summaries.
4. Sumzy stores no raw review text. In Sumzy's own systems the review text is held only for the duration of the request and the AI call, and the raw-input field is nulled the moment the job finishes. There is no database column that keeps it at rest.
5. What Anthropic holds, and for how long. Anthropic (our AI sub-processor) processes the review text to produce the summary. How long Anthropic retains that input depends on the processing mode: on the standard, interactive path it is held only as long as Anthropic's commercial API requires; when a summary is produced through Anthropic's batch processing mode (which Sumzy may use for bulk generation), Anthropic retains the batch request and result for up to about 29 days before deleting it. In both modes the input is not used to train AI models, and the same Standard Contractual Clauses apply. So the retention picture is exact: Sumzy keeps no raw reviews; our sub-processor holds the input briefly, then deletes it.

2. What we retain (and what we do not)

In short. We keep the derived summary, a one-way hash of the review set (to detect changes), and your account/entitlement data (with the license key stored only as a hash). We do not keep raw reviews.

Sumzy does NOT retain raw review text in its own systems. (Separately, our AI sub-processor holds the input briefly to do the processing and then deletes it; see the retention note in §1 and §8.) What persists in the Sumzy backend is only:

• The derived summary (result_json): the prose gist, the ranked product aspects (each with a short per-aspect summary and per-aspect mention counts), the overall sentiment, confidence, and the count of reviews analyzed (all subject to a PII scrub so reviewer personal data does not appear in shopper-visible strings).
• A one-way SHA-256 hash of the review set (review_set_hash), used solely to detect when the underlying reviews have changed and a refresh is warranted. It is not reversible to the original review text.
• Merchant account / entitlement data: email, Freemius user reference, subscription/usage state, hashed license key (SHA-256, never plaintext), site URL.
• Operational metadata: AI token counts and cost per generation (no review content), and truncated, PII-stripped error logs.

The merchant's own WordPress database also keeps a local copy of the finished summaries so product pages render fast without calling our backend. That local copy is under the merchant's control.

Alongside that copy, the plugin keeps a small sentiment history in the merchant's own WordPress database: a short, bounded log of each summary's sentiment label and confidence over time (up to about 12 snapshots per product, kept for roughly 180 days, oldest dropped first). This history records only those two derived values and a timestamp; it contains no review text and no reviewer personal data. It stays on the merchant's site, is never sent to or stored by Sumzy, and is the merchant's own first-party data. It is removed if the merchant opts in to delete Sumzy data on uninstall.

3. AI transparency

In short. Every summary is clearly labeled AI-generated, for sighted and screen-reader shoppers alike. The summary reflects the reviews proportionally; a complaint that genuinely recurs is always surfaced.

Every summary Sumzy displays is disclosed as AI-generated: the widget shows an "AI" pill and includes a screen-reader phrase so assistive technology announces "AI-generated summary." This is a product requirement, not just a legal one. Shoppers should always know the summary was produced by AI from the store's reviews.

The summary is a faithful, proportional reflection of the reviews. A complaint that genuinely recurs across reviews is surfaced; Sumzy provides no "positive-only" mode, tier, or toggle that would hide or down-weight a real recurring negative.

4. Account, site, and support data (Sumzy as controller)

When a merchant signs up, uses the dashboard, or contacts support, we process: name/email, license and subscription state, site URL, support correspondence, and standard server/edge logs (via Cloudflare) such as IP and request metadata for security and abuse prevention. We use this to provide the service, authenticate accounts, prevent abuse, and communicate about the product.

4a. Website analytics (consent-based)

On the sumzy.io marketing site we use Google Analytics 4 and PostHog (EU Cloud) to understand aggregate site usage and improve the site. We treat this as a separate, consent-based activity from the essential processing described above.

• What is collected: pseudonymous usage and event data (page paths, referrer, approximate device/browser type, a client identifier) together with a truncated, anonymized IP address (anonymize_ip is enabled for Google Analytics). We do not collect advertising identifiers, and we do not enable Google's advertising signals or cross-site tracking. No reviews and no merchant billing data are sent to analytics.
• Lawful basis: your consent. Both tools run under the same consent gate: before you accept, Google Analytics operates in a cookieless mode that sets no analytics cookies and sends only aggregate modeled measurement (Google Consent Mode), and PostHog is not initialized at all, so it sets no cookie and captures nothing. Analytics cookies (_ga, _ga_*) and PostHog's cookie are set only after you choose "Accept all" in the cookie banner.
• Roles: for analytics on sumzy.io, Sumzy is the controller and Google LLC and PostHog, Inc. are our processors. Google processes the data under the Standard Contractual Clauses (see §7); PostHog's processing runs on its EU Cloud instance.
• Withdrawing consent / opting out: choose "Essential only" in the banner, or clear the site's storage in your browser to be re-prompted. Analytics never runs on the account dashboard or operator pages. See the Cookie Policy for the specific cookies and durations.

4b. Product-usage analytics from the plugin and Shopify app (legitimate interest)

In short. Separately from the sumzy.io cookie banner above, PostHog also receives a small set of pseudonymous, merchant-scoped product-usage events describing how a store adopts and uses Sumzy (install, trial start, first summary generated, onboarding progress, widget going live). These events are keyed to Sumzy's own internal account identifier, never a shopper identifier, and never contain review text.

Sumzy needs to know, in aggregate, whether merchants are able to install the plugin, complete onboarding, and see their first summary go live, so we can find and fix friction in that path. To measure this, the Sumzy backend sends a small, fixed set of lifecycle events to PostHog (EU Cloud):

• Events the backend computes itself from Freemius or Shopify billing webhooks (merchant_installed, trial_started, trial_outcome, first_summary_generated).
• A short list of events relayed server-side from the WooCommerce plugin (onboarding_step_completed, widget_live), and the equivalent events from the Shopify app, each carrying only a small allowlisted set of non-sensitive properties (a step name, a numeric progress fraction).

Every event is keyed to Sumzy's internal account/shop identifier as the distinct id, chosen so a merchant can never be identified as a person from it. The events carry no shopper data, no review text, no email, and no site URL. This processing never touches a shopper's browser and is separate from the sumzy.io cookie banner described in §4a.

Lawful basis: Sumzy's legitimate interest (GDPR Art. 6(1)(f)) in understanding and improving product onboarding and reliability across both platforms, balanced against the merchant's interests by minimizing the data to a pseudonymous identifier and a closed set of non-PII properties, and by never including shopper or review data. A merchant who objects can contact hello@sumzy.io.

5. Sub-processors

In short. Anthropic (AI), Railway (hosting and primary database), Cloudflare (edge CDN/WAF and Cloudflare R2 for encrypted off-site database backups), Sentry (errors), Google and PostHog (consent-based analytics on sumzy.io; PostHog also receives pseudonymous, merchant-scoped product-usage events relayed server-side from the plugin and Shopify app, see §4b), Freemius (billing/MoR), and Mango Mail (transactional email). Database-derived data has a second at-rest location: a daily encrypted snapshot in Cloudflare R2 for disaster recovery (last 3 retained; raw review text excluded). The full disclosure is in the Sub-processors section, and we give advance notice before adding or replacing one.

Sumzy relies on the sub-processors listed in the Sub-processors section below:

• Anthropic (US): AI summarization. Processes the review text to generate the summary, then deletes it (request-duration on the interactive path, up to about 29 days for batch processing), and does not train on it.
• Railway (US): hosting and database (stores derived summaries and hash; no raw reviews).
• Cloudflare (US/global edge): CDN, security/WAF, and operator-console access control. Cloudflare R2 is used for encrypted off-site database backups (daily snapshot, last 3 retained, raw review text excluded).
• Sentry (US): error tracking, with PII scrubbing enabled.
• Google (US): Google Analytics for sumzy.io site usage measurement, set only after you consent (see §4a).
• PostHog (EU): product analytics. On sumzy.io, consent-based visitor analytics alongside Google Analytics, under the same consent gate (see §4a). Separately, receives pseudonymous, merchant-scoped product-usage and onboarding-funnel events relayed server-side from the plugin and the Shopify app, or computed by the backend from billing webhooks, under Sumzy's legitimate interest (see §4b). Never a shopper identifier, an email, or review text.
• Freemius (US): Merchant of Record for billing/tax (see §6).
• Mango Mail (US): transactional email delivery (admin auth codes; no review data). Transfers to Mango are limited to transactional email data; see §7 and the sub-processors table for the applicable transfer basis.

We commit to advance notice before adding or replacing a sub-processor.

6. Billing data and Merchant of Record

In short. On WooCommerce, Freemius is the Merchant of Record. Freemius collects and controls your billing data and handles VAT/sales tax. Sumzy never sees full payment-card data.

Sumzy subscriptions are sold by Freemius as Merchant of Record. Freemius collects and controls the buyer's billing data (name, billing address, tax IDs, payment details) to process the sale and handle global VAT/sales tax. Sumzy never sees full payment-card data. Freemius's own privacy terms govern that billing data; Sumzy receives only the account/license information needed to run entitlements.

7. International transfers

In short. Our sub-processors are in the United States. EEA/UK/Swiss transfers rely on the Standard Contractual Clauses. Because we keep only derived, PII-scrubbed summaries, the data actually transferred is minimal. The data exporter is Flamboyant Flamingos SRL (Romania).

Our sub-processors process data in the United States. For data subjects in the EEA, UK, or Switzerland, transfers rely on the Standard Contractual Clauses (plus the UK Addendum / Swiss adaptations) incorporated into each sub-processor's terms. Because Sumzy discards raw reviews and stores only derived, PII-scrubbed summaries, the personal-data actually transferred is minimal.

The data exporter (and controller of the data described in §4) is Flamboyant Flamingos SRL, a company incorporated in Romania, registration number CUI 38631092 (Romanian cod unic de înregistrare), whose registered address is on file with the Romanian Trade Register (Registrul Comerțului) under CUI 38631092 and is available on request. Our competent supervisory authority is the Romanian ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal); you have the right to lodge a complaint with it, or with the supervisory authority of your own EEA country of residence. The completed SCC annex identifying the exporter and importers is set out in the Data Processing Agreement section §7 and is available on request.

8. Retention periods

In short. No raw reviews are kept. Derived summaries and the hash are kept while you subscribe, and up to 12 months after cancellation so you can reactivate; you can ask us to delete sooner at any time.

• Raw review text: not retained by Sumzy. Our AI sub-processor (Anthropic) holds the input only to process it, then deletes it (for the duration of the request on the interactive path, or up to about 29 days when batch processing is used); in neither case is it used to train models.
• Derived summaries + review-set hash: kept while the merchant's subscription is active and the product is summarized. If the subscription is cancelled, we retain this backend-derived summary and aggregate data for up to 12 months after cancellation, so that a merchant who comes back can reactivate quickly without regenerating everything; after that period it is permanently deleted. A merchant may ask us to delete it sooner at any time (the right to erasure, see §9), and we will. We never retain raw review text in either case; only the derived summaries and the one-way hash. The local copy of the summaries stored in the merchant's own WordPress site is governed by the plugin's uninstall behavior (preserved unless the merchant opts in to delete it on uninstall), not by this 12-month clock.
• Account/entitlement data: kept for the life of the account plus any period required by law.
• Billing/tax records: retained by Freemius per its legal obligations as MoR.
• Error logs: retained only as long as needed to diagnose and fix failures, on Sentry's short default retention window, and PII-scrubbed before they are stored.

9. Data-subject rights (GDPR and similar)

In short. You have the usual GDPR rights (access, rectification, erasure, and so on). For a request about a specific review, the merchant is the controller and should handle it; Sumzy assists. There is no raw review text to erase, and deleting a review auto-refreshes the summary.

Data subjects (a store's customers, or merchants) have rights of access, rectification, erasure, restriction, portability, and objection. Because Sumzy is usually a processor of review data, a customer's request about their review should generally go to the merchant (the controller); Sumzy will assist the merchant in responding.

How an erasure request is handled: the specific Sumzy position

• There is no raw review text to erase. Sumzy does not store raw reviews, so there is no at-rest copy of a reviewer's original words to delete.
• The retained review_set_hash is a one-way SHA-256 hash of the whole review set. It is a fingerprint of all the sampled reviews for a product taken together, not of any one review or reviewer, and it is not reversible to any individual's review or identity. Sumzy's position is that this hash does not, by itself, constitute personal data, because it cannot be used to single out, contact, or re-identify a data subject: it changes wholesale whenever the review set changes, and it carries no per-person value an attacker could test against. We recognize that a stricter reading can treat a hash derived from personal data as "pseudonymized" data; our posture is safe under either reading, because (a) we hold no raw reviews to begin with, and (b) we will delete the hash on request along with the cached summary (see the last bullet of this section). So whether or not a regulator classifies the hash as personal data, the practical outcome for a data subject is the same.
• The derived summary is aggregate and PII-scrubbed. It describes recurring themes across many reviews and is scrubbed of names, emails, phone numbers, and order numbers, so it generally does not contain an identifiable individual's personal data.
• Deleting the source review auto-refreshes the summary. When a merchant deletes or hides a customer's review in WooCommerce, the review set changes; its hash changes; Sumzy regenerates the summary from the remaining reviews on the next scheduled refresh. The erased review therefore stops contributing to the summary without any separate deletion step inside Sumzy.
• If a merchant nonetheless needs the cached summary and hash for a product purged, Sumzy will delete them on request.

10. Children's data, automated decisions

Sumzy is a B2B product for store operators and does not knowingly process children's data. Sumzy's AI summary is an informational display; it does not make automated decisions that produce legal or similarly significant effects on individuals under GDPR Art. 22.

11. Contact

Privacy questions / data-subject requests: hello@sumzy.io. For requests about review content on a specific store, contact that store (the controller); we will support them.