1. Who operates SumTrail
SumTrail is the brand and service covered by this draft. The legal operator and privacy contact must be identified before publication.
- Service and brand
- SumTrail
- Legal operator
- [LEGAL NAME REQUIRED]
- Operator capacity
- [CONFIRM INDIVIDUAL OR SOLE TRADER]
- Country and jurisdiction
- [COUNTRY OF RESIDENCE AND GOVERNING JURISDICTION REQUIRED]
- Contact address
- [PUBLIC BUSINESS OR SERVICE ADDRESS REQUIRED]
- Support
- [SUPPORT EMAIL REQUIRED]
Privacy contact: [PRIVACY CONTACT EMAIL REQUIRED]
2. Information the service handles
- Account information: name, email address, authentication identifiers, and account preferences.
- Financial workspace information: budgets, income, transactions, accounts, goals, funds, and net-worth records that a user chooses to enter.
- Subscription information: plan, entitlement, provider customer and subscription identifiers, billing status, and billing-period dates when paid billing is introduced.
- Technical and security information: session, device, browser, request, and diagnostic data needed to operate and protect the service.
- Support communications: messages and information a user sends when requesting help.
SumTrail should not store full payment-card numbers. When billing is enabled, payment details should be collected and processed by the approved payment provider.
3. Why information is used
Information may be used to create and secure accounts, provide the financial workspace, preserve user-specific access, process subscriptions, deliver authentication messages, respond to support requests, prevent abuse, troubleshoot faults, and meet legal obligations.
Before publication, identify the lawful bases and notices required in the operator's jurisdiction and each market served.
4. Service providers and disclosures
The final policy must name or clearly categorize the providers used for hosting, authentication, database storage, transactional email, analytics, customer support, and billing. Current operational providers and their data-processing terms must be verified before this list is finalized.
Personal information should be disclosed only as needed to run the service, follow the user's instructions, complete a transaction, protect the service and its users, or comply with a lawful request.
5. Storage, transfers, and retention
The final policy must state where relevant data is hosted, the safeguards used for international transfers, and concrete retention periods or deletion criteria for account, finance, billing, security-log, and support data.
Required decision: retention schedule, deletion workflow, backup retention, and cross-border transfer mechanism.
6. Security and account control
SumTrail uses authenticated, user-specific access controls and is designed to keep one user's private financial records separate from another's. No online service can promise absolute security, so users should choose a strong password, protect their devices, and report suspected account misuse promptly.
7. Cookies and local storage
The service uses browser storage or cookies needed for authentication, session continuity, and core application operation. Any non-essential analytics or advertising technology must be documented and, where required, offered only after valid consent.
Required audit: list every production cookie/storage key, purpose, provider, duration, and consent category.
8. User choices and privacy rights
Depending on applicable law, users may have rights to access, correct, export, restrict, object to, or delete personal information, and to withdraw consent where consent is used. The final policy must explain how requests are authenticated, submitted, and appealed.
9. Children
Minimum permitted user age: [MINIMUM USER AGE REQUIRED]. Confirm the intended audience and any parental-consent requirements before publication.
10. Changes and contact
Material changes should be announced through an appropriate in-product or email notice. Questions and privacy requests should be sent to [PRIVACY CONTACT EMAIL REQUIRED].