Updated 21 October 2026. This notice covers the Sumili app for iOS and Android.
1. Controller and contact
The controller is OpenTrentuno di Corsini Niccolò, VAT IT02078540479. For privacy, rights requests and support: support@sumili.it.
2. Data and purposes
- Account: user identifier, email (including Apple relay), optional name, language, sign-in method and technical authentication data. Used to create, protect and manage your account. - Expenses: sheet titles, amounts, dates, descriptions, author, payer, participants, payment methods and due dates entered by users. Used to record, synchronise and display shared expenses. - Notifications: device token, platform and registration date if you enable reminders. Lock-screen text contains no sheet names or expense descriptions. - Support and security: email requests, user blocks, temporary invitation counters, deletion-request status and technical network/service data, such as IP addresses, SDK diagnostics and infrastructure logs.
We do not request access to contacts, location, microphone, bank accounts or cards. The camera only reads another user's QR code to share a sheet; scan images are not uploaded or stored by the service. Avoid entering health information, passwords or other sensitive data in descriptions.
3. Legal bases
Processing needed to provide and manage the requested service is based on performance of the relationship with the user (GDPR Article 6(1)(b)). Protecting the service, preventing abuse and proportionate retention of already shared financial records rely on legitimate interests (Article 6(1)(f)), taking data subjects' rights into account. Legal obligations, where applicable, rely on Article 6(1)(c). Camera and notifications are optional: you can deny or revoke permissions in device settings. System permission is not general consent to all processing.
4. Sharing and providers
A sheet is visible to its owner and authorised participants. They see its expenses and related identifiers/names, but not other people's private emails or notification tokens. An invitation lookup using an exact email or QR returns only the recipient's identifier and optional name. People who have already viewed or exported shared data may have retained copies.
We use Google Firebase for authentication, Firestore, server functions and notifications; Google Sign-In and, on iOS, Sign in with Apple provide optional sign-in. Apple APNs also delivers iOS notifications. Support requests reach support@sumili.it, the controller's mailbox hosted by Aruba S.p.A. Providers process data according to their contractual roles and privacy notices. We do not sell data or integrate advertising, commercial profiling or advertising analytics. On Android, QR reading uses Google ML Kit Barcode Scanning. Images are processed on the device and are not uploaded by Sumili’s scan flow; the SDK may collect installation identifiers, device and app information, performance metrics, events and error codes for diagnostics and technical usage analysis, as described by its provider. On iOS the scanner uses AVFoundation.
5. Processing locations
Firestore is configured in the European eur3 location and application functions in europe-west1. Authentication, push, support and infrastructure management may involve processing outside the European Economic Area. Applicable GDPR mechanisms, such as adequacy decisions and standard contractual clauses, are used where relevant; contact the controller for information on safeguards.
6. Retention and deletion
Account data and sheets remain available while using the service until the relevant deletion. You can delete your rows, delete sheets you own or leave shared sheets. Leaving a sheet does not delete previously shared expenses.
Account deletion removes the profile, authentication credentials, device registrations and private metadata. Personal sheets with no other participants are deleted. Shared sheets may pass to a still-active participant: references to you become 'deleted user', your descriptions are removed, and titles of your transferred sheets become generic. Amounts, dates and other shared financial data remain available to the others for continuity of their records. Context may still identify who incurred an expense, so absolute anonymity is not guaranteed. You can object to this retention by contacting the controller.
Processing is asynchronous and resumes automatically after interruptions. Completed-deletion technical status is retained for 14 days; invitation counters expire within approximately 24 hours with periodic removal. Google Cloud ordinary logs are retained for 30 days and required audit logs for 400 days. Firestore point-in-time recovery is disabled; its technical version window is one hour. Providers' internal technical data also follow their own policies. Support emails are retained for 12 months after the request is closed, unless legal obligations or the establishment, exercise or defence of legal claims require longer retention. Copies already downloaded by participants remain under their control. Firebase documents that authentication information may take up to 180 days after deletion is initiated to be removed from the provider’s live and backup systems. Removing an account from the service does not mean immediate removal of every provider-held technical copy.
7. Rights
You may request access, rectification, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. You can export your data and request deletion without reinstalling the app. Write to the contact above; we respond within GDPR time limits, normally one month, verifying your identity where necessary. You may complain to the Italian data protection authority or the competent authority in your country.
8. Minors and changes
The service is intended for adults. It involves no automated decisions with legal effects or profiling. Substantial changes to this notice will be communicated through the service or available contacts before taking effect where required.
9. Device storage
The app stores preferences and technical data required for its operation on the device and uses authentication, synchronisation and notification SDKs. The cookie and technical-storage policy describes purposes, retention and available controls. Camera and notification permissions are managed in device settings.
Request deletion of your Sumili account