Privacy Policy

1. Information We Collect

We collect information you provide directly, information generated through your use of our services, and information from third-party integrations.

Account Information

When you create an account, we collect your name, email address, organization name, and role. If you are invited by an administrator, we receive your email address from the inviting user.

Financial Data

When you connect bank accounts or corporate cards via Plaid, we receive transaction data including merchant names, amounts, dates, and account identifiers. We do not store your bank login credentials — these are handled entirely by Plaid's encrypted infrastructure.

Receipt Data

When you upload receipts or forward them via email, we process the images using OCR to extract merchant names, amounts, dates, and line items. Receipt images are stored securely in encrypted cloud storage.

2. How We Use Your Information

• Provide, maintain, and improve our expense management services
• Process and categorize transactions, match receipts, and generate reports
• Use AI services to improve categorization accuracy (see Section 3a below for details)
• Sync data with your connected ERP system (e.g., Sage Intacct)
• Send transactional emails (invitations, approvals, reports)
• Detect and prevent fraud, anomalies, and duplicate transactions

3. Data Sharing

We do not sell your personal or financial data. We share data only with:

• Plaid — to facilitate secure bank connections and transaction sync
• Sage Intacct — when you authorize the integration, to sync dimensions and export transactions
• Stripe — for subscription billing and payment processing
• PostHog (US region) — product analytics: pseudonymous user and organization ids, your organization's name, page routes, and device and browser metadata. No financial transaction data is sent, and session recording is off. On this website, cookieless page analytics (see Section 6)
• Sentry — error monitoring: error reports with technical context, such as the page or request that failed. We do not intend to send financial data in error reports
• Infrastructure providers — Supabase (database), AWS (hosting and file storage), Stytch (sign-in), and Resend and Twilio (email and text messages), all under strict data processing agreements

3a. Third-Party AI Services

Summit Spend uses third-party AI services to provide optional automated features. These services act solely as data processors — we retain full control over your data and determine the purposes and means of processing. AI features are optional and require your explicit consent before activation.

What is never shared with AI services: Your name, email address, personal identity information, bank account numbers, bank credentials, full credit card numbers, or your organization's employee data.

4. Data Retention

We retain your data for as long as your account is active. Transaction and receipt data is retained for 7 years to comply with financial record-keeping requirements. When you delete your account, we remove personal information within 30 days and anonymize remaining records for compliance retention.

5. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and export your personal data
• Request correction of inaccurate data
• Request deletion of your data — see how to delete your account
• Opt out of AI-powered processing via the AI Features toggle in the app's Settings, or by contacting us

To exercise these rights, contact us at privacy@summitspend.com.

6. Cookies and Analytics

We use essential cookies for authentication, session management, and theme preferences.

Inside the app we use PostHog (US region) for product analytics, to understand which features are used. It records page routes (with identifiers masked), pseudonymous user and organization ids, your organization's name, and device and browser metadata. It does not record financial transaction data or sessions (no session recording or click capture), and it stores its identifier in your browser's local storage rather than in cookies. We use Sentry to detect and fix errors in our software; error reports carry technical context and are not intended to include financial data. We do not use third-party advertising cookies or trackers.

On this website (summitspend.com) we use PostHog for cookieless, aggregate page analytics, to understand which pages are visited. It records the page address (including any query string, such as campaign parameters), the referring site, device and browser metadata, and clicks on our request-access links. It sets no cookies and stores nothing in your browser, so a visit is not linked to earlier visits or to an app account. It does not capture text you type, and session recording is off. As with any web request, PostHog receives your IP address. If your browser sends a Do Not Track signal, the analytics script is not loaded.

7. Text Messaging (SMS)

If you opt in to text message reminders, we use your mobile phone number to send transactional messages about your own expense items — for example, a text after a card charge asking for its receipt, or a reminder that a receipt or memo is missing. We do not sell or share mobile information, SMS opt-in data, or messaging consent with third parties or affiliates for marketing or promotional purposes. We provide information to service providers only as needed to operate and deliver the messaging service on our behalf. Message frequency varies with your card activity (up to 3 receipt requests a day). Message and data rates may apply. Reply STOP at any time to opt out, or manage this from Settings → Notifications in the app. Reply HELP for help. See our Terms & Conditions for SMS program details.

8. Contact

For questions about this policy, contact us at privacy@summitspend.com.