Privacy policy
What SumFair collects, why, for how long, and your rights. Last updated 2026-09-06.
1. Who we are
SumFair is operated by {{COMPANY_LEGAL_NAME}}, {{COMPANY_ADDRESS}}, Romania ("we"). We are the data controller for personal data processed through sumfair.com. Contact: privacy@sumfair.com.
2. What we collect
Guests (people joining a bill from a link)
- The display name you type when joining.
- The items you claim and the resulting amounts.
- A random session identifier stored in your browser so you stay connected to the bill.
Hosts without an account
- The bill data you create: receipt images, extracted lines, participants, amounts, tips and settlements.
- A random host token stored in your browser.
Hosts with an account
- Your email address and, if you sign in with a third-party provider, the identifier that provider gives us.
- Your bills, groups, trips, preferences and settlement history.
Technical data
- Server logs with request identifiers, pseudonymised session identifiers, timestamps, user-agent and an IP address kept for security and abuse prevention.
- Aggregate, anonymous usage statistics (for example how many bills were settled).
3. Why we process it
| Purpose | Legal basis (GDPR) |
|---|---|
| Running the service: reading receipts, sharing bills, calculating shares | Performance of a contract, Art. 6(1)(b) |
| Account features: history, sync, saved groups | Performance of a contract, Art. 6(1)(b) |
| Security, abuse prevention, rate limiting | Legitimate interest, Art. 6(1)(f) |
| Improving receipt recognition using aggregated, de-identified data | Legitimate interest, Art. 6(1)(f) |
| Answering support requests | Legitimate interest, Art. 6(1)(f) |
4. Receipt images
Receipt images are uploaded through signed URLs, processed to extract the lines, and stored only as long as needed for the bill to be finished and briefly reviewed afterwards. Guest bills and their images are deleted automatically after the retention period in section 6. Receipt images are not used for advertising and are not shared with third parties except the processing providers listed in section 5.
5. Who we share data with
We use a small number of processors under data-processing agreements: hosting and object storage in the European Union, an optical character recognition provider for reading receipts, an email provider for account messages, and an exchange-rate provider (which receives no personal data). We do not sell personal data and we do not share it with advertisers.
6. Retention
- Guest sessions and bills created without an account: {{GUEST_RETENTION_DAYS}} days after the last activity, then deleted.
- Receipt images: deleted together with the bill, or earlier once extraction has been confirmed.
- Account data: for as long as the account exists. Deleting the account deletes bills that belong only to you; bills shared in a group remain visible to the other members without your personal details.
- Server logs: up to 30 days.
7. Your rights
Under GDPR you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to privacy@sumfair.com. You can also lodge a complaint with the Romanian supervisory authority (ANSPDCP) or the authority in your country.
8. Cookies and local storage
SumFair uses strictly necessary storage only: a session identifier for guests, a host token, and sign-in state for accounts. There are no advertising or cross-site tracking cookies. The marketing site (sumfair.com) sets no cookies.
9. Children
SumFair is not directed at children under 16 and we do not knowingly collect their data.
10. Changes
We will post changes on this page and update the date at the top. Material changes affecting account holders are announced by email.