Privacy Policy

Last updated: 24 October 2026

Your documents never leave your device. Everything Sumi does to a document happens inside your browser; we have no server that could receive one.

Who is responsible

Abdessamad Souilem, a private individual, based in Lithuania. Contact: contact@sumipdf.com.

Your documents

Files you open in Sumi are read, analysed (including text recognition and the optional AI) and redacted on your device. They are not uploaded, stored or seen by us or anyone else. You can check this yourself: see how to verify.

What is stored on your device

• The app's own files, cached by your browser so Sumi works offline.
• Language and AI model files, if you use scans or turn on AI detection.
• A few preferences in local storage: sumi.license and sumi.order (your license key and order number, if you bought a plan), sumi.ai.consent and sumi.handwriting (whether you turned these on).

Sumi uses no cookies, no analytics and no tracking.

Requests your browser makes

• Loading the website from our host, Vercel Inc. (United States), which keeps standard server logs (IP address, time, page requested) for security, for the limited period set out in Vercel's own privacy policy.
• AI model download, only if you turn AI detection on: the model files come from Hugging Face (huggingface.co). The request names the model, never your document. Hugging Face receives your IP address under its own privacy policy.
• Buying a plan: payment happens on our pricing page through Paddle.com, our Merchant of Record, which processes your name, email, billing address and payment details as an independent controller under its own privacy policy. The app itself never loads payment code.
• Getting your license key: our server receives the transaction ID of your purchase, asks Paddle whether it is paid, and returns a signed key. We do not store the ID or the key. When your key is about to expire, the app sends the same order number again to fetch the renewed key.
• Signing in with your email, if you ask for a sign-in link: our server receives your email address, asks Paddle whether it has an active Sumi plan, and if so sends you a link through Resend (Resend, Inc., United States), our email provider, which keeps delivery logs under its own privacy policy. We do not store your email address. The answer on screen is the same whether or not the email paid. To stop abuse, we count requests per email and per IP address, stored only as one-way hashes and deleted after at most one hour.

Legal bases

Server logs: our legitimate interest in keeping the service secure. License issuance, sign-in emails and payment: performance of the contract you entered into.

Your rights

You can ask us for access, correction, deletion, restriction, portability or objection regarding personal data we hold about you, by writing to contact@sumipdf.com. You can also complain to your data protection authority (in Lithuania, the State Data Protection Inspectorate, vdai.lrv.lt; in France, the CNIL). For payment data, contact Paddle directly.