Sumna Privacy Policy

1. Introduction

This Privacy Policy explains how Linguae Academy LLC, a Virginia limited liability company doing business as "Sumna" ("Sumna," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit sumna.app, use the Sumna web application or recorder application, or otherwise interact with our services (together, the "Service").

Sumna is a tool for language tutors ("Tutors") that turns lesson transcripts or audio into class summaries and related teaching materials, and gives their students ("Students") a portal to receive those materials. Because the Service handles information about both Tutors and Students — and Students' information is entered by their Tutor — please read Section 2, which explains our two different roles.

This policy is written to satisfy the EU and UK General Data Protection Regulation ("GDPR"), the Virginia Consumer Data Protection Act ("VCDPA"), the California Consumer Privacy Act as amended ("CCPA/CPRA"), other U.S. state privacy laws, and the U.S. Children's Online Privacy Protection Act ("COPPA").

If you have questions or want to exercise any right described here, contact us at privacy@sumna.app.

2. Our Two Roles: Controller and Processor

For Tutor information, we are the controller. When a Tutor creates an account, completes onboarding, subscribes to a paid plan, or contacts us, we decide how and why that information is processed.

For Student information, the Tutor is the controller and we are the Tutor's processor (or "service provider" under U.S. state laws). Tutors decide what Student information to enter, what materials to create, and what to publish to a Student. We process that information only on the Tutor's instructions and to provide the Service, and Tutors are responsible for having a lawful basis (including any required parental consent for minors) for the Student information they submit. Students who have questions about how their information is used, or who want it corrected or deleted, should contact their Tutor first; we support Tutors in honoring such requests and will also assist Students directly where the law requires. A data processing addendum with GDPR Article 28 terms is available to Tutors on request.

We are also the controller for the limited processing we do for our own purposes across all data, such as securing the Service, billing, and legal compliance.

3. Information We Collect

3.1 Information Tutors provide

• Account and contact details: email address, password (held by our authentication provider in hashed form), academy or business name, director/display name, and contact email for student-facing documents.
• Onboarding profile: city and timezone, default teaching level, languages taught, specialties, approximate number of students, how you find students, teaching platforms you use, and how you heard about Sumna.
• Branding preferences: brand colors and logo display settings.
• Billing details: subscription plan, billing status and period dates, and identifiers issued by our payment processor (Stripe). Payment card details are collected and stored by Stripe, not by us.

3.2 Information about Students

Entered by the Tutor, by the Student during portal onboarding, or both:

• Profile: name, email address, phone number (optional), proficiency level, native language, city/location, timezone, teaching platform and mode, scheduling preferences, interests, learning goals, and free-text notes written by the Tutor.
• Portal account: for invited Students, a portal login (email and password, held by our authentication provider), invitation and join dates, and onboarding responses (interests, learning goals, native language, city and timezone).
• Learning records: class summaries and the lesson transcripts behind them, homework and grades, homework submissions the Student uploads, exams and exam attempts (answers, scores, feedback), lesson plans, goals, focus areas and progress history, notes the Student writes on summaries, and an AI-generated summary of the Student's goals.
• Change history: an audit log of edits to a Student's profile (field changed, old and new values, when).

3.3 Lesson content

• Transcripts: lesson transcripts you paste or upload are stored in your account and are used to generate summaries and other materials.
• Audio: if you upload lesson audio (or use the Sumna recorder app, which saves recordings only to a folder on your own computer), the audio is sent to our transcription provider to produce a transcript. We do not store lesson audio on our servers — only the resulting transcript is kept. We log the duration of transcribed audio to enforce plan limits.
• Uploads: files you upload (such as summary PDFs) and homework submissions (PDF, image, Word, or text files up to 25 MB) are stored in private storage accessible only to the authorized Tutor and Student.

3.4 Information collected automatically

We collect limited technical information needed to operate the Service securely: authentication session cookies, IP addresses and timestamps in server and security logs, and basic request metadata. We do not use analytics trackers, advertising pixels, or third-party marketing cookies anywhere on the Service (see Section 8).

3.5 Information from other sources

We receive subscription and payment status from Stripe. We do not buy personal information from data brokers or enrich profiles from third-party sources.

4. How We Use Information

We use personal information to:

• provide the Service: generate summaries, homework, exams, and lesson plans from your content; deliver materials to Students by email and through the portal; track goals and progress;
• create and manage accounts, authenticate users, and secure the Service (including fraud and abuse prevention);
• process subscriptions, payments, and plan limits;
• send transactional email: summary and homework deliveries, portal invitations and sign-in links, notifications to Tutors when a Student joins the portal or sends a note, account and billing emails, and administrative notices;
• provide support and respond to your requests;
• comply with legal obligations and enforce our Terms and Conditions;
• improve the Service — using aggregated or de-identified information wherever possible.

We do not sell personal information, we do not share it for cross-context behavioral or targeted advertising, and we do not use your content to advertise to anyone.

5. Artificial Intelligence Processing

The Service uses third-party AI providers to deliver its core features:

• Transcription: lesson audio is sent to AssemblyAI (or, as a fallback, OpenAI) to produce a speaker-labelled transcript. The audio is processed for transcription and is not retained on our servers.
• Generation: lesson transcripts and relevant Student context (such as level, goals, and prior summaries) are sent to Anthropic's Claude models to draft summaries, homework, exams, lesson plans, progress analyses, and goal summaries. AI assistance is also used to help score certain exam answers, which the Tutor can review and override.

We do not use your content to train AI models, and our AI providers are engaged on API terms under which they do not use your data to train their models. AI output is a draft for the Tutor: nothing generated by AI is shown to a Student until the Tutor reviews and publishes it, and exam scores suggested by AI can be overridden by the Tutor before release. We do not make automated decisions about you that produce legal or similarly significant effects without human involvement.

6. Legal Bases for Processing (GDPR)

Where the GDPR or UK GDPR applies and we act as controller, we rely on:

• Contract (Art. 6(1)(b)): to provide the Service you signed up for, manage your account, and process payments.
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent abuse, improve features, and communicate about service matters — balanced against your rights and interests.
• Legal obligation (Art. 6(1)(c)): for tax, accounting, and responding to lawful requests.
• Consent (Art. 6(1)(a)): where we ask for it explicitly; you may withdraw consent at any time.

Where we process Student information as the Tutor's processor, the Tutor is responsible for the legal basis — typically consent (including parental consent for minors) or the Tutor's contract with the Student or their family.

7. How We Share Information; Subprocessors

We share personal information only with service providers ("subprocessors") that help us run the Service, under contracts that limit their use of the data to providing services to us:

We may also disclose information: to comply with law or valid legal process; to protect the rights, safety, or property of Sumna, our users, or others; in connection with a merger, acquisition, or sale of assets (in which case this policy will continue to apply to previously collected data, and we will notify you of any successor); or with your direction or consent (for example, emailing a summary to a Student at your request).

We do not sell personal information and have not done so. We do not share personal information with third parties for their own marketing.

8. Cookies and Tracking

The Service uses only strictly necessary cookies: session cookies set by our authentication provider to keep you signed in. We do not use analytics cookies, advertising cookies, social-media pixels, or session-replay tools. Because we use no non-essential cookies, we do not show a cookie consent banner. If this ever changes, we will update this policy and request any legally required consent first.

Because we do not track users across sites, we do not respond differently to "Do Not Track" signals; there is no tracking to disable. Where a state law requires recognition of opt-out preference signals (such as Global Privacy Control) for sale or targeted advertising, note that we do not sell personal information or process it for targeted advertising in the first place.

9. International Data Transfers

We are based in the United States, and the Service is hosted and processed there. If you use the Service from the EEA, UK, Switzerland, or elsewhere, your personal information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Where the GDPR or UK GDPR applies to a transfer, we rely on appropriate safeguards: our subprocessors either certify under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or enter into the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA), supplemented as needed. You can request more information about transfer safeguards at privacy@sumna.app.

10. Data Retention

We keep personal information only as long as needed for the purposes described in this policy:

• Account and profile data: for as long as your account exists, and deleted within a reasonable period after account deletion.
• Transcripts, summaries, homework, exams, and other learning records: for as long as the Tutor keeps them in their account. Tutors can delete individual items or an entire Student record at any time; deleting a Student permanently removes their profile, summaries, homework, submissions, exams, goals, uploads, and portal account.
• Lesson audio: not stored on our servers (processed transiently for transcription). Recordings made with the recorder app remain on your own device under your control.
• Billing records: retained as required for tax and accounting purposes (typically 7 years).
• Security and server logs: retained for a short operational period, then deleted or anonymized.
• Backups: deleted data may persist in encrypted backups for a limited period before being overwritten in the normal backup cycle.

11. Security

We take security seriously. Measures include: encryption in transit (TLS) and at rest at our infrastructure providers; row-level security in our database so each Tutor's data is isolated and Students can see only what their Tutor has published; private storage buckets with per-user access controls for uploads; hashed passwords managed by our authentication provider; single-use, expiring invitation and sign-in links; and restricted, audited use of administrative access. No service can guarantee absolute security, but we work to protect your information against unauthorized access, alteration, disclosure, and destruction. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law, including Virginia's breach notification statute and the GDPR's 72-hour authority notification rule.

12. Your Rights — EEA, UK, and Switzerland (GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten") in certain circumstances;
• Restrict processing in certain circumstances;
• Data portability — receive data you provided in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests, and to any direct marketing;
• Withdraw consent at any time, without affecting prior processing;
• Not be subject to solely automated decisions with legal or similarly significant effects;
• Complain to a supervisory authority in your country of residence or work, or where an alleged infringement occurred.

To exercise these rights, email privacy@sumna.app; we respond within one month (extendable by two further months for complex requests, with notice). If you are a Student, your Tutor controls your learning records — we will refer your request to them where appropriate and help fulfil it.

13. Your Rights — Virginia (VCDPA)

If you are a Virginia resident, the VCDPA gives you the right to:

• confirm whether we process your personal data and access it;
• correct inaccuracies;
• delete personal data provided by or obtained about you;
• obtain a copy of personal data you provided, in a portable and readily usable format;
• opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects — noting that we do not engage in any of these practices.

Submit requests to privacy@sumna.app with the subject line "Privacy Request." We will authenticate your request using information associated with your account and respond within 45 days, extendable once by 45 days where reasonably necessary (we will tell you if so). We will not discriminate against you for exercising your rights.

Appeals: if we decline to act on your request, you may appeal within 60 days of our decision by replying to our response or emailing privacy@sumna.app with the subject line "Privacy Appeal." We will respond in writing within 60 days, explaining our decision. If your appeal is denied, you may contact the Virginia Attorney General at www.oag.state.va.us to submit a complaint.

We process sensitive data (such as data about children, or any health-related notes a Tutor chooses to record) only with the consent required by law — for known minors' data, we rely on the Tutor obtaining verifiable parental consent as described in Section 15.

14. Your Rights — California and Other U.S. States

If you are a resident of California or another state with a comprehensive privacy law (including Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you may have similar rights of access, correction, deletion, and portability, and rights to opt out of sales, sharing for targeted advertising, and certain profiling. We do not sell or share personal information for targeted advertising and do not use it for such profiling.

California residents: the categories of personal information we collect are described in Section 3 (identifiers; customer records; commercial information; internet activity limited to service logs; audio through transcripts; professional information; education-related records; and inferences limited to AI-generated learning summaries). We collect them from you, your Tutor, or your Student, and disclose them only to the service providers in Section 7 for business purposes. We do not use or disclose sensitive personal information for purposes requiring a "limit use" right. You may exercise rights, including through an authorized agent, via privacy@sumna.app; we will verify requests using account information and respond within the statutory period. We do not discriminate for exercising rights. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing.

Exercising rights under any state law is free, though we may decline or charge for manifestly unfounded or repetitive requests where the law allows.

15. Children's Privacy

The Student Portal is intended for students aged 13 and older, and Tutor accounts require users to be 18 or older. We do not knowingly collect personal information directly from children under 13, and portal accounts may not be created for them. If we learn that a child under 13 has a portal account, we will delete the account and associated data.

Tutors may enter information about minor students (including students under 13, without portal access) in order to prepare lessons and share materials with families. In that case the Tutor acts as controller and must first obtain verifiable consent from the student's parent or guardian — both under COPPA-aligned practice and, in the EEA/UK, under the applicable age-of-consent rules (13–16 depending on country). Children's data is treated as sensitive data under the VCDPA and several other state laws, which is why parental consent is required before it is entered.

Parents and guardians may review, correct, or request deletion of their child's information at any time — through the child's Tutor, or by contacting us at privacy@sumna.app; we will act on such requests together with the Tutor, and we will honor deletion requests regardless of the Tutor's response where the law requires.

If a Tutor works with a school or institution subject to FERPA (the U.S. Family Educational Rights and Privacy Act) or similar education-records laws, the Tutor is responsible for ensuring their use of Sumna complies with those laws and any agreement with the institution.

16. Exercising Your Rights: Deletion and Export

• Tutors can edit their profile in Settings, delete individual summaries, homework, exams, uploads, and Students (including all the Student's data) directly in the app, and can permanently delete their entire account and all associated data from account settings. A complete export of your data is available on request at privacy@sumna.app.
• Students can edit certain profile details in the portal and can ask their Tutor to correct or delete their records; they may also contact us directly at privacy@sumna.app.
• Parents/guardians of minor students may contact the Tutor or us as described in Section 15.

We will verify requests using the email address associated with the account (or equivalent reasonable means) before acting on them.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version at sumna.app/privacy with a new effective date, and for material changes we will notify account holders by email or in-app notice before the changes take effect. If a change requires your consent under applicable law, we will request it.

18. Contact Us

Linguae Academy LLC (d/b/a Sumna)

Virginia, USA

Email: privacy@sumna.app

If you are in the EEA or UK and believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority. Virginia residents may contact the Office of the Attorney General of Virginia.