Last updated: October 6, 2026

Privacy Policy

Sumerzé is operated by Creamery Technologies LLC, a Colorado limited liability company ("Sumerzé," "we," "us," or "our"), which is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use the Sumerzé mobile application and website ("App").

1. Information We Collect

Account information. When you register, we collect your name, email address, and the role you select (customer, provider, or both).

Profile information. Providers may optionally provide a business name, bio, city and state, phone number, service listings, portfolio photos, and before/after transformation images.

Payment information. All payment data (card numbers, bank account details) is collected and stored directly by Stripe. Sumerzé does not store full payment card information on our servers. We store Stripe payment intent IDs and payout account identifiers to manage bookings and payouts.

Booking and messaging data. We store booking requests, booking status, scheduled dates, service names, amounts paid, and messages exchanged between Customers and Providers through the App. Message monitoring: Sumerzé monitors in-app conversations to detect fraud, harassment, and policy violations. By using the messaging feature, you acknowledge that messages may be reviewed by our team or automated systems. Messages are not end-to-end encrypted and should not be treated as private communications outside the scope of coordinating services.

Location data. We use the city and state in your profile to match you with nearby services. If you allow it, the App uses your device's location while you are using it to show providers near you; we never track your location in the background. Providers give their address and ZIP code: the address and phone number are shown only to a Customer with a confirmed booking, the ZIP code is used to calculate sales tax, and maps and search show only an approximate location (about 1 km), never the exact address.

Contacts (Invite your clients). If a Provider uses Invite your clients, the App opens the iOS contact picker. The App has no access to the contact list: it only receives the name and number of the people the Provider picks, and uses them only on the device to prepare a text message the Provider sends from their own phone. Sumerzé does not upload, store or share those contacts, and does not message them.

Device and usage data. We collect push notification device tokens to send you booking and message alerts. We may collect basic usage analytics (feature interactions, error logs) to improve the App. We record when a Provider's profile or photos are viewed; the Provider only sees view totals, never who viewed them.

What Providers see about Customers. When you request a booking or send a message, the Provider sees your name, profile photo, and your Sumerzé trust history (customer rating, completed bookings, and no-shows). Providers may keep private notes about their clients that only they can see. Your email and phone number are never shown to other users.

User-submitted feedback. If you submit feedback through the App, we store the message and its category (suggestion, bug report, or other).

2. How We Use Your Information

• To create and manage your account
• To facilitate bookings between Customers and Providers
• To process deposits, final payments, and tips through Stripe
• To issue automatic refunds when a Provider cancels a paid booking
• To send push notifications for new bookings, booking status changes, and messages, including reminders of upcoming appointments to Customers and Providers
• To display Provider profiles and reviews to Customers searching for services
• To generate referral tracking and promo code attribution
• To calculate and apply frequent client rewards: we count your completed bookings with each Provider who offers a reward, to show your progress and apply the discount. Each Provider only sees the bookings you've made with them
• To handle quotes: when you request a quote, we share the date, number of guests, description and reference photos you send with that Provider. Photos are stored privately and only you and that Provider can see them
• To generate your annual Sumerzé year in review, a summary of your booking activity for the calendar year shown only to you inside the App
• For waitlists and time changes: if you ask to be notified when a day opens up, we keep the provider and the day until it passes; if you ask to change a booking's time, we share the proposed time with the other party
• For favorites updates: if you save a Premium Provider as a favorite, they can ask us to tell you about a sale or an opening (up to 2 times a month). We never give them your contact details, and you can turn these off with your Reminders setting
• To respond to support inquiries and investigate disputes
• To improve and maintain the App

3. Information Sharing

We do not sell your personal information. We share information only in the following circumstances:

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Sumerzé, our users, or the public.

Payment disputes. If a payment made in the App is disputed with a bank or card issuer (a chargeback), we share with Stripe — and, through Stripe, with the bank and card network — the information about that booking needed to respond: the customer's name and email, the service, booking dates and status, payment amounts and receipts, the customer's review, the messages exchanged between customer and provider about that booking, and photos or documents the provider supplies. Only information about the disputed booking is shared.

Publicly accessible Provider content. Provider profile information — including business name, bio, city, services, reviews, and portfolio photos. Is publicly accessible and not protected by the App's private data handling. Specifically:

• Provider profiles are visible to all App users and may be indexed by search engines via public profile URLs (sumerze.com/p/[slug]).
• Portfolio photos uploaded by Providers are displayed on their public profile page, accessible to anyone on the internet without a Sumerzé account.
• When discovery sharing is enabled, portfolio photos may appear to all Sumerzé customers in the in-app discovery feed.
• Collections: anyone with a collection's link (sumerze.com/collection/[slug]) can see its name and the providers saved in it, including each provider's profile photo. The creator's email and other private details are not shown. Only share the link with people you want to see it; you can rename or delete a collection at any time.
• Reviews: reviews you write, and any photo you add to a review, are public on the Provider's profile, along with your name and profile photo.
• Providers can opt out of the in-app discovery feed and remove photos at any time from Portfolio settings in the App. Removing a photo from the App removes it from public display.

4. Data Retention

We retain your account information and booking history for as long as your account is active. If you delete your account through the App, your photos are removed right away and your profile and personal data are deleted after 30 days. Bookings and messages you shared with another person stay in their history, shown as “Deleted user”, because they are part of their record too. Specific retention periods by data category:

• Account and profile information. Retained for the life of the account; deleted within 30 days of account deletion.
• Booking records and transaction amounts. Retained for 3 years after the booking date for legal, tax, and dispute purposes, even after account deletion.
• Message content. Retained for the life of the account. When you delete your account, your name and photo are removed from your messages; messages in a booking stay visible to the other person, without your name, as part of that booking's record.
• Safety and dispute records. Retained for up to 3 years to support potential legal proceedings.
• Stripe payment identifiers. Stripe payment intent IDs and payout account identifiers are retained for up to 7 years as required for financial record-keeping and tax compliance.
• Anonymized analytics data. Aggregated, non-identifiable usage data may be retained indefinitely as it cannot be linked back to an individual.
• Push notification tokens. Deleted within 30 days of account deletion or when a device is deregistered.

5. Your Rights

You may access, correct, or delete your personal information at any time through the App's profile settings. To delete your account and all associated data, use the "Delete My Account" option in the Profile screen. For additional requests or questions, contact us at legal@sumerze.com.

California residents (CCPA/CPRA). Under the California Consumer Privacy Act, California residents have the following rights:

• Right to know. You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to delete. You may request deletion of your personal information, subject to certain exceptions (e.g., information needed to complete a transaction or comply with a legal obligation).
• Right to correct. You may request correction of inaccurate personal information we hold about you.
• Right to opt out of sale or sharing. Sumerzé does not sell or share your personal information for cross-context behavioral advertising as defined under CCPA. We do not sell personal data to third parties for monetary or other valuable consideration.
• Right to non-discrimination. We will not discriminate against you for exercising any of your CCPA rights.

Categories of personal information collected include: identifiers (name, email, phone), commercial information (booking history, payment amounts), professional information (provider bio, services, portfolio), internet/network activity (usage analytics, push tokens), and message content (text messages exchanged between customers and providers through the in-app chat, which may be reviewed by Sumerzé as described in Section 1). We do not collect sensitive personal information beyond what is described in Section 1. To submit a verifiable consumer request, email legal@sumerze.com with the subject line "California Privacy Request."

European Economic Area & UK residents (GDPR/UK GDPR). If you are located in the EEA or UK, you have the following rights under applicable data protection law:

• Right of access. You may request a copy of the personal data we hold about you.
• Right to rectification. You may request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"). You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restrict processing. You may request that we limit how we use your data in certain circumstances.
• Right to data portability. You may request your personal data in a structured, machine-readable format.
• Right to object. You may object to processing based on our legitimate interests.
• Right to lodge a complaint. You have the right to lodge a complaint with your local data protection authority.

Our legal bases for processing personal data are: (a) contract performance. To create your account, process bookings, and facilitate payments; (b) legitimate interests. Specifically, improving platform safety, preventing fraud, detecting and investigating policy violations, and sending service-related notifications that users would reasonably expect; and (c) consent. Where you have explicitly provided it, such as agreeing to identity verification. To exercise any of these rights, contact legal@sumerze.com.

International data transfers. Sumerzé's infrastructure is hosted in the United States. If you are located in the European Economic Area (EEA) or United Kingdom, your personal data is transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission with our data processors (including Supabase and Stripe) as the lawful transfer mechanism for these transfers. By using the App, you acknowledge that your data will be processed in the United States in accordance with this Privacy Policy.

6. Push Notifications

We send push notifications for booking requests, booking status updates, new messages, and payment requests. You can disable push notifications at any time in your device's system settings. Disabling notifications does not affect your ability to use the App, but you may miss time-sensitive alerts.

7. Children's Privacy

Sumerzé is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a minor, we will delete it promptly.

8. Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), row-level security policies on our database, and Stripe's PCI-compliant infrastructure for payment data. No method of transmission or storage is 100% secure; use the App at your own risk.

9. Identity Verification (Sumerzé Verified)

Providers may optionally participate in the Sumerzé Verified program, which confirms their real identity through a government ID check. This section explains how identity data is handled.

What we collect. When a provider initiates identity verification, Stripe Identity (a service operated by Stripe, Inc.) collects a photo of a government-issued ID document and a selfie photograph directly from the provider. Sumerzé does not receive, view, or store the ID document or selfie.

Who processes it. Identity documents and biometric data (facial geometry derived from the selfie) are processed solely by Stripe Identity. Stripe's privacy policy at stripe.com/privacy governs how this data is collected, retained, and deleted. Sumerzé receives only the verification result (approved or not approved).

What Sumerzé stores. Sumerzé stores a record of the verification outcome (verified or not), the Stripe verification session ID for audit purposes, and the date the verification was completed. We do not store any biometric data.

Purpose. Identity verification data is used only to confirm that a provider is a real person. It is not used for credit checks, background checks, advertising, or any other purpose.

Biometric data. Facial recognition and biometric comparison is performed exclusively by Stripe. Sumerzé does not use, access, or retain biometric identifiers or biometric information. Providers in states with biometric privacy laws (such as Illinois, Texas, and Washington) should review Stripe's biometric data practices at stripe.com/privacy.

Consent. Identity verification is entirely optional. Providers must explicitly consent to the collection and processing of their identity data by agreeing to the Sumerzé Verified terms before initiating the process.

Deletion. To request deletion of your Sumerzé Verified record, contact legal@sumerze.com. For deletion of identity documents processed by Stripe, contact Stripe directly per their privacy policy.

10. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users as required by applicable law. Under GDPR, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach where feasible, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Under applicable US state laws, we will provide notice within the timeframes required by the laws of each affected user's state. Breach notifications will be sent to the email address associated with your account.

11. Cookies and Website Tracking

This section applies to the Sumerzé website at sumerze.com in addition to the App.

Essential cookies. We use cookies that are strictly necessary for the website to function. For example, remembering your language preference (English or Spanish) and your cookie consent choice. These cookies do not require your consent as they are required for the site to operate.

Analytics cookies. We may use analytics tools on the website to understand how visitors navigate and use the site. These tools may set cookies or use similar tracking technologies. We ask for your consent before loading non-essential cookies, via the cookie banner displayed on your first visit.

Managing cookies. You can withdraw cookie consent at any time by clearing your browser cookies and revisiting the site, at which point the consent banner will reappear. You can also disable cookies in your browser settings, though this may affect website functionality.

12. Marketing Communications

In addition to the transactional and service-related messages described elsewhere in this Policy, Sumerzé may occasionally send you promotional emails about new features, referral incentives, or other marketing communications. You may opt out of marketing emails at any time by clicking the "unsubscribe" link included at the bottom of every marketing email, or by emailing support@sumerze.com with the subject line "Unsubscribe." Opting out of marketing communications does not unsubscribe you from transactional messages (such as booking confirmations, payment receipts, or security notices), which we will continue to send as needed to operate your account. In accordance with the CAN-SPAM Act, all marketing emails from Sumerzé clearly identify Sumerzé as the sender and provide a working opt-out method.

13. Links to Third-Party Websites

The App and our website may contain links to third-party websites or services that are not owned or controlled by Sumerzé, including payment processors, social media platforms, or external links supplied by Providers. This Privacy Policy applies only to information collected by Sumerzé. We are not responsible for the privacy practices of any third-party site, and we encourage you to review the privacy policy of any third-party website before providing it with information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the App or email. Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

Contact

Privacy or legal questions? legal@sumerze.com.

General support? support@sumerze.com.

Billing questions? billing@sumerze.com.