SUM AI ("we", "us", or "our") operates the website sumai.ca. This policy explains what information is collected when you visit the site, how it is used, how long it is kept, and what third-party services process data on our behalf. We handle personal information in accordance with British Columbia's Personal Information Protection Act (PIPA).
We use no advertising networks. We use Google Analytics only if you allow it in the banner at the bottom of the page; until you do, nothing is sent to Google Analytics and no analytics cookies are set. Cloudflare Turnstile, described below, is a third-party bot-prevention widget that may set its own cookies depending on how it is configured.
When you interact with the demo chat or the SUM AI Voice assistant, our server records the following information for each request and stores it in a database:
For SUM AI Voice sessions we additionally record how long the session lasted and why it ended. We do not store the audio itself or the transcript.
This data is used to monitor abuse and understand where our visitors come from. We retain it for 90 days, after which it is automatically deleted.
When you complete the demo chat flow or submit the contact form, you may provide:
This information is used solely to follow up with you about our services. We do not sell or share it with third parties for marketing purposes. We keep inquiry records for up to 24 months so we can pick up a conversation you started, and delete them sooner on request.
Demo requests from the chat and messages from the contact form are each recorded as a row in a spreadsheet in our Google Workspace account, and the emails they trigger, including the demo confirmation you receive, are sent from our Gmail mailbox. That spreadsheet and the inbox are where your inquiry record is kept.
SUM AI Voice is an optional voice assistant. It activates only when you press "Start" and grant your browser's microphone permission, and it stops when you press "End", close the popup, or leave the page.
While a session is active, your microphone audio is streamed through our server to the Gemini Live API on Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI) for processing. Google's service transcribes both sides of the conversation so the exchange can be shown on screen as you speak. Neither the audio nor the transcript is stored by SUM AI. They exist only for the duration of the session and are never written to our database.
Because a third party processes the audio, please do not say anything confidential or sensitive, and avoid using the assistant where other people can be overheard. Google processes the audio and the live transcript on our behalf, under our Google Cloud agreement and the Cloud Data Processing Addendum.
We use Google Analytics 4 to count visits and see which pages lead to inquiries, so we know what to fix or write next. It runs only after you press "Accept" on the cookie banner. If you press "Decline" or ignore the banner, the Google Analytics script is never loaded.
When you allow it, Google Analytics records:
Google states that Google Analytics 4 does not log or store IP addresses. We keep Google signals and advertising features switched off, so this data is not linked to your Google account or used for ads. Event-level data is kept for 2 months, the shortest retention Google Analytics offers; after that only aggregated counts that describe no individual visitor remain.
You can change your choice at any time through "Analytics settings" in the footer. Choosing "Decline" there deletes the Google Analytics cookies and stops further data collection. Processing is subject to Google's Privacy Policy.
The following external services process data as part of normal site operation:
Cloudflare. Our site is served through Cloudflare's network. Cloudflare acts as a reverse proxy and processes all traffic passing through it, including IP addresses and request headers, under their own Privacy Policy.
Cloudflare Turnstile. The demo chat and contact form use Cloudflare Turnstile
for bot prevention. Turnstile loads a script from challenges.cloudflare.com and
may collect browser signals to distinguish humans from bots, subject to Cloudflare's
Privacy Policy.
Google Fonts. This site loads the DM Sans typeface from Google's font CDN
(fonts.googleapis.com, fonts.gstatic.com). Your browser makes a
direct request to Google's servers to fetch the font files, which transmits your IP address
to Google, subject to
Google's Privacy Policy.
Google Cloud (Gemini Enterprise Agent Platform). The demo chat assistant and SUM AI Voice use Google's Gemini models on Google Cloud's Gemini Enterprise Agent Platform, formerly called Vertex AI. Messages you type in the demo chat, and audio you speak to SUM AI Voice, are transmitted to Google, which processes them on our behalf under our Google Cloud agreement and the Cloud Data Processing Addendum. Do not share sensitive or confidential information with either assistant.
YouTube (Google). One article on our blog contains a demo video hosted on
YouTube. The video is not loaded when the page opens: we show a
placeholder instead, and nothing is requested from Google unless you press play. If you do
press play, the player is loaded from youtube-nocookie.com, Google's
privacy-enhanced domain, and from that point YouTube receives your IP address and may store
data on your device, subject to
Google's Privacy Policy.
If you never press play, no connection to YouTube is ever made.
Google Workspace (Gmail and Google Sheets). When you complete the demo chat or submit the contact form, what you entered (name, email address, phone number, company, and your request or message) is added to a spreadsheet in our Google Workspace account, and the resulting emails are sent through Gmail. Google processes this data on our behalf under our Google Workspace agreement and the Cloud Data Processing Addendum.
Google Analytics. Only if you allow it, as described under
Analytics above. The script loads from
www.googletagmanager.com and sends data to google-analytics.com.
Resend. We use Resend only as a backup: if Gmail cannot send an email triggered by the contact form or the demo chat, Resend delivers it instead. In that case your name, email address, and message pass through Resend's servers, subject to their Privacy Policy.
SUM AI operates from Vancouver, British Columbia. The service providers listed above (Cloudflare, Google, Resend) process data on servers located outside Canada, primarily in the United States. Personal information stored outside Canada may be accessible to foreign courts and law enforcement under the laws of that country. We remain accountable for personal information transferred to these providers and require them by contract to protect it.
All traffic to this site is encrypted in transit with HTTPS. Access to the database, the inbox that receives form submissions, the demo request spreadsheet, and the analytics account is restricted to the individual responsible for running SUM AI. Automated abuse prevention (Cloudflare Turnstile, rate limiting) sits in front of every endpoint that accepts input.
No analytics or advertising cookies are set unless you allow analytics. If you press
"Accept", Google Analytics sets two cookies on sumai.ca, _ga and
_ga_<ID>, which let it recognize a returning browser and expire after
two years. If you later decline through "Analytics settings" in the footer, we delete them.
Your banner choice itself is saved in your browser's local storage under
sumai_analytics_consent, holding only "granted" or "denied", so the banner
does not ask again on every page. Clearing your browser's site data removes it.
Cloudflare Turnstile is loaded on pages with a form, the demo chat, or the voice assistant, and may set its own cookies for bot prevention depending on its configuration. The YouTube player described above can also store data on your device, but only after you choose to play the video.
This site and its services are directed at businesses, not at children. We do not knowingly collect personal information from anyone who is not old enough to give meaningful consent under British Columbia's Personal Information Protection Act. If you believe a child has provided us with personal information, email us and we will delete it.
We may update this policy from time to time. The "Last updated" date at the top of this page reflects when the most recent changes were made.
Under British Columbia's Personal Information Protection Act you may:
Email info@sumai.ca with "Privacy request" in the subject line. We respond within 30 days, as the Act requires. There is no charge for an access request.
If you have a concern about how we handled your personal information, email our Privacy Officer at info@sumai.ca. We acknowledge complaints within 5 business days and provide a written response within 30 days. If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.
Privacy Officer
SUM AI, Vancouver, British Columbia, Canada
info@sumai.ca