Sumna Privacy Policy

1. Introduction

This Privacy Policy explains how Linguae Academy LLC, a Virginia limited liability company doing business as "Sumna" ("Sumna," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit sumna.app, use the Sumna web application or recorder application, or otherwise interact with our services (together, the "Service").

Sumna is a tool for language tutors ("Tutors") that turns lesson transcripts or audio into class summaries and related teaching materials, and gives their students ("Students") a portal to receive those materials. Because the Service handles information about both Tutors and Students — and Students' information is entered by their Tutor — please read Section 2, which explains our two different roles.

This policy is written to satisfy the EU and UK General Data Protection Regulation ("GDPR"), the Virginia Consumer Data Protection Act ("VCDPA"), the California Consumer Privacy Act as amended ("CCPA/CPRA"), other U.S. state privacy laws, and the U.S. Children's Online Privacy Protection Act ("COPPA").

If you have questions or want to exercise any right described here, contact us at privacy@sumna.app.

2. Our Two Roles: Controller and Processor

For Tutor information, we are the controller. When a Tutor creates an account, completes onboarding, subscribes to a paid plan, or contacts us, we decide how and why that information is processed.

For Student information, the Tutor is the controller and we are the Tutor's processor (or "service provider" under U.S. state laws). Tutors decide what Student information to enter, what materials to create, and what to publish to a Student. We process that information only on the Tutor's instructions and to provide the Service, and Tutors are responsible for having a lawful basis (including any required parental consent for minors) for the Student information they submit. Students who have questions about how their information is used, or who want it corrected or deleted, should contact their Tutor first; we support Tutors in honoring such requests and will also assist Students directly where the law requires. A data processing addendum with GDPR Article 28 terms is available to Tutors on request.

We are also the controller for the limited processing we do for our own purposes across all data, such as securing the Service, billing, legal compliance, and understanding how the Service is used so we can improve it (product usage analytics, described in Sections 3.4 and 8).

For advertising measurement, we and Meta act as joint controllers. If you consent to advertising cookies on our public marketing pages, the Meta pixel reports two events to Meta Platforms, Inc. — that a page was viewed, and that a sign-up link was clicked. Meta uses that information for its own purposes as well as ours, which is different in kind from our other providers: they act only on our instructions, whereas Meta does not. This applies only to visitors to our public pages who opt in; it never applies to Student information, which we process solely as the Tutor's processor.

3. Information We Collect

3.1 Information Tutors provide

• Account and contact details: email address, password (held by our authentication provider in hashed form), academy or business name, director/display name, and contact email for student-facing documents.
• Onboarding profile: city and timezone, default teaching level, languages taught, specialties, approximate number of students, how you find students, teaching platforms you use, and how you heard about Sumna.
• Branding preferences: brand colors and logo display settings.
• Billing details: subscription plan, billing status and period dates, and identifiers issued by our payment processor (Stripe). Payment card details are collected and stored by Stripe, not by us.

3.2 Information about Students

Entered by the Tutor, by the Student during portal onboarding, or both:

• Profile: name, email address, phone number (optional), proficiency level, native language, city/location, timezone, teaching platform and mode, scheduling preferences, interests, learning goals, and free-text notes written by the Tutor.
• Portal account: for invited Students, a portal login (email and password, held by our authentication provider), invitation and join dates, and onboarding responses (interests, learning goals, native language, city and timezone).
• Learning records: class summaries and the lesson transcripts behind them, homework and grades, homework submissions the Student uploads, exams and exam attempts (answers, scores, feedback), lesson plans, goals, focus areas and progress history, notes the Student writes on summaries, and an AI-generated summary of the Student's goals.
• Change history: an audit log of edits to a Student's profile (field changed, old and new values, when).

3.3 Lesson content

• Transcripts: lesson transcripts you paste or upload are stored in your account and are used to generate summaries and other materials.
• Audio: if you upload lesson audio (or use the Sumna recorder app, which saves recordings only to a folder on your own computer), the audio is sent to our transcription provider to produce a transcript. We do not store lesson audio on our servers — only the resulting transcript is kept. We log the duration of transcribed audio to enforce plan limits.
• Uploads: files you upload (such as summary documents in PDF, Word, or text format) and homework submissions (PDF, image, Word, or text files up to 25 MB) are stored in private storage accessible only to the authorized Tutor and Student.

3.4 Information collected automatically

We collect limited technical information needed to operate the Service securely: authentication session cookies, IP addresses and timestamps in server and security logs, and basic request metadata. With your consent (see Section 8), we also collect product usage analytics and masked session recordings: pages viewed, features used, and actions taken in the Service (for example, generating a summary or opening a homework assignment), together with your IP address, general device and browser information, and a masked recording of your on-screen interactions. This applies to both the Tutor application and the Student Portal. Analytics events and recordings are linked to a pseudonymous identifier and never include lesson content, transcripts, audio, passwords, or the content of learning materials — every input field and all on-screen text are masked in your browser before a recording is sent. Our analytics provider is PostHog; this data is processed in the United States under the transfer safeguards described in Section 9.

3.5 Advertising measurement

On our public marketing pages only, and only with your consent, we use the Meta pixel to measure whether our advertising works. It reports two standard events to Meta: PageView (a page was viewed) and Lead (a sign-up link was clicked). No other events are sent, and no custom parameters are attached. Meta receives your IP address, browser information, the page address, and cookie identifiers it sets, together with the page title and description that Meta collects by default.

We do not send Meta your email address, name, telephone number, or any other identifier about you. Meta's "Advanced Matching" feature, which would transmit that information in hashed form, is switched off. The pixel is never present on the Tutor application or the Student Portal, and no lesson content, transcript, summary, or Student information is ever transmitted to Meta. If you decline or have not yet chosen, the pixel script is never downloaded at all, so no request reaches Meta and no Meta cookie is set. See Sections 7 and 8.

3.6 Information from other sources

We receive subscription and payment status from Stripe. We do not buy personal information from data brokers or enrich profiles from third-party sources.

4. How We Use Information

We use personal information to:

• provide the Service: generate summaries, homework, exams, and lesson plans from your content; deliver materials to Students by email and through the portal; track goals and progress;
• create and manage accounts, authenticate users, and secure the Service (including fraud and abuse prevention);
• process subscriptions, payments, and plan limits;
• send transactional email: summary and homework deliveries, portal invitations and sign-in links, notifications to Tutors when a Student joins the portal or sends a note, account and billing emails, and administrative notices;
• provide support and respond to your requests;
• comply with legal obligations and enforce our Terms and Conditions;
• improve the Service — including through the product usage analytics described in Section 3.4, and using aggregated or de-identified information wherever possible.

We do not sell personal information, and we never use Your Content — lesson audio, transcripts, summaries, or Student information — for advertising of any kind. On our public marketing pages only, and only with your consent, we use the Meta pixel to measure our advertising (Section 3.5). Some U.S. state privacy laws may treat that as "sharing" personal information for cross-context behavioral advertising. You can decline it at any time through our consent banner or the "Manage cookies" link, and it is never present in the Tutor application or the Student Portal.

5. Artificial Intelligence Processing

The Service uses third-party AI providers to deliver its core features:

• Transcription: lesson audio is sent to AssemblyAI (or, as a fallback, OpenAI) to produce a speaker-labelled transcript. The audio is processed for transcription and is not retained on our servers.
• Generation: lesson transcripts and relevant Student context (such as level, goals, and prior summaries) are sent to Anthropic's Claude models to draft summaries, homework, exams, lesson plans, progress analyses, and goal summaries. AI assistance is also used to help score certain exam answers, which the Tutor can review and override.

We do not use your content to train AI models, and our AI providers are engaged on API terms under which they do not use your data to train their models. AI output is a draft for the Tutor: nothing generated by AI is shown to a Student until the Tutor reviews and publishes it, and exam scores suggested by AI can be overridden by the Tutor before release. We do not make automated decisions about you that produce legal or similarly significant effects without human involvement.

6. Legal Bases for Processing (GDPR)

Where the GDPR or UK GDPR applies and we act as controller, we rely on:

• Contract (Art. 6(1)(b)): to provide the Service you signed up for, manage your account, and process payments.
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent abuse, improve features, and communicate about service matters — balanced against your rights and interests.
• Legal obligation (Art. 6(1)(c)): for tax, accounting, and responding to lawful requests.
• Consent (Art. 6(1)(a)): for non-essential product analytics and session replay, and anywhere else we ask for it explicitly; you may withdraw consent at any time (for analytics, via the "Manage cookies" link in the footer).

Where we process Student information as the Tutor's processor, the Tutor is responsible for the legal basis — typically consent (including parental consent for minors) or the Tutor's contract with the Student or their family.

7. How We Share Information; Subprocessors

We share personal information only with service providers ("subprocessors") that help us run the Service, under contracts that limit their use of the data to providing services to us:

Advertising partner. The company below is listed separately because it is not a subprocessor acting on our instructions. It uses the information it receives for its own purposes as well as ours, which is why we and it are joint controllers for that processing (Section 2). It receives data only from visitors to our public marketing pages who have consented, and only the two events described in Section 3.5.

We may also disclose information: to comply with law or valid legal process; to protect the rights, safety, or property of Sumna, our users, or others; in connection with a merger, acquisition, or sale of assets (in which case this policy will continue to apply to previously collected data, and we will notify you of any successor); or with your direction or consent (for example, emailing a summary to a Student at your request).

We do not sell personal information and have not done so. Apart from the advertising measurement described above — which happens on our public marketing pages, only with consent, and never involves Student or lesson data — we do not share personal information with third parties for their own marketing.

8. Cookies and Tracking

The Service stores strictly necessary and functional cookies on your device: session cookies set by our authentication provider to keep you signed in, and a preference cookie that remembers which Tutor's academy branding to show on the student sign-in page (it contains an internal identifier only and grants no access). These are always on.

With your consent, we also use non-essential storage (cookies and local storage) for two separate purposes, both covered by the same choice in our consent banner:

• Product analytics and session replay, through PostHog, which records how the Service is used so we can improve it. This runs on the Tutor application and the Student Portal as well as our public pages.
• Advertising measurement, through the Meta pixel, which tells us whether our advertising reaches people who go on to sign up (Section 3.5). This runs on our public marketing pages only — never on the Tutor application or the Student Portal — and Meta uses the data for its own purposes as well as ours.

In the EEA, the UK, and Switzerland this storage is set only after you opt in through our consent banner; elsewhere it is on by default and you may opt out. You can change or withdraw your choice at any time using the "Manage cookies" link in the footer. Declining or withdrawing stops all analytics and session recording, and stops the advertising pixel. If you decline, or have not yet chosen, the Meta pixel script is never downloaded — no request is made to Meta and no Meta cookie is placed on your device.

We do not track you across other websites for our own purposes, and our product analytics observes use of the Service itself and nothing beyond it. The Meta pixel is a third-party advertising technology, and information it collects may be combined by Meta with data it holds from elsewhere; that is Meta's processing, governed by Meta's own privacy policy, and it is the reason we ask for consent before loading it at all. We do not respond differently to "Do Not Track" signals, which have no agreed meaning. Where a state law requires recognition of opt-out preference signals such as Global Privacy Control for sale or targeted advertising, we honor them: we do not sell personal information, and you can decline or withdraw advertising storage at any time through the consent banner or the "Manage cookies" link.

9. International Data Transfers

We are based in the United States, and the Service is hosted and processed there. If you use the Service from the EEA, UK, Switzerland, or elsewhere, your personal information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Where the GDPR or UK GDPR applies to a transfer, we rely on appropriate safeguards: our subprocessors either certify under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or enter into the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA), supplemented as needed. Meta Platforms, Inc., our advertising partner, is self-certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You can request more information about transfer safeguards at privacy@sumna.app.

10. Data Retention

We keep personal information only as long as needed for the purposes described in this policy:

• Account and profile data: for as long as your account exists, and deleted within a reasonable period after account deletion.
• Transcripts, summaries, homework, exams, and other learning records: for as long as the Tutor keeps them in their account. Tutors can delete individual items or an entire Student record at any time; deleting a Student permanently removes their profile, summaries, homework, submissions, exams, goals, uploads, and portal account.
• Lesson audio: not stored on our servers (processed transiently for transcription). Recordings made with the recorder app remain on your own device under your control.
• Billing records: retained as required for tax and accounting purposes (typically 7 years).
• Security and server logs: retained for a short operational period, then deleted or anonymized.
• Product analytics and session recordings (PostHog): usage events are retained for up to 12 months and masked session recordings for up to 30 days, after which they are deleted; withdrawing consent stops further collection.
• Backups: deleted data may persist in encrypted backups for a limited period before being overwritten in the normal backup cycle.

11. Security

We take security seriously. Measures include: encryption in transit (TLS) and at rest at our infrastructure providers; row-level security in our database so each Tutor's data is isolated and Students can see only what their Tutor has published; private storage buckets with per-user access controls for uploads; hashed passwords managed by our authentication provider; single-use, expiring invitation and sign-in links; and restricted, audited use of administrative access. No service can guarantee absolute security, but we work to protect your information against unauthorized access, alteration, disclosure, and destruction. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law, including Virginia's breach notification statute and the GDPR's 72-hour authority notification rule.

12. Your Rights — EEA, UK, and Switzerland (GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten") in certain circumstances;
• Restrict processing in certain circumstances;
• Data portability — receive data you provided in a structured, commonly used, machine-readable format;
• Object to processing based on legitimate interests, and to any direct marketing;
• Withdraw consent at any time, without affecting prior processing;
• Not be subject to solely automated decisions with legal or similarly significant effects;
• Complain to a supervisory authority in your country of residence or work, or where an alleged infringement occurred.

To exercise these rights, email privacy@sumna.app; we respond within one month (extendable by two further months for complex requests, with notice). If you are a Student, your Tutor controls your learning records — we will refer your request to them where appropriate and help fulfil it.

13. Your Rights — Virginia (VCDPA)

If you are a Virginia resident, the VCDPA gives you the right to:

• confirm whether we process your personal data and access it;
• correct inaccuracies;
• delete personal data provided by or obtained about you;
• obtain a copy of personal data you provided, in a portable and readily usable format;
• opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. We do not sell personal data and do not carry out such profiling. For advertising, our only processing is the consent-based measurement pixel on our public marketing pages described in Section 3.5, which you can decline or withdraw at any time through the consent banner or the "Manage cookies" link.

Submit requests to privacy@sumna.app with the subject line "Privacy Request." We will authenticate your request using information associated with your account and respond within 45 days, extendable once by 45 days where reasonably necessary (we will tell you if so). We will not discriminate against you for exercising your rights.

Appeals: if we decline to act on your request, you may appeal within 60 days of our decision by replying to our response or emailing privacy@sumna.app with the subject line "Privacy Appeal." We will respond in writing within 60 days, explaining our decision. If your appeal is denied, you may contact the Virginia Attorney General at www.oag.state.va.us to submit a complaint.

We process sensitive data (such as data about children, or any health-related notes a Tutor chooses to record) only with the consent required by law — for known minors' data, we rely on the Tutor obtaining verifiable parental consent as described in Section 15.

14. Your Rights — California and Other U.S. States

If you are a resident of California or another state with a comprehensive privacy law (including Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you may have similar rights of access, correction, deletion, and portability, and rights to opt out of sales, sharing for targeted advertising, and certain profiling. We do not sell personal information and do not use it for such profiling. Our only advertising-related processing is the consent-based measurement pixel on our public marketing pages (Section 3.5), which some of these laws may treat as "sharing"; you can decline or withdraw it at any time through the consent banner or the "Manage cookies" link, and we honor Global Privacy Control signals as an opt-out.

California residents: the categories of personal information we collect are described in Section 3 (identifiers; customer records; commercial information; internet activity limited to service logs; audio through transcripts; professional information; education-related records; and inferences limited to AI-generated learning summaries). We collect them from you, your Tutor, or your Student, and disclose them only to the service providers in Section 7 for business purposes. We do not use or disclose sensitive personal information for purposes requiring a "limit use" right. You may exercise rights, including through an authorized agent, via privacy@sumna.app; we will verify requests using account information and respond within the statutory period. We do not discriminate for exercising rights. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing.

Exercising rights under any state law is free, though we may decline or charge for manifestly unfounded or repetitive requests where the law allows.

15. Children's Privacy

The Student Portal is intended for students aged 13 and older, and Tutor accounts require users to be 18 or older. We do not knowingly collect personal information directly from children under 13, and portal accounts may not be created for them. If we learn that a child under 13 has a portal account, we will delete the account and associated data.

Tutors may enter information about minor students (including students under 13, without portal access) in order to prepare lessons and share materials with families. In that case the Tutor acts as controller and must first obtain verifiable consent from the student's parent or guardian — both under COPPA-aligned practice and, in the EEA/UK, under the applicable age-of-consent rules (13–16 depending on country). Children's data is treated as sensitive data under the VCDPA and several other state laws, which is why parental consent is required before it is entered.

Parents and guardians may review, correct, or request deletion of their child's information at any time — through the child's Tutor, or by contacting us at privacy@sumna.app; we will act on such requests together with the Tutor, and we will honor deletion requests regardless of the Tutor's response where the law requires.

Product usage analytics (Section 3.4) applies to the Student Portal, including its use by students aged 13–17. These events are pseudonymous, are never used for advertising or profiling, never include lesson content, and are collected without cookies. Parents and guardians may exercise the rights described in this section for their child's analytics data as for any other data.

If a Tutor works with a school or institution subject to FERPA (the U.S. Family Educational Rights and Privacy Act) or similar education-records laws, the Tutor is responsible for ensuring their use of Sumna complies with those laws and any agreement with the institution.

16. Exercising Your Rights: Deletion and Export

• Tutors can edit their profile in Settings, delete individual summaries, homework, exams, uploads, and Students (including all the Student's data) directly in the app, and can permanently delete their entire account and all associated data from account settings. A complete export of your data is available on request at privacy@sumna.app.
• Students can edit certain profile details in the portal and can ask their Tutor to correct or delete their records; they may also contact us directly at privacy@sumna.app.
• Parents/guardians of minor students may contact the Tutor or us as described in Section 15.

We will verify requests using the email address associated with the account (or equivalent reasonable means) before acting on them.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version at sumna.app/privacy with a new effective date, and for material changes we will notify account holders by email or in-app notice before the changes take effect. If a change requires your consent under applicable law, we will request it.

18. Contact Us

Linguae Academy LLC (d/b/a Sumna)

Virginia, USA

Email: privacy@sumna.app

If you are in the EEA or UK and believe we have not resolved your concern, you may lodge a complaint with your local supervisory authority. Virginia residents may contact the Office of the Attorney General of Virginia.