1. Information We Collect
Under Data Protection Principle 1 (DPP1) of the PDPO, we only collect data necessary to run our software.
Account Data: Name, email, and secure billing information (handled via third-party payment processors; we never store raw credit card details).
Email & Communication Data (via OAuth): With your permission (Google Gmail API, Microsoft Graph, or IMAP), we access email metadata, headers, subject lines, timestamps, and attachment details.
Zero Raw Body Retention: Raw email body text/HTML is processed transiently to extract project intelligence and is never retained in our production database.
Technical Data: Basic system logs (IP address, browser type) and essential session cookies to keep you logged in securely.
2. How We Process & Store Data
Processing: Connected communication channels are scanned automatically to generate project summaries, match status tags, and isolate risks.
Storage: We store account profiles, OAuth access tokens, message metadata, and AI-generated summaries. Disconnecting an integration revokes tokens immediately, though previously generated project summaries remain until deleted.
Security: All data is protected with HTTPS, database encryption at rest, and strict infrastructure access controls.
3. Artificial Intelligence & Models
Gemini API: Selected text excerpts are sent securely via API to Google's Gemini models solely to extract logistics data.
No AI Training: We never use your emails, messages, or project data to train, fine-tune, or improve public or generalized AI models.
4. Google API & Data Protection Disclosures
Summa Flow’s use of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including Limited Use requirements:
We only access email data to provide core project extraction features.
We never sell user data or use email contents for advertising.
Human staff cannot read your email content unless you explicitly grant permission for support troubleshooting, required for security investigations, or mandated by law.
5. How We Share Information
We do not sell, rent, or trade your data. We share information only with:
Essential Service Providers: Cloud hosts (AWS/Google Cloud), payment processors, and AI processing APIs bound by strict data protection agreements (DPP4).
Legal Requirements: When mandated by valid legal requests or court orders within Hong Kong jurisdiction.
Business Transfers: In the event of a merger or acquisition, provided the acquiring entity upholds this policy.
6. Direct Marketing
In compliance with the Hong Kong PDPO, we will only use your contact details to send marketing communications if you have provided voluntary, explicit consent. We will never share your personal data with third parties for direct marketing. You may opt out of marketing communications at any time, free of charge, via the unsubscribe link in our emails or by emailing sever@summaflow.com.
7. Data Retention & Deletion
Under DPP2, we keep data only as long as necessary:
Active Accounts: Data is stored as long as your workspace remains active.
Account Deletion: You may delete your account and revoke OAuth tokens anytime via dashboard settings.
Backups: Following a verified deletion request, production records are removed immediately. Encrypted system backups overwrite deleted data permanently within 30 days.
8. International Transfers
Your data may be processed on secure cloud infrastructure located outside Hong Kong. We enforce encryption and contractual safeguards to ensure international processing maintains legal protection equivalent to the PDPO.
9. Your Privacy Rights
Under PDPO (DPP6), you have the right to:
Access & Correct: Request a copy of your personal data or update inaccurate details via your dashboard.
Revoke & Delete: Disconnect email integrations or request full account deletion at any time.
To submit a Data Access Request (DAR), email our Data Protection contact at sever@summaflow.com.
10. Updates & Contact
We may update this policy periodically. Material updates will be notified via email or dashboard notice.
Data Protection Officer — Summa Flow Ltd.
Email: info@summaflow.com