This Privacy Policy explains how MRSLM Group LLC, a Florida limited liability company ("we", "us"), collects, uses and shares personal data when you visit summafolio.com (the "website") or use Summafolio (the "Service"). It describes how our software actually behaves. If that changes, we'll update this page first.
Summary
- The website sets no cookies and loads no analytics, advertising or third-party scripts.
- Statements and matter data are encrypted at rest with a key unique to each matter.
- Matters are deleted automatically after the retention period (90 days by default).
- We never use customer data to train AI models, and we do not sell or share personal data.
Two roles
For account, billing and website data, we decide how personal data is used. For Customer Content (statements and matter data you upload, which contain personal data of the fiduciary, beneficiaries, decedents and others), we process it on your behalf and under your instructions, only to provide the Service. You are responsible for having the authority to upload it.
Information we collect
| Source | What | Why |
|---|---|---|
| Website visits | Standard web-server logs kept by our hosting provider: IP address, browser user agent, page requested, time. | Delivering and securing the website. |
| Your address and what you write to us at hello@summafolio.com, security@summafolio.com or legal@summafolio.com. | Responding to you. | |
| Account and workspace | Name, email, firm name, and the clients and matters you create. Sessions use a signed cookie in the application only. | Providing the Service. |
| Customer Content | Uploaded statements (which include account numbers, balances, transactions, payees and names), matter details, beneficiaries, notes and generated accountings. | Producing your accountings. |
| Agreement records | When you accept the Terms: the version, date and time, your email, IP address and browser user agent. | Proving the agreement and preventing fraud. |
| Audit trail | Who made each change to a matter, and when. | Integrity of the accounting and your review. |
| Billing | Plan, amounts and billing status. Card details are collected by our payment processor and are never stored on our servers. | Billing. |
How we use information
To provide, operate and secure the Service; to produce the accountings you request; to communicate with you and provide support; to bill; to detect and prevent abuse, including use for prohibited matters; and to comply with legal obligations. We don't use Customer Content to train machine-learning or AI models, and we don't sell personal data. Our staff don't access Customer Content except at your request for support, to investigate abuse or security incidents, or when the law requires it.
Legal bases (EEA/UK)
If the GDPR or UK GDPR applies: contract, to provide the Service; legitimate interests, to secure the Service and prevent abuse; legal obligation, for tax and accounting; and consent, where we ask for it. You can withdraw consent at any time.
Retention
- Matters, uploaded statements and generated accountings: deleted automatically after the retention period your workspace sets (90 days by default, 7 to 365 days), or earlier when you delete the matter. Deletion destroys the matter's encryption key.
- Agreement records: for the life of the account and afterwards as long as needed to establish, exercise or defend legal claims.
- Account and billing records: while your account is active and afterwards as required for tax, accounting and legal purposes.
- Logs: kept by our hosting providers under their standard retention; we aim not to keep them longer than needed for security and troubleshooting.
- Email: as long as needed to handle your request and any follow-up.
These periods describe how our systems are designed to work and don't limit rights you have under applicable law.
Service providers (subprocessors)
| Provider | Purpose | When |
|---|---|---|
| Hostinger | Website hosting and server logs | Visiting the website |
| Application hosting provider (named here before it receives Customer Content) | Running the Service and storing encrypted data | Using the Service |
| Stripe | Payment processing | Paying for an accounting |
| AI statement-reading provider (named here before it receives Customer Content) | Reading statement layouts that our built-in parsers can't | Only if used, under a no-retention, no-training contract |
We may also disclose information when required by law, to protect rights and safety, or as part of a merger, acquisition or sale of assets. We'll update this list before adding a provider that receives Customer Content.
International transfers
We are based in the United States, and data is processed in the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Security
See our Security page and Security and Data Handling policy. No method of transmission or storage is completely secure, and we can't guarantee absolute security. If a breach affects your personal data, we'll notify you and regulators as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, and to withdraw consent. EEA and UK residents may complain to their data protection authority. For data inside a matter (for example a beneficiary's information), we'll refer your request to the fiduciary or firm that controls the matter and help them respond.
California (CCPA/CPRA). California residents have the right to know, delete and correct personal information, to opt out of its sale or sharing, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. We don't sell or share personal information as those terms are defined in the CCPA and haven't in the past 12 months. Categories collected: identifiers (name, email, IP address), commercial information (billing), financial information contained in Customer Content (processed on your behalf) and internet activity (server logs). We aim to respond within 45 days. You may use an authorized agent; we may verify the agent's authority and your identity.
Other U.S. states. Residents of other states with privacy laws may have similar rights. If we deny your request, you may appeal by replying with the subject "Appeal".
To make a request, email legal@summafolio.com. We verify requests by confirming control of the email address associated with the data.
Children
The Service is for adults, and it is not available for matters involving minors. We don't knowingly collect personal data from children.
Changes
We'll post updates here and change the version and "last updated" date. If changes are material, we'll make reasonable efforts to notify account holders.
Contact
MRSLM Group LLC
7095 Hollywood Blvd Ste 484, Los Angeles, CA 90028, United States
Email: legal@summafolio.com