Privacy notice

Last updated: October 14, 2026.

1. Who is responsible

Irvin Ariel Madrid Castillo (“Summa”), located in Agua Prieta, Sonora, ZIP 84269, Mexico, is responsible for the personal data you give us when you use Summa POS, the summapos.com website and its cloud services. For anything about personal data, write to irvinmadrid@summapos.com.

2. What data we collect

• Your account: name, email, password (we only keep an encrypted version that can't be reversed) and business name.
• Tax and business data: RFC, legal name, tax regime, ZIP code, and the address and phone of your branches. For invoicing, the digital seal certificate (CSD) you register with our invoicing provider.
• Payments: card charges are processed by Stripe. We don't see or store your card number; only your plan status and the charge identifiers.
• Technical data: a device identifier for each register (for licenses and so the free trial isn't repeated), the IP address and browser when you sign in, and error and service-usage logs.
• What your business records in Summa, if you use the cloud: products, sales, inventory, cash counts, your registers' users and your customers' data (name, RFC, email, phone, address, tax data and credit). In pharmacies, the antibiotics log (prescribing doctor's details and medicines dispensed).
• Your page at summapos.com/n/…, if you publish it: what you choose to show (description, logo, catalog and your branches' hours, phone and WhatsApp) is public. The orders your customers put together there are kept only in their browser and travel on WhatsApp straight to your business: Summa doesn't receive them.
• Self-invoicing: when someone requests the invoice for their receipt at summapos.com/factura, their RFC, name or legal name, tax regime, ZIP code and email.

3. What we use it for

We use your data only for what is needed to provide the service:

• Creating and managing your account, your licenses and your registers.
• Syncing your registers and showing your business in “My business”.
• Stamping and canceling electronic invoices (CFDI) before the SAT through an authorized provider (PAC).
• Charging for your plan and sending your account notices: email verification, end of trial, payments, expirations and cancellations.
• Giving you support by email.
• Running the “Refer and earn” program: whoever referred you only sees part of your business name and how the referral is going (for example, “paid”), never your data or your sales. To prevent abuse we compare, without showing them, the computer identifier, the RFC, the card fingerprint Stripe provides and the email of both accounts.
• Protecting the service: detecting unauthorized access, free-trial abuse and failures.
• Meeting our legal and tax obligations.

Also, unless you object, we use your email for one purpose that isn't needed to provide the service:

• Letting you know about updates and new features of the service you already use. Every notice has a link to stop receiving them, without affecting your service or your account notices.

Apart from those product-news notices, we don't use your data for advertising or marketing, and we don't share it for others' advertising. If we ever wanted to, we will ask for your consent first and you can say no without it affecting the service.

4. Your business's customers' data

The data your business records about its customers is your business's responsibility. Summa only stores and processes it on your behalf (as a processor), to provide the service and following your instructions; it doesn't use it for anything else. Your business must give its own privacy notice to its customers. If one of your business's customers writes to us to exercise their rights, we will forward it to you.

5. Who we share it with

To operate we use these providers, which handle data only on our behalf:

In addition, the invoices you stamp reach the SAT, and we will hand data to an authority only when a law or an order requires it. None of this requires your consent, because it is needed to provide the service or required by law. We don't sell or rent your data.

6. How long we keep it

As long as your account exists. If you ask us to delete it, we erase your data from the cloud, except what the law requires us to keep (tax and payment records, for 5 years). Our database backups are deleted automatically after 30 days. Your registers' data lives on your computers, and deleting it there is up to you.

7. Your rights and how to exercise them

You can access your data, correct it, ask us to delete it or object to its use (ARCO rights), as well as revoke your consent or limit the use of your data. Write to irvinmadrid@summapos.com with:

• your name and your account's email;
• an official ID (and, if someone writes on your behalf, the document that proves it);
• which right you want to exercise and over which data;
• any detail that helps us find it.

We reply within 20 business days at most and, if it applies, we carry it out within the following 15 business days. You can correct much of your data yourself in “My business” or on your register. If you revoke consent for data the service needs, we may no longer be able to provide it.

8. Cookies

summapos.com only uses the cookies needed to keep your session in “My business”, remember the language you chose, remember for 30 days the referral link you arrived with and protect the forms. We don't use advertising or third-party analytics cookies.

The cart on business pages (summapos.com/n/…) is kept only in the browser of whoever builds it. If you open the map on one of those pages, it loads from Google Maps, which applies its own privacy policy.

9. Security

All connections are encrypted (HTTPS), passwords are stored encrypted, server access is restricted and the database is backed up every day. If a security breach affecting your rights ever happened, we would let you know.

10. Minors

Summa is a service for businesses and is not directed at minors.

11. Changes to this notice

We will publish any change on this page with its date. If the change is significant, we will also let you know by email.

12. Businesses we contact to offer Summa

To offer Summa to businesses in the region we use the data each business published in INEGI's National Statistical Directory of Economic Units (DENUE), which is a publicly available source: business name, line of business, address, phone, email and website.

We use it only to write to you or call you once or a few times, by email, WhatsApp or phone, and introduce Summa. We don't share or sell it. If you're not interested, reply “NO” to the message or write to irvinmadrid@summapos.com: we won't contact you again and we delete your data from our list, except the business name and the contact channel, which we keep only so we don't write to you again. If you don't ask us for information within six months, we delete it as well. You can exercise your other rights as explained in section 7.

13. Authority

If you believe your right to the protection of your personal data was harmed, you can go to the competent authority on the matter (currently, the Secretaría Anticorrupción y Buen Gobierno).