Privacy Policy

Sumor ("Sumor," "we," "us," or "our") provides a web service at sumor.io that helps executive search consultants create and share client-ready candidate shortlists. For privacy questions, contact [email protected].

This policy covers personal information we process when you:

• Create or use a Sumor account (consultant / organization users)
• Upload or manage shortlists, candidates, CVs, and related content
• Open a shared shortlist link as a client or other viewer
• Visit our marketing or authentication pages

Account and organization

Email address, name, authentication details (including OAuth provider identifiers when you sign in with a third-party provider), organization / workspace information, and branding assets you choose to upload (such as firm name and logo).

Workspace content

Shortlists, candidate profiles, CVs and other files, recruiter notes, presentation order, and related metadata you enter into Sumor. Candidate content is provided by you or your organization.

Share links and access

Share-link tokens, status (active / revoked), optional expiry, optional passcodes (stored hashed; never shown after save), optional email capture from clients when enabled on a link, and basic access logs for security and product support (for example, when a link was opened). Access logs are not intended to store full candidate profile content.

Technical information

IP address, browser or device information, and similar diagnostic or security logs needed to operate and protect the service.

• Provide, maintain, and improve Sumor
• Authenticate users and manage organizations
• Host and present shortlists and CVs according to your settings
• Enforce share-link controls (revocation, expiry, passcode, email gate)
• Send transactional email (for example, verification, password reset, account deletion)
• Secure the service, prevent abuse, and provide support
• Comply with law and enforce our Terms of Service

We share personal information with service providers that help us operate Sumor (for example, hosting, database, authentication, and email delivery). They may process data only as needed to provide those services to us.

We may disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset transfer.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are commonly defined under the California Consumer Privacy Act (CCPA / CPRA).

If you are a California resident, you may have rights under the CCPA / CPRA, including rights to know / access, delete, correct, and opt out of the sale or sharing of personal information, and to not be discriminated against for exercising these rights.

Because we do not sell or share personal information for cross-context behavioral advertising, an "opt out of sale/sharing" request is typically not applicable; we will still confirm our practices if you ask. To exercise rights, email [email protected]. We may need to verify your request. Authorized agents may submit requests with appropriate proof of authorization.

Organizations using Sumor decide what candidate and shortlist content to upload and share. For that customer-provided content, we process information to provide the service on the organization's instructions. Consultants are responsible for having a lawful basis to collect and share candidate information with clients through Sumor.

Clients who open a share link may provide an email address when a consultant enables email capture. Internal recruiter notes are not shown on client-facing shortlist views.

We retain personal information for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. If you delete your account, we delete or de-identify associated account data according to our deletion process, subject to residual backups and legal retention needs. Organizations control shortlist and candidate content until it is deleted or the account/workspace is removed.

We use administrative, technical, and organizational measures appropriate to the sensitivity of the data we handle, including authenticated workspace access, hard-to-guess share tokens, revocable links, optional expiry and passcodes, and CV access limited to valid authenticated or share-link contexts (not public unguessable file URLs). No method of transmission or storage is 100% secure.

We use cookies and similar technologies as needed for authentication, security, and core product functionality. We do not currently operate a third-party advertising cookie stack on Sumor marketing pages.

Sumor is directed to business users and is not intended for children under 16. We do not knowingly collect personal information from children.

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date. Continued use of Sumor after changes become effective constitutes acceptance of the updated policy where permitted by law.

Privacy requests and questions: [email protected]