Privacy Policy

Sum28 builds instruments that make claims about real estate checkable. Restraint is our discipline — in what we say, and in what we collect. This policy explains what SUM 28 LLC (“Sum28”, “we”) collects across our website and our products p2d, ohm, and oak, how we use it, who we share it with, and the rights you have — including your rights under the California Consumer Privacy Act (CCPA/CPRA).

Who we are

Sum28 is a California real-estate technology company operated by SUM 28 LLC. We serve licensed real-estate professionals and, through them, their clients and the members of the public who attend their open houses. Our products are trust instruments: photographs and facts go in, and a checkable, sealed artifact comes out. We sell the instrument and the proof — never advertising, leads, or data about people.

p2d — data we collect

p2d (“photo to description, verified”) turns listing photos and an agent’s notes into listing copy, with every sentence traced to evidence. p2d’s users are the licensed agents who hold accounts; p2d emails only the account holder’s own address.

• Account — your email and a hashed password (we never store your password in plain text), plus a record of your acceptance of our Terms (the date and version you agreed to).
• Inputs you provide — the listing photos you upload, any text you paste (fact sheets, notes, prior listings), and the structured facts you confirm.
• Generated content — the descriptions we produce and your edits/refinements, kept in your history so you can return to them.
• Feedback — if you send in-app feedback, the text and any optional voice memo; a copy is emailed to our support inbox so we can respond.
• Push notifications — if you enable them, your device’s Apple push token, used only to tell you when your copy is ready or credits are returned.
• Usage & billing — credits, generations, refinements, and plan, plus a Stripe customer identifier that links your account to your Stripe billing record. Payments are processed by Stripe; we never see or store your card number.
• Anti-abuse signals — salted, one-way hashes of your IP address and a device identifier, used to rate-limit the free preview and prevent fraud (the raw values are not stored).
• Server logs — standard access logs (including IP addresses), retained about 30 days and then deleted.

What p2d deliberately does not keep

Your photos are processed in memory and are not stored on our servers after we extract their visual features; we keep the derived feature list and the photo file names, not the images. Raw pasted text is not retained — we extract the factual selling points you confirm and discard the original. Drafts you compose in the iOS app stay on your device until you submit them.

ohm — data we collect

ohm (“open house, measured”) is a sign-in used at open houses hosted by licensed agents. It produces a report for the seller and, for visitors who ask, information about the property. The hosting agent and their brokerage decide to use ohm at their event; Sum28 provides the instrument that records the sign-in and sends what was requested.

If you are an open-house visitor

When you sign in at an open house, a consent disclosure is shown directly above the button, including a Notice at Collection: “we collect your name and contact details to share property information with you and for the hosting agent to follow up.” You sign in by taking an affirmative action (tapping “sign in”). What happens next depends on how you sign in:

• If you ask to receive property information (a buyer sign-in), we collect your name, email, and/or phone number and use them to send you the property packet you requested and to let the hosting agent follow up. We hold your contact details for as long as needed to deliver what you asked for and for the agent’s follow-up, then delete or de-identify them.
• If you sign in only to be counted (a neighbor or pass-by), your sign-in is recorded anonymously — no name, email, or phone — for the seller’s attendance count.
• If you are another agent, we record your professional details for the host’s records and do not send you a property packet.

Tamper-evident consent record. For every sign-in that collects contact details, we store an immutable record proving what you agreed to: a one-way SHA-256 hash of the exact disclosure text shown, a reference to the versioned disclosure, the language presented, and a timestamp (with the request’s IP address and browser user-agent). Your name, email, and phone are stored in this consent record only as one-way hashes — never in plain text. We keep your actual email or phone separately, only for as long as we need it to send the information you requested and honor your choices.

Agency notice. The disclosure also tells you that the hosting agent works for the seller and does not represent you unless you have a separate written agreement, that real-estate commissions are not set by law and are fully negotiable, and that signing in is never required to tour the home.

If you are a seller

If you are the seller whose home was shown, your own agent may send you the open-house report about your listing (attendance, interest, and follow-through). You receive this from your agent, about your own property.

Opting out

Every message we send you can be stopped. We maintain a suppression list; a hard bounce, a spam complaint, an unsubscribe, a text reply of STOP, or a CCPA opt-out request permanently removes your address from all future sends. We do not buy, rent, share, or sell contact information.

oak — status

oak (“equity, accounted”) is an annual statement for the home — value range, equity position, tax and insurability facts — planned for January 2027. oak is in development and is not yet collecting data from consumers. Before oak begins operating, we will update this policy to describe exactly what it collects, from whom, and how it is protected.

Website & contact form

Our website (sum28.com) is a static site. If you send us a message through the contact form, we collect the name, email address, and message you provide, together with the IP address and browser user-agent of the request. We use this only to read and respond to your message and to prevent abuse of the form. We do not add you to any marketing list, and we do not sell or share this information. See Cookies for the (very short) list of cookies we use.

How we use information

• To provide the instruments — read photos, generate and check copy, record open-house sign-ins, send the reports and packets that were requested, and screen listing copy for potentially problematic fair-housing language (automated assistance to support your own review — not legal advice or a compliance determination).
• To run accounts, process payments, provide support, and prevent abuse and fraud.
• To improve quality — using de-identified, aggregated usage data and the outputs the service generates. We do not use your inputs (photos, pasted text, confirmed facts, sign-in details) or personal information to train AI models, and our AI providers process your content under API terms that do not use it to train their models.
• To meet legal obligations and enforce our Terms.

What we never do

These are commitments, not preferences:

• We never sell your personal information, and we never “share” it for cross-context behavioral advertising.
• We never sell a lead, a list, or a person, and we take no per-lead fees from lenders, escrow, or title.
• We never sell advertising inside an instrument.
• We use no analytics cookies, no advertising cookies, and no third-party trackers.
• We never use your inputs or personal information to train AI models.

Service providers

We share information only with the vendors that operate the service on our behalf, under contracts that limit them to that purpose. They are processors, not recipients of a sale:

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger or acquisition (in which case this policy governs how your information may be transferred).

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose;
• Access a copy of your personal information;
• Delete your personal information, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of sale or sharing — though we do not sell or share your personal information, so there is nothing to opt out of;
• Non-discrimination — we will not deny you service or charge you differently for exercising these rights.

To exercise any of these rights, email info@sum28.com. In the p2d app you can also delete your account and its data directly (Account → Delete account). We will verify your request against the information we hold and respond within the timeframes the law requires. You may use an authorized agent to submit a request on your behalf.

Categories collected (CCPA). Across our products we collect identifiers (such as name, email, phone, account and device identifiers, IP address), commercial information (credits, plan, transaction records), internet activity (usage and server logs), and the content you provide (photos, notes, messages, feedback). We collect these for the business purposes described above and retain them as described under Retention. We do not collect sensitive personal information for the purpose of inferring characteristics.

Cookies

In the p2d web app we use exactly two cookies, both essential: a signed session cookie that keeps you logged in, and a signed device cookie (kept about one year) that helps us rate-limit the free preview and prevent abuse. The marketing site and the policy pages set no cookies. We use no analytics cookies, no advertising cookies, and no third-party trackers, and — because we do no cross-site tracking — we honor Global Privacy Control signals as opt-outs where applicable.

Retention

We keep personal information only as long as needed for the purpose it was collected, then delete or de-identify it. Server logs are kept about 30 days. Account data is kept while your account is active and removed when you delete your account (some records may be retained where required for legal, tax, or anti-fraud purposes). Open-house contact details are kept for as long as needed to deliver what was requested and for the hosting agent’s follow-up, then deleted or de-identified; the hashed consent record is retained as a tamper-evident proof of consent.

Security

We protect information with encryption in transit (TLS), network isolation of our databases, least-privilege access, hashed passwords and hashed anti-abuse identifiers, and vendor agreements that require appropriate safeguards. No method of transmission or storage is perfectly secure, but we design to hold as little as possible and to keep sensitive values one-way-hashed.

Children

Our products are built for real-estate professionals and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as our products evolve — notably before oak begins operating and before ohm’s public launch. We will revise the “Effective” date and version above and, for material changes, provide notice through the affected product.

Contact

Questions or privacy requests: info@sum28.com. General inquiries: hello@sum28.com. SUM 28 LLC, California, USA.