Privacy Policy

1. Data Controller

Summito is the data controller for personal data collected through this platform. Contact us at privacy@summito.com for any privacy-related inquiries.

2. Data We Collect

• Account information: name, email address, profile photo, password (hashed)
• Profile information: bio, location, website, social media links
• Collections: cards, binders, decks, and associated metadata
• Content: posts, comments, reactions, messages
• Usage data: page views, interactions, preferences
• Payment data: Stripe customer ID (we do not store full payment details)

3. Legal Basis for Processing

We process your data based on: (a) your consent (for marketing emails, cookies); (b) contract performance (account creation, collection management); (c) legitimate interests (platform security, fraud prevention, service improvement).

4. Data Processors

We use the following third-party data processors who have entered into Data Processing Agreements with us: Vercel (hosting), Neon (database), Azure/Microsoft (cloud services, blob storage, service bus, functions), Stripe (payments), Resend (email), Upstash (caching, search), Pusher (real-time notifications), Google Analytics (usage analytics).

5. Your Rights

Under GDPR you have the right to: access your data (Settings → Export Data), rectify inaccurate data, erase your data (Settings → Delete Account), restrict processing, data portability, and withdraw consent at any time.

6. Data Retention

We retain your personal data for as long as your account is active. After account deletion, most data is immediately deleted. Anonymized records may be retained for legal compliance. Email logs are purged after 90 days. Session tokens expire automatically.

7. Contact

For privacy inquiries or to exercise your rights, contact us at privacy@summito.com. You also have the right to lodge a complaint with your local data protection authority.