Summit Privacy notice
Effective from 1 November 2026
This notice explains which personal data Summit processes about you as a user, why, and what your rights are.
Who is responsible
Summit is provided by Around Us B.V., Veemarkt 110, 1019 DE Amsterdam, the Netherlands. Chamber of Commerce (KvK) number 57043388, VAT number NL852415205B01. Around Us B.V. is responsible for processing your personal data as described in this notice. In this notice, "we" and "us" means Around Us B.V.
Do you have a question about privacy, or do you want to exercise your rights? Email support@getsummit.eu.
Data about your clients
The data you store in Summit about your own clients (names, contact persons, addresses, invoices) is yours. For that data, your company is the controller and we only process it on your behalf, under the processing agreement in Appendix A of our Terms of service. If you are one of our customers' clients and have a question about your data, please contact the company that invoiced you.
What we process, why, and on what basis
| What | Why | Basis |
|---|---|---|
| Name, email address, password (stored only as a secure hash), profile photo, app language | Creating and running your account | Contract |
| Company details: name, address, KvK and VAT number, bank details, logo, invoice settings | Running Summit and putting your details on your invoices | Contract |
| Role in your company, invitations you sent or accepted | Managing members and access | Contract |
| Plan, payments and billing details | Billing you and keeping our own records | Contract and legal obligation (tax law) |
| Emails we send you (sign-in links, invitations, weekly invoice report, account notices) and their delivery status | Running your account and informing you | Contract |
| IP address, browser details and sign-in history | Securing Summit: preventing abuse, bots and break-ins | Legitimate interest |
| The country your IP address points to | Pre-filling your country when you set up your company | Legitimate interest |
| Messages you send to support, with your account and company details and the page you were on | Answering your question | Contract |
| Error reports | Finding and fixing errors | Legitimate interest |
| Product usage: which features are used (for example "invoice issued"), linked to a random user ID, without names, email addresses or amounts | Understanding how Summit is used, to improve it | Legitimate interest |
| Pseudonymous statistics: sign-up and stop dates, plan, payment days and amounts, country | Counting sign-ups, conversion and churn, also after an account is deleted | Legitimate interest |
Where we rely on legitimate interest, we have weighed it against your privacy and limited the data to what's needed. You can object (see "Your rights").
We don't sell your data, don't use it for advertising, and don't make automated decisions about you that have legal effects.
Who we share it with
We use the following services to run Summit. They process data only on our instructions, under a processing agreement:
| Service | What for | Location |
|---|---|---|
| Supabase | Database, file storage and sign-in | Frankfurt, Germany |
| Vercel | Hosting of the application | Frankfurt, Germany |
| Railway | Creating invoice PDFs | Amsterdam, the Netherlands |
| Resend | Sending emails | Ireland |
| Upstash | Rate limits against abuse | Frankfurt, Germany |
| Cloudflare (Turnstile) | Telling people and bots apart at sign-up and sign-in | Worldwide network |
| Sentry | Error monitoring | Frankfurt, Germany |
| PostHog | Product usage statistics | Frankfurt, Germany |
Mollie handles payments for your plan. Mollie is a licensed payment institution and processes your payment details under its own responsibility; see Mollie's privacy statement.
We share data with authorities only when the law requires it.
Where your data is processed
We store and process your data in the EU. Some of these services belong to companies based in the United States (Vercel, Resend, Upstash, Cloudflare, Sentry, PostHog). Where data could be accessed from outside the EU, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Your account: as long as it exists. After the owner deletes the account, we permanently delete the company's data after 14 days.
- Inactive accounts: deleted 3 months after a trial ends without a paid plan, or 12 months after an account became read-only. We email the owner at least 30 days beforehand.
- Our invoices to you and payment records: 7 years, because tax law requires it.
- Pseudonymous statistics: kept after deletion, without names or contact details and no longer linked to your account's ID.
- Product usage data: deleted when your account is deleted.
- Rate-limit counters: at most 24 hours.
- Technical records needed to complete a deletion: at most 30 days.
- Error reports and server logs: at most 90 days.
Cookies
Summit only uses cookies that are needed for it to work: to keep you signed in, to remember an invitation you are accepting, and for the bot check at sign-up and sign-in. We don't use cookies for advertising or tracking, so we don't ask for cookie consent.
Your rights
You can ask us to access, correct or delete your data, to restrict its use, or to hand it over in a common format. You can also object to processing based on legitimate interest, such as product usage statistics. Most of your data you can view and change yourself in Summit. For anything else, email support@getsummit.eu. We respond within one month.
If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
We update this notice when Summit changes. The date at the top shows the current version. We tell you about important changes by email.