Privacy Policy

Summone Limited is a company registered in Scotland, company number SC324228. Our registered office is Flat 0/1, 16 Springfield Gardens, Glasgow, G31 4JD, Scotland.

ICO registration number: ZC123116

For anything about your data, email steven@summone.co.uk.

• Your account: your first name, email address and password. Your password goes to our sign-in provider, Supabase. We don't keep it in our own records.
• Your business details: the business name, website address, town or area, industry, services and any competitors you enter when you run a check.
• Your check results: the questions we ask AI tools, the answers they give, the sources they cite, the businesses they name, what we find on your website, and the score, fixes and content ideas we give you. We save all of this as your report.
• Your plan and payments: whether you are on Free or Pro, your Stripe customer and subscription references, the status of your subscription and its billing dates. Stripe takes your card details on its own payment page. We never see or store your card number.
• How you use SummAEO: when you sign in and out, how long you stay signed in, which pages and report tabs you open, when you download a PDF, and when a check starts, finishes or fails. With these we record your IP address and your browser's user agent (the line that says which browser and device you are using).
• Messages you send us: if you email us, we keep the email so we can deal with it.

• To provide SummAEO to you (to perform our contract with you): running your account, your checks and your reports, taking payment for Pro, and applying the limits of your plan.
• To keep SummAEO working and improve it (our legitimate interests): the usage records above, alerts to us when a check fails, stopping misuse, and working out what to fix or build next.
• To meet our legal duties (legal obligation): for example, keeping payment records for tax.

We don't sell your data, and we don't use it for advertising.

We can see your reports and usage records. We look at them to help you, to fix problems and to improve SummAEO.

We use these companies to run SummAEO. Each gets only what it needs to do its job for us.

• Supabase (database and sign-in). Stores your account, business details, reports, plan details and usage records. Our database is hosted in Ireland (EU).
• Vercel (hosting). Runs the app, so every page you open and everything you send passes through Vercel, including your IP address. Our server code currently runs in Vercel's data centre in Washington, D.C., in the United States.
• Resend (email delivery). Sends your sign-up confirmation and password reset emails, so it receives your email address and the content of those emails.
• Stripe (payments). When you go Pro we send Stripe your email address and your account reference. Stripe collects your card details directly.
• OpenAI (ChatGPT). Writes the questions for your check, answers them using web search, and writes your fixes, content ideas and report summary. For this we send OpenAI your business details and your check results. At the moment these requests also include your account email address, because it is saved with your business details.
• Perplexity. Answers the check questions, and one question to find competitors near you. We send the questions, which include your service, industry and area but not your business name or website.
• Google (Gemini). Answers the check questions using Google Search. We send the questions only.
• SerpApi. Runs the check questions on Google Search so we can read Google's AI Overview (and AI Mode, when we have it switched on). We send the questions and your country.
• Telegram (alerts to our own team). When a check fails or comes back incomplete, or we can't count your checks, we send ourselves a Telegram message. It includes your business name, your account email address, the error and, for an incomplete check, a link to your report. Only you and we can open that link.
• Google Fonts. Our public home page loads its font from Google, so Google receives your IP address and browser details when you open that page.

We will also share data if the law requires us to.

To check your website, our server opens your home page, your robots.txt file and your sitemap, the same way a search engine would. We read what is publicly there. We don't log in or fill in any forms.

The answers AI tools give often name other businesses. We save those names as part of your report.

Some of the companies above are based in, or handle data in, the United States: Vercel, Resend, Stripe, OpenAI, Perplexity, Google and SerpApi. Telegram is also based outside the UK.

When personal data leaves the UK, we rely on the protections UK law allows. These are the UK-US data bridge, where the company is certified under it, or the company's standard contractual clauses with the UK International Data Transfer Addendum.

SummAEO only uses cookies to keep you signed in. Our sign-in system (Supabase) sets them on our own site when you sign in (their names start with "sb-"). The app can't work without them, so we don't ask for consent.

We don't use analytics cookies, advertising cookies or third-party tracking scripts. The usage records described above are kept in our own database.

The check form saves what you type in your browser's local storage, so it is still there if you leave and come back. It stays on your device. When you start a check, your details are briefly held in your browser's session storage to pass them to the next page.

When you pay, you are on Stripe's own checkout page, where Stripe sets its own cookies, for example to prevent fraud. See Stripe's privacy policy.

We keep your account, business details, reports, plan details and usage records for as long as your account is open. Nothing is deleted automatically.

If you ask us to delete your account, we will delete it and the data linked to it within 30 days. The exception is anything the law says we must keep, such as payment records for tax. Stripe keeps its own payment records under its own privacy policy.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data;
• limit how we use it, or stop using it where we rely on our legitimate interests;
• give you your data in a format you can take elsewhere.

To do any of these, email steven@summone.co.ukfrom the address on your account. It's free, and we will reply within one month.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

SummAEO is for businesses. It isn't meant for anyone under 18.

If we change this policy, we will update this page and the date at the top. If a change is significant, we will also email you.

See also our Terms of Service.