Privacy Policy

The short version

We built Summit to make standups better, not to harvest your data. This policy explains what we collect, why we collect it, and how we keep it safe. We've written it in plain English on purpose.

Summit is a voice-first standup tool. That means we handle audio recordings, transcriptions, and some team metadata. We take that seriously.

What we collect

When you use Summit, we collect the minimum data needed to make the product work:

• ·Account info: your name, email address, and username.
• ·Audio recordings: the voice updates you record during standups. These are stored securely and only accessible to members of your team.
• ·Transcripts: text generated from your audio by our transcription provider. Stored alongside your recording.
• ·Team data: team names, member lists, and standup cadence settings.
• ·Usage data: when you record, how long recordings are, which features you use. This helps us improve the product.
• ·Device info: OS version, app version, and crash logs. Used only for debugging.

We do not collect payment information directly. Billing is handled by Stripe, subject to their own privacy policy.

Audio storage

Your audio is the heart of Summit. Here's exactly how it's handled:

• ·Recordings are encrypted in transit using TLS and at rest using AES-256.
• ·Audio files are stored on Cloudflare R2, a zero-egress-fee object storage service with strong security defaults.
• ·Only authenticated members of your team can access your recordings.
• ·You can delete any of your recordings at any time from the app. Deletion is permanent.
• ·If you delete your account, all your audio is deleted within 30 days.

Transcription

Summit uses AssemblyAI to transcribe your voice recordings into text. When you post a standup, your audio is sent to AssemblyAI's API for transcription. The resulting transcript is stored in our database alongside your recording.

AssemblyAI processes audio under their own data processing agreement and does not use your audio to train their models without explicit consent. You can read their privacy policy at assemblyai.com.

Transcripts are searchable by your team members. That's the whole point. They are not visible to Summit employees or third parties.

Third-party services

We use a small, carefully chosen set of third-party services to operate Summit:

• ·AssemblyAI: speech-to-text transcription. Audio is sent to their API and returned as a transcript. assemblyai.com
• ·Cloudflare R2: audio file storage and delivery. cloudflare.com
• ·Slack: optional integration for posting standup summaries to a channel. You control when and whether this is enabled. slack.com
• ·Stripe: payment processing. We never see your full card details. stripe.com
• ·Resend: transactional email (receipts, team invites, early access updates). resend.com

We do not sell your data to advertisers. We do not use your data for advertising of any kind. We do not share your data with any party not listed above.

Slack integration

If you connect Summit to Slack, we'll post a standup summary to a channel you choose when a team member posts their update. Here's what that means:

• ·We store your Slack workspace token to make posts on your behalf.
• ·We only post to channels you explicitly authorize.
• ·You can disconnect Slack at any time from Settings. Disconnecting removes your token immediately.
• ·We do not read your Slack messages or access any data beyond the channel we post to.

How long we keep your data

We keep your data for as long as your account is active. Here are the specifics:

• ·Audio and transcripts: kept indefinitely while your account is active. You can delete individual recordings anytime.
• ·Account data: deleted within 30 days of account deletion.
• ·Usage logs: anonymized and retained for up to 12 months for product analytics.
• ·Crash logs: retained for 90 days.

Your rights

Depending on where you are, you may have the right to access, correct, export, or delete your personal data. We honor all of these.

• ·Access: request a copy of your data at any time.
• ·Correction: update your profile info in Settings.
• ·Deletion: delete your account and all associated data from Settings > Delete Account.
• ·Export: email us at privacy@summit.app and we will export your data within 30 days.
• ·Opt-out: you can opt out of product analytics emails at any time.

For any requests, email us at privacy@summit.app. We respond within 5 business days.

EU residents (GDPR)

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) applies to your data. Our legal basis for processing your personal data is as follows:

• ·Contract performance: processing your account data and recordings is necessary to provide the Summit service.
• ·Legitimate interests: usage analytics and crash logs help us improve the product without overriding your rights.
• ·Consent: marketing communications (e.g. waitlist updates) are sent only when you have explicitly opted in.

Under GDPR you have the right to: access your data, correct inaccuracies, request erasure (right to be forgotten), restrict or object to processing, and data portability. To exercise any of these rights, email privacy@summit.app. We will respond within 30 days.

We do not transfer personal data outside the EEA without adequate safeguards. Our sub-processors that operate outside the EEA (AssemblyAI, Cloudflare, Resend) are covered by Standard Contractual Clauses or equivalent mechanisms.

You have the right to lodge a complaint with your local data protection authority.

Canadian residents (CASL)

If you are located in Canada, Canada's Anti-Spam Legislation (CASL) governs how we send commercial electronic messages (CEMs) to you.

• ·We only send marketing or promotional emails when you have given explicit, opt-in consent, for example by checking the consent box on our waitlist form.
• ·Every marketing email includes a clear and functional unsubscribe mechanism. Unsubscribe requests are honored within 10 business days.
• ·Transactional messages (team invites, password resets, billing receipts) are sent under implied consent as they relate directly to a transaction you initiated.

To withdraw consent or unsubscribe from any commercial messages at any time, email privacy@summit.app or use the unsubscribe link in any marketing email.

Cookies

Summit uses only essential cookies and localStorage to keep you signed in and remember your preferences (such as cookie consent). We do not use tracking, advertising, or analytics cookies.

• ·Authentication session: keeps you logged in. Expires when you sign out or after 30 days of inactivity.
• ·Cookie consent preference: records your accept/reject choice so the banner is not shown again.

Because we use only strictly necessary cookies, we do not require consent before setting them under the ePrivacy Directive. However, we still show a consent banner to give you a clear, informed choice.

Questions?

If you have any questions about this policy or how we handle your data, reach out anytime at privacy@summit.app.

We're a small team and we read everything.