Legal · Draft 1.0
Summa aims to operate without advertising or cross-site tracking cookies. We use only technologies necessary to provide, secure and remember the service, unless optional technologies are introduced with a lawful consent mechanism.
Summa aims to operate without advertising or cross-site tracking cookies. We use only cookies or browser storage necessary to provide, secure and remember the service, unless optional technologies are introduced with a lawful consent mechanism.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| authjs.session-token | Cookie | Keeps you signed in and protects the session | 12 hours |
| authjs.csrf-token | Cookie | Prevents request forgery | Session |
| authjs.callback-url, authjs.state, authjs.pkce.code_verifier | Cookies | Complete a secure sign-in exchange | Short-lived |
| auth_flow | Cookie | Carries sign-in, two-factor and password-reset steps | Short-lived |
| active_tenant_id | Cookie | Remembers which workspace you selected | 30 days |
| NEXT_LOCALE | Cookie and local storage | Remembers your chosen language | 1 year |
| sidebar_state | Cookie | Remembers whether the sidebar is collapsed | 7 days |
| summa-theme | Local storage | Remembers light or dark appearance | Until cleared |
| summa.waitlist-draft.v1 | Session storage | Preserves an unfinished waitlist form | Until the tab closes |
The last four remember a choice you made yourself — language, appearance, layout, or an unfinished form. None of these technologies is used for advertising, profiling or cross-site tracking, and none is shared with a third party.
We measure how the public website is used so we can see which pages are useful and whether the site performs well. This measurement uses no cookies and stores nothing on your device, which is why you are not asked for consent for it: the rules on consent govern access to your device, and we do not access it.
Instead, our own servers record the page you requested, the response status, the referring website's domain name, and a coarse description of your device, browser and operating system. Your IP address is used only to derive a short-lived visitor code and is never stored. That code is produced with a secret key which is replaced and destroyed every day, so visits cannot be linked from one day to the next — by us or by anyone else. There is no profile, no advertising use, and no third party involved.
| What we record | Why | How long |
|---|---|---|
| Requested page and response status | See which pages are used and which are failing | Up to 90 days |
| Referring website domain | Understand where visitors come from | Up to 90 days |
| Device, browser and operating system category | Ensure the site works on real devices | Up to 90 days |
| Daily visitor code derived from IP address | Count visitors and visits without identifying anyone | Up to 90 days; the key is destroyed daily |
| Page performance measurements | Detect slow pages for real visitors | Up to 90 days |
After 90 days the detailed records are deleted and only daily totals remain. Because no stored value can be linked back to a person once the daily key is destroyed, these statistics cannot be tied to an individual and therefore fall outside data subject access and erasure requests. Our lawful basis for this limited processing is legitimate interest.
Pages inside your account — the chat, settings and administration areas — are excluded from website statistics entirely.
Summa does not activate privacy-invasive analytics, marketing, profiling or tracking technologies without valid prior consent. We do not use advertising cookies, cross-site tracking, session recording or heatmaps. Should any optional technology be introduced, it will remain disabled until consent is given, rejection will be as easy as acceptance, refusal will not block the core service, consent can be withdrawn at any time, and this notice will identify the providers, purposes and durations.
The website loads no third-party scripts, fonts, or content delivery networks. Typefaces are served from our own servers, so loading a page sends no request to any outside provider and no outside provider receives your IP address.
Blocking necessary cookies may prevent login or other essential functionality.