Data Management Policy
Last updated: October 22, 2026
Data is classified into four levels, handled according to its level, kept in the customer’s chosen region, and deleted when no longer needed.
Scope
All data created, collected or processed by Summerbase ApS, in any system or format. Customer Data, End Customers and Aggregated Data have the meanings given in the Summerbase Terms of Service.
Classification
| Level | Examples | Handling |
|---|---|---|
| Restricted | Customer data, personal data in the product, staff credentials, customers’ Third-Party Credentials (such as Stripe API keys), encryption keys | Encrypted, least-privilege access, logged access, region-locked, never in non-production without anonymization |
| Confidential | Source code, contracts, financials, employee records, security reports | Internal only, access by need, shared externally only under NDA |
| Internal | Internal docs, roadmaps | Employees and contractors only |
| Public | Website, marketing, public security page, published policies | No restrictions once approved for publication |
Policy
- Classification. Data owners classify data at creation; when unclear, treat it as the higher level.
- Data residency. Customer data stays in the region the customer selects: europe-west4 (Netherlands) for EU hosting, us-central1 (Iowa) for US hosting. This includes backups, logs containing customer data, and analytics. The only exception is Cloudflare, which processes traffic in transit across its global network, as disclosed in the DPA.
- International transfers. Transfers of personal data from the EU to third countries, including support access from outside the EU/EEA, rely on an adequacy decision (such as the EU–US Data Privacy Framework), Standard Contractual Clauses, or another GDPR Chapter V mechanism, documented in the transfer register.
- Non-production. Restricted data is not copied to development or test environments unless anonymized. Customer Data is never entered into Summerbase’s internal tools, such as support, chat, CRM, email, analytics or AI tools, unless the tool is listed as a sub-processor for Customer Data (Third-Party Management Policy). Analytics tool session recordings mask dashboard data, and report emails sent through Postmark contain no end-customer names or email addresses. If a tool must start receiving end-customer data, it is first added as a sub-processor with 10 days’ notice (Third-Party Management Policy). This rule does not cover Connected AI Clients that a customer connects through the MCP server or APIs: Summerbase makes data available to them on the customer’s instructions, and they are not sub-processors (Terms 4.5, DPA 1.2).
- Retention. Customer Data is kept for the contract term, then exported, returned and deleted within the periods set out in the Terms and the DPA. Account and billing data, including accounting records, are kept for the periods set out in the Privacy Policy. Logs are kept for the period set out in the Operations Security Policy.
- Deletion. Deletion requests from customers or data subjects are completed within 30 days, by deleting the data or irreversibly anonymizing it so that it can no longer identify any customer, End Customer or individual. Pseudonymized data is not treated as anonymized. Deletion and anonymization are done through documented procedures and recorded.
- GDPR roles. For customer data in the product, Summerbase is a data processor acting on the customer’s instructions under the DPA. For its own employee, marketing and billing data it is a controller.
- Data subject requests. Requests are handled by the privacy contact within the deadlines in GDPR Art. 12 (one month, extendable).