PRIVACY AND DATA PROTECTION
Your information,
handled with purpose.
VERSION 2026-09-13
1. Who is responsible
Summum Editor is an independent platform operated by Dennis N'Gaide in the Netherlands. Dennis N'Gaide is the data controller for the processing described in this notice.
2. Information we process
- Account data: user ID, email address, display name, chosen sign-in provider, account status, policy versions accepted, and acceptance timestamps.
- Learning and membership data: course access, plan and subscription status, lesson progress, and related account preferences.
- Waitlist data: first name, email, editing level, interests, source, campaign parameters, referring page, consent record, and unsubscribe status.
- Activity and security data: first and last activity times, sign-in count, provider, access role, security events, and a short-lived cryptographic hash derived from connection information for rate limiting. The application does not keep the raw connection address in its rate-limit database or use this information for unrelated advertising.
- Connected Discord account: immutable Discord user ID, granted scopes, authorization timestamp, join and role status, and encrypted server-side OAuth token material where needed to complete an authorized join or refresh. Disconnecting or revoking authorization stops further authorized joins; relevant service or legal records may still need to be retained.
- Community data: creator name, preset listing details, uploaded files, moderation status, and information needed to handle reports or ownership disputes.
- Email delivery data: message type, delivery status, provider message ID, attempts, and unsubscribe information.
- Support and legal requests: correspondence and the information you provide when requesting help or exercising a legal right.
We do not intentionally request sensitive personal data such as health, biometric, political, or religious information.
3. Why we use information
| Purpose | Typical legal basis |
|---|---|
| Create and secure accounts, provide courses, community features, uploads, and requested services | Taking steps at your request and performing the agreement with you |
| Send sign-in links, confirmations, purchase messages, important service changes, security alerts, and support replies | Performance of the agreement, legal obligations, and legitimate interests in operating a secure service |
| Send launch news, events, competitions, resources, and promotional community updates | Your separate, optional consent, with an unsubscribe option in every marketing message |
| Prevent fraud, spam, unsafe uploads, paywall bypass, and unauthorised administrative access | Legitimate interests in protecting users, creators, and the platform |
| Maintain financial, tax, dispute, and compliance records for paid services | Legal obligations and the establishment or defence of legal claims |
4. Email rules
Accepting the Terms does not subscribe you to marketing. The marketing checkbox is optional and is not preselected. We may contact account holders without marketing consent only for messages needed to deliver or protect the service, including authentication, confirmations, receipts, material policy or service changes, security, moderation, support, and account administration.
Waitlist and promotional campaigns are sent only to people with a recorded marketing consent who have not unsubscribed. Each marketing email includes a free, direct unsubscribe method. Withdrawing marketing consent does not affect essential account messages.
5. Service providers and disclosures
We use carefully selected service providers for authentication, hosting, structured storage, email delivery, optional connected-account sign-in, community access, payment processing, seller onboarding, fraud prevention, file security scanning, and transaction records. The specific provider involved is shown when you choose that integration or checkout.
We share only information needed for the service, legal compliance, safety, or a properly safeguarded business transfer. We do not sell or rent contact lists.
6. International transfers
Some providers may process information outside the European Economic Area. Where this occurs, we rely on the transfer safeguards made available by the provider, such as an adequacy decision or Standard Contractual Clauses, where applicable.
7. Retention
- Active account and learning data is kept while the account is used. After account closure, it is deleted or anonymised within 24 months unless a shorter period is requested or a longer period is legally required.
- Waitlist details are kept until you unsubscribe, the waitlist purpose ends, or the information becomes outdated. Suppression and consent evidence may be retained for up to five years after the last relevant marketing message to demonstrate compliance and prevent accidental re-subscription.
- Authentication, activity, and security records are normally kept for up to 24 months, unless they are needed longer for an active investigation or legal claim. Short-lived rate-limit counters expire automatically after their abuse-prevention window.
- Email delivery logs are normally kept for up to 24 months. Financial records are kept for the applicable statutory period.
- Community content remains until removed by you or Summum Editor, subject to backups, disputes, moderation, and legal obligations.
8. Your rights
Send requests to privacy@summumeditor.net. Include the account email and the right you want to exercise. Do not send passwords, card numbers or identity documents unless a secure, proportionate verification process is specifically arranged. Requests are handled separately from marketing choices.
Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. We may request reasonable identity verification before acting on a request and normally respond within one month.
You may complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or another competent supervisory authority.
9. Security and data minimisation
We use authenticated access, role checks, server-side permission checks, encrypted connections, restricted administrative tools, provider secrets stored outside public code, and purpose-limited databases. No online service can promise absolute security, but we review access and minimise the information collected.
11. Children
Accounts are intended for people aged 16 or older. A person under 16 may use the service only with verifiable permission and supervision from a parent or legal guardian.
12. Changes
Material changes will be shown on the website or sent as an essential service notice. If a change requires new consent, access will remain limited until that consent is given. The version and effective date at the top identify the notice that applies.