Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, profile picture, and authentication credentials (including via third-party login providers such as GitHub or Google).

Usage Data

We automatically collect information about how you use the Platform, including pages visited, features used, session duration, browser type, device information, IP address, and referring URLs.

Code & Projects

We store the code, project files, configurations, and related content you create or upload to the Platform. This is necessary to provide our AI code building and hosting services.

Marketplace Work Records

For developer engagements, we collect work pack records such as accepted scope, task status, session history, messages, approval events, payment status, dispute events, repository references, and developer-client interaction metadata.

Repository Integration Data

When you connect GitHub or another code host, we may collect repository names, branch names, fork references, commit references, pull request references, permission scopes, and related metadata needed to operate the integration. We request only the access needed for the features you choose to use.

Payment Information

Payment details (credit card numbers, billing addresses) are collected and processed by our payment processor, Stripe. We do not store full payment card details on our servers.

Communications

We collect messages sent through our Platform's communication features, including chat messages between clients and developers, support requests, and feedback.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform and its features.
• Process transactions and manage your account.
• Power AI code generation and assistance features.
• Match clients with developers in the marketplace.
• Send you transactional communications (receipts, account updates, security alerts).
• Send marketing communications (with your consent; you can opt out at any time).
• Detect, prevent, and address fraud, abuse, and security issues.
• Analyze usage patterns to improve the Platform experience.
• Comply with legal obligations.

3. AI Processing Disclosure

Important: When you use SUMMON's AI features, your code and project context are sent to third-party AI providers for processing. Currently, our primary AI provider is Anthropic (Claude). We may also use other AI providers.

Key details about AI processing:

• Code snippets and project context are transmitted to AI providers to generate responses.
• We send the minimum context necessary to provide useful AI assistance.
• AI providers are contractually prohibited from using your data to train their models (where such agreements are available).
• AI-generated outputs may not be unique and similar outputs may be generated for other users.
• We recommend not including sensitive secrets, API keys, or credentials in code processed by AI features.

4. Third-Party Services

We use the following third-party services that may process your data:

• Supabase: Database hosting, authentication, and real-time services.
• Vercel: Platform hosting and deployment infrastructure.
• Stripe: Payment processing and billing management.
• GitHub: Authentication, code repository integration.
• Anthropic: AI model provider for code generation features.

Each third-party service operates under its own privacy policy. We encourage you to review their policies.

5. Audit Logs & Verification Records

SUMMON maintains audit logs to support marketplace trust, security, dispute review, fraud prevention, payment review, and project accountability. These logs may connect a developer, client, project, work pack, repository event, approval, and payment event.

For some engagement events, SUMMON may create cryptographic hashes, timestamps, or smart-contract verification receipts. These records are designed to verify that a private event or agreement existed without publishing the underlying private code, messages, payment details, or client business information.

Public verification records may include limited metadata such as a timestamp, hash, transaction identifier, or status. They should not include raw source code, secrets, private messages, full payment details, or sensitive project content.

6. Cookies & Tracking

We use cookies and similar technologies to:

• Maintain your session and authentication state.
• Remember your preferences and settings.
• Analyze Platform usage and performance.
• Provide relevant content and features.

You can control cookies through your browser settings. Disabling cookies may affect Platform functionality.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Account data: Retained until you delete your account.
• Project data: Retained until you delete the project or your account.
• Usage logs: Retained for up to 24 months.
• Payment records: Retained for 7 years as required by tax and financial regulations.
• Marketplace work records: Retained for up to 7 years where needed for payment, dispute, fraud prevention, tax, legal, or audit purposes.
• Verification records: Cryptographic hashes, timestamps, or smart-contract receipts may persist because blockchain or distributed ledger records may not be deletable.
• AI interaction logs: Retained for up to 90 days for debugging and service improvement, then anonymized or deleted.

After account deletion, we will remove your personal data within 30 days, except where retention is required by law.

8. Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest.
• Regular security audits and vulnerability assessments.
• Access controls and authentication for internal systems.
• Incident response procedures.

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your personal data and account.
• Export: Request a portable copy of your data (including project code).
• Opt-out: Unsubscribe from marketing communications at any time.

To exercise these rights, contact us at privacy@unstucklabs.com. We will respond within 30 days.

10. Children's Privacy

SUMMON is available to users aged 13 and older. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal data, please contact us at privacy@unstucklabs.com.

11. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Opt out of the sale of personal information. We do not sell your personal information.
• Non-discrimination for exercising your privacy rights.

To submit a request, email privacy@unstucklabs.com with "CCPA Request" in the subject line.

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the GDPR, including:

• Right to access, rectification, erasure, and data portability.
• Right to restrict or object to processing.
• Right to withdraw consent at any time.
• Right to lodge a complaint with your local data protection authority.

Our legal basis for processing your data includes: performance of a contract (providing the Platform), legitimate interests (improving our services, security), and consent (marketing communications).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the effective date. We encourage you to review this policy periodically.

14. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us at:

Unstuck Labs LLC
Arlington, VA
Email: privacy@unstucklabs.com