--- title: "Privacy Policy · Sommet" meta: "og:description": "How Sommet collects, uses and protects personal data, your rights under the GDPR, and how we handle data from Google APIs." "og:title": "Privacy Policy · Sommet" "twitter:description": "How Sommet collects, uses and protects personal data, your rights under the GDPR, and how we handle data from Google APIs." "twitter:title": "Privacy Policy · Sommet" description: "How Sommet collects, uses and protects personal data, your rights under the GDPR, and how we handle data from Google APIs." --- Legal # Privacy Policy Last updated October 12, 2026 This policy explains which personal data Sommet processes, why, for how long, who receives it and how you can exercise your rights. ## 1. Data controller The controller of the personal data described in this policy is Geoffroy Stanger, who operates Sommet. For any question about your data, write to contact@sommet.dev. ## 2. Data we collect Account data: your name, email address, password (stored only as a hash) and, if you sign in with Google or GitHub, the identifier and profile information that provider shares with us. Session and security data: the IP address and browser user agent of your sessions, with their dates. Workspace content: the domains, brand names, competitors, questions, notes and settings you enter, and the results Sommet produces from them. Data from services you connect: search performance data from Google Search Console or Bing Webmaster Tools, and AI crawler visits from Cloudflare or a log drain. For AI crawler visits we keep only the crawler identified, the day and the request identifier; every other field of the log line, including visitor IP addresses, is discarded. Connected AI assistants: when you connect an AI assistant such as ChatGPT or Claude through the MCP server, Sommet stores the name the assistant registers with, the permissions you grant it and its access tokens. The assistant then reads, and if you allow it changes, your workspace data when you ask it to. Sommet does not receive your conversations with the assistant, only the requests it sends to Sommet. You can disconnect an assistant at any time in Settings → AI assistants, which revokes its access immediately. Billing data: your plan, subscription status, invoices and the Stripe customer identifier. Card details are collected and stored by Stripe; Sommet never receives them. Email data: the emails we send you, their delivery status and your email preferences, and the messages you send us. ## 3. Purposes and legal bases To provide the Service you subscribed to, manage your account, run your trial or plan, and send the emails the Service needs (verification, alerts, billing): performance of the contract (article 6(1)(b) GDPR). To bill, keep accounting records and meet our tax obligations: legal obligation (article 6(1)(c) GDPR). To secure the Service, prevent abuse and fraud, and fix errors: our legitimate interest in operating a secure and reliable Service (article 6(1)(f) GDPR). To send you news about the features of Sommet as a customer: our legitimate interest, in line with article L34-5 of the French Postal and Electronic Communications Code. You can unsubscribe at any time from the link in each email or from your settings. ## 4. Recipients and sub-processors Your data is accessible only to Sommet and to the following providers, each for its own task and under a contract that protects your data: Hostinger (hosting of the servers and database of Sommet); Stripe (payments, subscriptions and invoices); Resend (sending emails); OpenAI (analysis of collected AI answers and the evidence assistant: workspace content and connected search data may be sent for these features); DataForSEO (collection of AI assistant answers to the questions you track); Google and GitHub (sign-in, if you choose them). Services you connect yourself, such as Google Search Console, Bing Webmaster Tools, Cloudflare, Vercel or an AI assistant through the MCP server, exchange data with Sommet on your instructions and under their own privacy policies. Some of these providers are located outside the European Union, in particular in the United States. Those transfers rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the standard contractual clauses adopted by the European Commission. We do not sell your data, and we do not use it for advertising. ## 5. Google user data This section describes how Sommet accesses, uses, stores, shares and deletes the data it receives from Google APIs. Sommet asks for Google access only when you choose to sign in with Google or to connect Google Search Console. Data accessed with Google sign-in: if you sign in with Google, Sommet receives your name, email address, profile picture and Google account identifier (scopes openid, email and profile). Data accessed with Google Search Console: if you connect Google Search Console, Sommet requests read-only access to your Search Console data (scope webmasters.readonly). It reads the list of the properties your Google account can access and, for the properties you choose, their search performance data: queries, pages, clicks, impressions, click-through rates and average positions. Sommet never modifies your Search Console properties or settings, and does not access any other Google data such as your emails, files or contacts. How Sommet uses this data: sign-in data is used only to create your account, sign you in and contact you about the Service. Search Console data is used only to provide the features you see in Sommet: showing the search performance of your pages, comparing it with the answers of AI assistants, and producing recommendations for your sites. It is not used for any other purpose. How Sommet stores this data: Google user data and the access tokens Google issues to Sommet are stored in the database of Sommet, on servers hosted by Hostinger. Data is encrypted in transit, access to production systems is restricted to the operator of Sommet, and the tokens are used only to call the Google APIs on your behalf. How Sommet shares this data: Google user data is never sold and never shared with advertisers, data brokers or information resellers. It is shared only with the providers needed to run the features you use: Hostinger, which hosts the servers and database; OpenAI, which receives the Search Console data needed to generate the analyses and answers you request, through its API, under terms that do not allow it to use that data to train its models; and an AI assistant you connect yourself through the MCP server, which reads your workspace data at your request. It may also be disclosed when the law requires it. Limited Use: Sommet's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is used only to provide and improve the user-facing features of Sommet; it is not used for advertising, not used to train generalised AI or machine learning models, and not read by humans except with your consent, for security purposes, to comply with the law, or when aggregated and anonymised for internal operations. Retention and deletion: Search Console data and Google tokens are kept as long as the connection is active and your account is open. You can disconnect Google Search Console in Sommet at any time, and revoke the access of Sommet from your Google account permissions page (myaccount.google.com/permissions). Imported Search Console data is deleted when you delete the workspace or your account, within 30 days of the closure of your account, or earlier on request at contact@sommet.dev. ## 6. Retention Account data and workspace content are kept as long as your account is open, then deleted within 30 days of its closure. Session records are kept until the session expires or you sign out. Invoices and accounting records are kept for 10 years, as required by article L123-22 of the French Commercial Code. Email delivery data is kept for as long as needed to send the emails and handle bounces and unsubscribes. ## 7. Cookies Sommet uses only cookies and local storage that are strictly necessary: the session cookie that keeps you signed in, a cookie that remembers the language of the site, and the theme you choose. They do not require your consent. Sommet uses no advertising or analytics cookies and no third-party trackers. ## 8. Security Connections are encrypted, passwords are stored only as hashes, session cookies cannot be read by scripts, the API keys you store for connected services are encrypted, and access to production systems is restricted. ## 9. Your rights Under the GDPR and the French Data Protection Act, you have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to give instructions on what happens to your data after your death. To exercise these rights, write to contact@sommet.dev. We answer within one month. We may ask for proof of identity if we have a reasonable doubt about it. If you believe your rights are not respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr. ## 10. Changes to this policy We may update this policy. The date at the top of the page shows the latest version, and we will inform you by email of any material change. [Terms](https://sommet.dev/terms) [Legal notice](https://sommet.dev/legal)