Privacy notice

Who we are

Summ Base is run by Consultblue Ltd, a company registered in England and Wales, registered with the Information Commissioner's Office under number C1910715. We are the data controller for everything described here. You can reach us at hello@summbase.co.uk.

If you are a woman using Summ Base

Your account. We hold your personal email address, encrypted, so you can sign in without a password. We hold what you choose to keep in your space: your check-ins, your saved scripts and requests, your bookings, and which employers you have connected. We use these only to run your space for you. Your employer cannot see any of it, and cannot see that you have an account.

Your health. What you record about how you feel is information about your health. We hold it only because you choose to keep it in your space, and you can delete any check-in, or your whole account, at any time. We never use it to diagnose, and we never share it with anyone.

Your answers to your employer's round. When you take part in a round, a copy of your answers is written to a separate database with no name, no email, no account id and no time of day, only a date. It cannot be traced back to you, by us or by anyone else. Your employer only ever sees totals from groups of at least 10 people, rounded. Because nothing links those answers to you, they cannot be withdrawn once they are counted.

Free text. If you write something in your own words, it is automatically redacted for names, numbers and links, read by a member of Summ Base staff, and shown to your employer only as a theme. If what you write suggests you are at immediate risk, we cannot contact you, because we do not know who wrote it. The screen tells you this before you type.

Bookings. If you book a named service through Summ Base, the organiser receives a booking code and the nickname you chose. Nothing else.

Asking your employer to join. If you ask us to tell your employer about Summ Base, we send them a message once at least three people have asked, or after 60 days, saying that people at the organisation have asked. Never your name.

How long. Your account and everything in it stay until you delete them. If you have not signed in for 24 months we email you a warning first, then delete the account if you do not sign in. Deleted accounts are not restored from backups.

If you work for an employer that uses Summ Base

Your employer gives us your name, work email and role so you can sign in. We hold an audit log of what employer users do: sign-ins, changes to setup, exports. We use these to run the service and to keep the promise to women. We keep them while the licence runs and for 24 months after.

If you ask for a demo

We collect your name, work email, organisation, job title, organisation size and sector, and use them to reply and arrange a demo. Our lawful basis is legitimate interests: you asked us to get in touch. We do not use these details for marketing and we do not sell or share them. We keep them for up to 24 months from your last contact with us.

Where your information is held

Summ Base runs on Cloudflare, and every database is created in the European Union jurisdiction. Our website is hosted by Vercel. We send email through Resend. Employer payments are handled by Stripe, and Summ Base never sees card details. The demo form is protected by Cloudflare Turnstile. Each of these acts on our instructions under a written agreement. Before an organisation goes live, where its data is held is agreed with it in writing and named in a data protection impact assessment.

How it is kept apart

Who you are, what employers set up, and what women answered live in three separate databases, read by three separate services. No single system holds both who she is and what she said. The service that reads answers cannot receive an account id, and employers only ever read published totals.

Your rights

• See what we hold about you. In your space you can download your whole record at any time.
• Correct it, or ask us to.
• Delete it. In your space, deletion is immediate and complete.
• Object to our using it, or ask us to restrict it.
• Complain to the Information Commissioner's Office at ico.org.uk if you are not happy with our answer.

Email hello@summbase.co.uk for anything you cannot do yourself and we will reply within one month. Any time a member of Summ Base staff looks at a member record to help with a request, it is logged.

Cookies

Summ Base sets cookies to keep you signed in, to open the pages that are not public, and to stop spam on its forms. Nothing else, and no analytics or tracking anywhere a woman signs in or answers.

Cookies we set

• sb_member, sb_employer, sb_admin. Your sign-in, one for each kind of account, so a cookie for one can never open another. HttpOnly and secure. Women's sessions last 30 days; staff sessions one day.
• sb_pending_employer, sb_pending_admin. Ten minutes, while a two-factor code is entered.
• sb_gate. On test sites only, to remember the access password.

Cookies set by others

The sign-up and enquiry forms use Cloudflare Turnstile to tell people from scripts. It may set its own cookie while the check runs. No other third party sets anything.

What we do not do

No analytics or tracking scripts load anywhere a woman signs in or answers. At present none load on the public pages either. If that changes on the public or employer pages, it will be with consent and this notice will say so first.

Your browser's own storage

Nothing about your answers is kept in your browser after you send them.

Last updated 6 October 2026. Draft, pending legal review.