Privacy & Cookies
Your data, in plain language.
Last updated: April 2026
The short version
Summer River uses essential cookies only — for keeping you signed in and for processing payments securely. There are no analytics, no advertising trackers, and no third-party behavioural cookies. We don't sell or share your data.
What we collect
- Email and (optional) name — when you subscribe to the newsletter, request a consultation, recommendations, or portfolio curation, or create an account.
- Account identity — when you sign in (email, secure session token).
- Service request details — anything you choose to write into a request form (sectors of interest, goals questionnaire answers, etc.).
- Payment data — handled entirely by Stripe. We never see or store your card details. Stripe provides us with a transaction reference and your billing email.
Why we collect it
- To send you the newsletter you signed up for.
- To fulfil consultation, recommendation, and curation requests you submit.
- To provide and secure your account and subscription access.
- To process payments and provide receipts.
- To respond when you contact us.
Cookies in use
- Authentication session — keeps you signed in. First-party, essential.
- Stripe checkout — set only when you open the payment form, required for secure card processing.
No analytics platforms (Google Analytics, Plausible, PostHog, etc.), no advertising pixels, no social media trackers, no fingerprinting. Because we use only essential cookies, no consent banner is required under EU/UK GDPR or Canadian PIPEDA — but you should know what's running, hence this page.
Where your data lives
Subscriber and account data is stored on managed Supabase infrastructure (the "Lovable Cloud" backend) in a secured, access-controlled Postgres database. Payment data is processed and retained by Stripe under their own privacy terms. The newsletter list is held only here — we do not sync it to third-party email marketing platforms.
How long we keep it
Subscriber emails are kept until you unsubscribe. Account and subscription records are kept while your account is active and for a reasonable period afterwards for accounting and legal compliance. Service-request messages are kept while the engagement is active and reasonably afterwards in case you return.
Your rights
You can request access to your data, correction of inaccurate information, or deletion of your account and associated personal data at any time. To exercise any of these rights — or to ask any privacy question — write to us via the contact page. We aim to respond within 30 days.
Children
Summer River is not intended for, and we do not knowingly collect data from, anyone under 18.
Changes to this policy
If we change how data is handled in any meaningful way, we will update this page and revise the "Last updated" date above. For subscribers, material changes will also be announced in the newsletter.