Privacy
As of: 31 October 2026
This policy has two parts. Part A concerns everyone who visits this website or contacts Summado by email. Part B describes how Summado processes the merchants' data in the service.
Part A: Website and contact
Controller
Daniel Wiegand, Wiegand-Digital
Am Leimbach 9, 68723 Oftersheim, Germany
Email: hello@summado.de
No data protection officer has been appointed, because there is no legal obligation to do so.
Hosting
The website is hosted on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data as a data processor (Auftragsverarbeiter) on the basis of a data processing agreement (Art. 28 GDPR) and exclusively within the EU or the EEA.
Provision of the website
When you open a page, your browser transmits technically necessary data, in particular your IP address, the requested address and information about the browser. This data is processed only to deliver the page. The website keeps no access logs; apart from the error log (next paragraph), the data is not stored after delivery.
Only in the case of serious web server errors, for example when a file cannot be read because of a server fault, is an entry written to the error log. Such an entry can contain the time, the requested address, the IP address the request came from, the requested host name and, if your browser sends it, the referring page (referrer). It serves only to fix the error.
On the server, the entries of the error log are deleted every day. Hetzner backs up the server every day (seven backups at the server's location in Nuremberg); these backups can contain an entry for a few days longer. Before maintenance work, an image of the server may be created, which Hetzner stores at another location in the EU (Germany or Finland) and which is deleted after 7 days at the latest. Overall, an entry is deleted after 14 days at the latest.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in providing the website and fixing errors. The connection is encrypted with TLS; the certificate is issued by Let's Encrypt, and no visitor data is transmitted to Let's Encrypt in the process.
No cookies, no tracking
The website sets no cookies and uses no web storage in the browser and no tracking or analytics tool. It loads no content from other servers; the fonts are the system fonts of your device. Therefore nothing is stored on or read from your device, and no consent is required.
Contact by email
If you write to Summado by email, Summado processes your email address, your name if provided, the content of the message and the time, in order to handle your request.
- Legal basis: Art. 6(1)(b) GDPR if the request concerns a contract or its initiation, otherwise Art. 6(1)(f) GDPR. The legitimate interest lies in answering your request.
- Storage period: until your request has been dealt with. After that only insofar as statutory retention obligations apply, and only for their duration.
- Recipients: Hetzner Online GmbH as data processor, which operates the mailboxes in Germany.
Please do not send any business data by email (Contact).
Transfers to third countries
For the website and for contact by email, no data is transferred to countries outside the EU or the EEA.
No obligation to provide data, no automated decision-making
You are not obliged to provide any data. Without the technically transmitted data, however, the website cannot be delivered, and without your email address Summado cannot reply. There is no automated decision-making, including profiling.
Your rights
Towards Summado, you have the right to
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR) and
- object (Art. 21 GDPR).
Summado does not obtain consent for the website or for contact; a withdrawal of consent is therefore not necessary. For your requests, an email to hello@summado.de is sufficient.
Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for Summado is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Part B: Data in the service
Summado processes the merchants' business data on behalf of the merchants. For this data, the merchant is the controller and Summado is the data processor (Art. 28 GDPR), on the basis of a data processing agreement with the merchant. As the operator of Summado, Wiegand-Digital is an entity separate from the merchants, with its own permissions.
How Summado calculates metrics, how current and accurate they are and what role AI plays is described on the Security page in the section "Calculations, data freshness and AI".
What data Summado collects
The merchant connects their seller account by authorizing Summado's access at Amazon (OAuth). Summado receives no password and retrieves data only through Amazon's interfaces, from no other sources. Summado does not request any roles for restricted data (Restricted Roles) and does not collect buyer data such as names, addresses, email addresses or phone numbers. Summado does not store any information that could identify a buyer.
Which data from Amazon Summado uses, and for what purpose:
| Data | Purpose |
|---|---|
| Sales and traffic per ASIN (revenue, units, sessions) | Analysis of revenue, traffic and conversion |
| Orders and order items without buyer data (product, quantity, price, time, marketplace) | Current revenue and order trends |
| Inventory in Fulfillment by Amazon, reserved and inbound quantities | Inventory overview and days of supply |
| Fees, refunds and payouts | Margin per SKU, fees and payouts |
| Marketplaces with country, currency and time zone | Assignment and correct presentation of the values |
| Search Query Performance from Brand Analytics (only with access to Brand Analytics) | Analysis of search queries per ASIN; planned as an extension |
| Campaigns, targets, search terms and metrics from Amazon Ads | Advertising reports. Amazon Ads reports are in preparation and not yet available. |
In addition, there are the purchase prices (COGS) that the merchant uploads themselves, for calculating the margin, and the credentials for the connected account. For the users' account data (login, for example email address and name), Summado itself is the controller; this data is stored separately from the business data.
How Summado uses the data
- Only to provide its service to the merchant who authorized Summado.
- No analysis across merchants: Summado does not combine the data of different merchants and does not create benchmarks from other merchants' data.
- No use for its own purposes and no sale of data.
- No training: Summado does not train models with the data and does not call a language model itself.
Where Summado stores the data
The data is stored in a database in a data center in Ireland (EU). The services that process the data run on servers in Germany and do not store any business data permanently. Credentials are stored only in encrypted form (envelope encryption). Some providers are based outside the EU; see Subprocessors.
How Summado protects the data
- TLS for all connections over the internet, envelope encryption of the credentials with AES-256-GCM.
- Each customer's data is kept separate from that of other customers.
- Only the operator, Daniel Wiegand, has access to the data. There are no employees and no contractors with access. If this changes, Summado will disclose it here beforehand.
More on this on the Security page.
Who Summado shares the data with
Summado shares the data only with the subprocessors listed below and, as answers, with the AI assistant that the merchant has connected to Summado themselves. The assistant receives only that merchant's data and only in response to queries the merchant has authorized. The merchant uses the assistant with their own account and contract; its provider is not a subprocessor of Summado. The merchant should only use an AI assistant whose provider does not train on the answers, by contract or by a setting in their account; Summado cannot check this setting.
Subprocessors
"Planned" means: the provider is only used once the services are in operation and then receives only the data listed. Summado announces new subprocessors to the merchants in advance; they can object.
| Provider | Purpose | Data | Location | Third-country transfer |
|---|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Servers for Summado's services, hosting of the website, email mailboxes | Business data only during processing, without permanent storage; credentials only in memory; operational logs; emails | Germany; images of the server taken before maintenance work in Germany or Finland (EU) | no transfer to a third country |
| Supabase Pte. Ltd., Singapore | Database and file storage, backups | Business data, credentials only in encrypted form, user account data, operational data | Data center in Ireland (AWS region eu-west-1); Supabase contractually commits to storing data in the chosen region as a rule; operated by Amazon Web Services as a subprocessor of Supabase | Contracting party in Singapore, standard contractual clauses |
| Amazon Web Services (key management) | Management of the master key of the envelope encryption, which protects the keys of the credentials | No business data and no credentials; logs of key usage with pseudonymous identifiers | EU | Group headquartered in the USA; EU-US Data Privacy Framework, standard contractual clauses |
| Functional Software, Inc. (Sentry), San Francisco, USA (planned) | Recording of errors in the services | Only operational data without business data, credentials and account data | EU region | EU-US Data Privacy Framework, standard contractual clauses |
| Raintank Inc. (Grafana Labs), New York, USA (planned) | Operational logs, metrics and alerts | Only operational data without business data, credentials and account data | EU region (Germany) | EU-US Data Privacy Framework, standard contractual clauses |
When Summado deletes the data
- Sales, order, inventory and financial data: as long as the booked history (Starter 12 months, Pro 24 months, with add-on 36 months). Summado deletes older data on an ongoing basis.
- Raw files (reports and responses from the interfaces): at most 30 days from retrieval. After that, the values exist only in the processed tables.
- Credentials: deleted immediately when you disconnect a connection, revoke the authorization or the access is no longer valid.
- Disconnecting a connection or cancellation: All data of the connection or of the customer is deleted, and no later than 30 days after that also in the backups.
- Request by Amazon: deletion to the extent requested within 30 days, including the backups.
- Audit log (record of queries, without business data): 12 months.
- Answers in the AI assistant: Summado does not store a copy of the answers. What your AI assistant retains depends on your contract with its provider.
Questions about Part B
Questions about processing in the service to hello@summado.de, reports of security issues to security@summado.de.