Skip to main content
Book a Call

Summrex LLC

Summrex Privacy Policy

Effective date: October 30, 2026

This policy covers summrex.com, the automations Summrex LLC runs for the businesses it builds websites for (the consultation responder and the daily spam check), Consultation Capture (capture.summrex.com), the Summrex client dashboard, and the Summrex browser extension for Google Chrome and Microsoft Edge and the Summrex Gmail add-on, which help a business's staff edit reply drafts in Gmail. It describes what each one reads, where it goes, and what is kept, as of the effective date.

This website

  • The contact form. What you type into the form on summrex.com (your name, email, business and message) goes to Netlify, which hosts the site, and is emailed to us. We use it to reply to you and for nothing else.
  • Analytics. The site uses Google Analytics 4 to count visits and understand which pages are read. No form text reaches analytics.

The consultation responder

A business that subscribes to it gets a reply draft, in its own Gmail account, for every inquiry sent through its website's consultation form. Nothing is sent automatically: the business reviews every draft and decides whether to send it.

  • What it reads. The inquiry the visitor submitted: the name, contact details and message entered in the form. It reads nothing else in the mailbox, apart from checking whether the business is already in correspondence with that address.
  • Before anything reaches an AI model, the message is redacted in code: email addresses, phone numbers, web addresses, identification and case numbers, dates, street addresses and the person's name are replaced with placeholders. One call to Anthropic, the AI provider, returns classification signals about the redacted message. The draft itself is assembled in code from the business's own approved sentences; the model does not write it.
  • Where the draft goes. Into the business's Gmail account as a draft, filed under its "Consultation Drafts" label.
  • What is kept. For each inquiry, a record of the outcome by submission ID: a status, flags and fixed error codes, and a scrambled (hashed) form of the email address used to avoid duplicate drafts. No names, email addresses, phone numbers or message text are stored or written to any log. At Anthropic, the redacted text is not used to train models and is deleted within 30 days, except where a longer period is required by law or to enforce Anthropic's usage policies.

The daily spam check

Once a day, for a business that has it switched on, the check looks at the inquiries that the website's spam filters held back, so that a real person's message is not lost. It screens each held message the same way the responder does (the same redaction, the same single model call), writes a report of what it found, and, when the business has asked it to, gives real inquiries a draft under a "Needs Review" label. It never deletes a message and never sends one. Its records hold IDs, dates, reasons and counts only.

Consultation Capture

Consultation Capture records a law firm's consultations, when the firm chooses, and turns each one into a transcript, a summary and, when asked, a draft retainer agreement for the attorney to review. The firm decides what is recorded and controls its clients' information. Summrex processes that information only to run Capture for the firm, on the firm's instructions.

  • What it records, and when. Nothing is recorded before the recording notice. In the browser, the attorney gives the client the notice and starts recording only after the client agrees; if the client declines, the attorney types notes instead and no audio is recorded. Capture records the attorney's microphone and, when the attorney chooses, the sound of a video call shared from a browser tab. From the firm's Zoom account it takes only the recording of a consultation booked with the firm, after Zoom's own notice to everyone in the meeting that it is being recorded; every other Zoom recording is ignored, and nothing from it is kept. A meeting attended only by the firm's own people may skip the notice when the firm allows it. A firm cannot record anything until it has approved its notice.
  • Where it goes. Capture's server runs on DigitalOcean in New York. It handles recordings as they arrive and keeps no client content on its own disk. Recordings, transcripts, summaries and drafts are stored with Supabase, which also handles sign-in, in its US East (Ohio) region. Every connection, from the browser and between services, is encrypted.
  • The services that process it. Each receives only what its task needs:
    • AssemblyAI transcribes the audio. The firm's data is opted out of AssemblyAI's model improvement program, and AssemblyAI deletes its copy after one day.
    • Anthropic, the AI provider, receives the transcript and the consultation's details to write the summary, tell the speakers apart, remove identifying details for the firm's de-identified analysis, and draft the retainer, its Spanish version and its cover email. Anthropic does not use this to train its models and deletes it within 30 days, except where a longer period is required by law or to enforce Anthropic's usage policies.
    • Resend sends email to the firm's own people only: the summary with its PDF, the reminder before a recording is deleted, and sign-in emails such as invitations and password resets. Resend keeps sent email for up to 30 days.
    • Sentry receives error reports with technical details only, such as the firm's account number and an error code, never a name, a recording, a transcript or a draft.
    • Zoom. For a consultation held on Zoom, Capture downloads the recording from the firm's own Zoom account. Zoom keeps its copy under the firm's Zoom settings; Capture never deletes it.
    • Dropbox Sign. When the attorney approves a retainer, Dropbox Sign receives the document and the signers' names and email addresses, and sends it for signature. Signed retainers stay in the firm's Dropbox Sign account.
    • Gmail. The retainer's cover email is placed as a draft in the firm's own Gmail account. Nothing is sent automatically; the attorney reviews and sends it.
  • Encryption and separation. Before anything is stored, each firm's recordings, transcripts, summaries and drafts are encrypted (AES-256-GCM) with a key that belongs to that firm alone, and that key is itself locked with a master key kept only on Capture's server. Every table in the database is separated by firm, so one firm's people can never see another firm's records.
  • Who can see it. Only the firm's own people, each signing in with a password and a two-factor code. A recording, its transcript and its summary can be opened by the attorney who made it and by the firm's owner. Summrex staff do not open recordings, transcripts or drafts, except when the firm asks us to look into a problem, for security, or when the law requires it.
  • What is kept, and for how long. Recordings, transcripts, summaries and drafts are deleted 30 days after the recording, and the attorney is reminded on day 25. A daily check deletes them from storage and from the database, along with AssemblyAI's copy if any remains, and logs only that the deletion happened. The firm's owner can delete a recording sooner at any time. A retainer out for signature keeps its draft until it is signed, declined or expires, and is then deleted the same way. The client's details from the booking are deleted 30 days after the consultation. Database backups are kept for 7 days, so deleted records leave the backups within a week; stored files are not in the backups. Two things are kept longer. The first is a short record of each consultation for the firm's own analysis, kept for two years, which the firm's owner can export or delete: topic codes, outcomes and short de-identified exchanges only. No full transcript is kept past day 30. The second is the copies in the firm's own Dropbox Sign and Zoom accounts, which follow those accounts' settings.
  • The firm's clients. The firm controls its clients' information in Capture. A client who wants to see their information or have it deleted asks the firm, and the firm can delete it in Capture at any time; Summrex helps the firm with any such request.

The client dashboard

A business on the Summrex Visibility Plan can sign in to the Summrex client dashboard to see its own website and search numbers in one place: visits from Google Analytics, searches from Google Search Console and Bing Webmaster Tools, and its monthly Summrex Score.

  • How it connects to Google. The business either adds Summrex's service account as a viewer of its Google Analytics property and its Search Console site, or clicks Connect Google and signs in with its own Google account. Connect Google asks Google for two read-only permissions and nothing more: "See and download your Google Analytics data" and "View Search Console data for your verified sites". Summrex cannot change anything in Google Analytics or Search Console, and it gets no access to Gmail, Drive, Calendar, Google Ads or any other Google service.
  • What it reads. The names of the Analytics properties and Search Console sites the Google account can see, so the business can choose which ones to show. Then totals by day and by date range: visitors, sessions, page views, key events, how visitors arrived, countries, cities, languages, devices and pages; search clicks, impressions, click rate, average position, and the search terms and pages they came from; and whether each page of the business's site is in Google's index. Google Analytics reports totals, not individual visitors, so Summrex receives no visitor's name, IP address or user ID from Google.
  • Where it goes. Into the dashboard's database. Summrex runs the dashboard on Netlify (hosting) and Supabase (the database). Each business's numbers are kept apart from every other business's, and only that business's own dashboard logins and Summrex staff can see them.
  • How the connection is kept. When a business uses Connect Google, Google gives Summrex a token that lets it fetch the numbers again each day. The token is stored encrypted, with a key unique to that business, and is never written to a log. Disconnect in the dashboard revokes it at Google and deletes it. A business can also remove Summrex's access at any time from its Google Account, under Security, "Your connections to third-party apps and services" (myaccount.google.com/connections), or by removing Summrex's service account in Analytics or Search Console. The dashboard then says that Google access was removed, and keeps the numbers already copied until they are deleted as described below.
  • What is kept, and for how long. The copied numbers are kept while the business is on the Visibility Plan, so the dashboard can show history. When the plan ends, dashboard access ends after the final billed month and any Google token is revoked; the copied numbers are deleted 30 days later, and the deletion is recorded in the business's account log. A business can ask us to delete them sooner by email. Logs and error reports record only that a sync ran, when, whether it worked, and an account ID: never the numbers, a name or a token.
  • How it is used. Only to show a business its own numbers in its dashboard and in its monthly Summrex report, and to point out changes worth its attention. The dashboard's Google Analytics and Search Console data is not sold, not used for advertising, not used to train any AI model, and never sent to any AI provider. (This promise is about the dashboard's data only; what the other Summrex automations send to an AI provider is described in their own sections.) Summrex staff look at a business's numbers only to support that business at its request, for security, or when the law requires it.

The browser extension and the Gmail add-on

The Summrex browser extension and the Summrex Gmail add-on help an organization's staff edit consultation reply drafts in Gmail. The rest of this section describes the extension; the add-on reads and sends the same things through Google's add-on platform.

What Summrex reads, and when

  • The open draft, only when you ask. Summrex reads the text of the Gmail draft that is open in front of you only when you type an instruction and ask for a change. It reads that one draft, never your inbox, other messages or attachments.
  • The draft's Gmail ID. When a draft opens, Summrex reads the draft's ID from the page, so it can recognize a draft it was working on.
  • Your sign-in. You sign in with your Google account. Summrex asks Google only for your email address and a sign-in token (the scopes "openid" and "email"). It does not get access to your Gmail, Calendar, Drive or any other Google service.

Where it goes

Summrex contacts its backend only when you ask for a change or open the Rules settings. When you ask for a change, it sends these over an encrypted connection (HTTPS): your sign-in token, the draft's Gmail ID, the draft's text, your instruction, and the earlier instructions and suggested changes of the same conversation in the panel.

The backend:

  • checks your sign-in and that your account is one your organization has set up;
  • checks, through your organization's own Gmail connection, that the draft still exists and was created by your organization's consultation responder, and reads the original inquiry the draft answers from your organization's records;
  • removes names and contact details before anything is sent on: the name, email address and phone number of the person who wrote in, and the email addresses, phone numbers, street addresses, web addresses, full dates, and identification and case numbers it finds, each replaced with a placeholder. Names are removed when the backend knows them (the person who wrote in, and anyone named as having referred them) or when they follow words such as "my friend" or "named"; another name typed into the draft or an instruction may not be recognized;
  • sends the redacted draft, instruction and inquiry to Anthropic, the AI provider that writes the change, together with your organization's own writing guidelines and business details (such as its name, its fee and its consultation hours) and the rules you saved in the Rules settings, as you wrote them; then puts the real details back into the answer;
  • applies your organization's writing rules and checks, and returns the change to Summrex, which types it into your draft for you to review.

Nothing is sent automatically, and Summrex never sends email. Sending a draft is always your own action in Gmail.

What is stored, and for how long

  • In your browser: your sign-in token, in memory only, until the browser closes; where you last left the Summrex panel on screen; and, while a suggested change is waiting for you to apply or discard it, a scrambled (hashed) marker for that draft. No draft text, email address or instruction is stored in your browser.
  • On the Summrex backend:
    • the rules and settings you save in the Rules settings, until you change them or ask us to delete them;
    • for each request, a record of the outcome, how long it took and how much AI processing it used, and counts of your requests per hour and per day (used to limit how many requests can be made). These are tied to a scrambled form of your account, not your email address, and are deleted after 12 months.
    • Draft text, inquiry text, instructions and email addresses are not stored, and they are not written to any log.
  • At Anthropic: Anthropic does not use this text to train its models and deletes it within 30 days, except where a longer period is required by law or to enforce Anthropic's usage policies.

What we never do

  • We do not sell your data.
  • We do not use or share it for advertising, or for any purpose other than editing the draft you asked about.
  • We do not use it to decide creditworthiness or for lending.
  • Summrex staff do not read your drafts or instructions, except when you ask us to look into a problem, for security, or when the law requires it.

Google user data

Summrex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The browser extension and the Gmail add-on use Google sign-in only to confirm who you are, and use draft content only to make the change you asked for. The client dashboard uses Google Analytics and Search Console data only to show a business its own numbers, as described in The client dashboard.

Removing Summrex

You can remove the extension at any time from your browser's extensions page; that deletes everything it kept in your browser. If your organization installed it for you, ask your administrator. To have your saved rules deleted from the backend, or the responder's records for your business deleted when you leave, email us.

Changes and contact

If this policy changes, the new version will be posted at this address with a new effective date, and any change to what Summrex collects or shares will be announced before it takes effect.

Questions: hello@summrex.com, Summrex LLC.