Skip to content
SUM EQUITIES

Privacy

Last updated: 2026-09-26

Changed 2026-09-26: the contact and waitlist forms can now apply a flood limit (five submissions per connection per ten minutes), keyed on the one-way hash of your IP address and kept for ten minutes. Details under “What we collect”.

Plain-English summary This site is a portfolio. The only personal data it collects is what you voluntarily submit through a form. There are two: the contact form (name, email, your message) and the Chefrson waitlist form on that project's page (your email, plus a fixed note that it is a waitlist signup). Both post to the same endpoint. That data is used to reply to you and nothing else. You can ask for it to be deleted at any time by emailing hi@sumequities.com.

Who runs this site

This site is operated by SUM Equities ("we," "us," "our"). For privacy questions or requests, contact hi@sumequities.com.

What we collect

When you submit the contact form, we collect:

  • Your name
  • Your email address
  • The message you write us
  • Whether you ticked the consent box

Of those, only three actually leave this site: your name, your email address and your message. Everything else is discarded. That includes the consent tick — the form will not submit without it, but that is enforced by your browser, and nothing on our side acts on the value afterwards. It also includes three things the request carries or the endpoint derives and then drops: which form you used (a hidden field the page sets, not something we infer about you), a one-way SHA-256 hash of your IP address (never the address itself), and your browser's user-agent string. None of these are stored with your message. They would only be stored if the database described below were provisioned, and this page will say so before that happens.

To be exact about the IP hash: its one other use is a flood limit of five messages per connection per ten minutes. When that limit is switched on, the hash (never the address) is the key of a counter that deletes itself after ten minutes, and nothing else is kept with it. The limit only runs if a rate-limit store is attached to the site; without one, nothing reads the hash at all. Apart from that limit, the only bot defence written into this form is a hidden honeypot field. There is a Cloudflare Turnstile check wired into the code, but it is not enabled in production — no Turnstile widget is served to you, so we do not claim it as a protection.

We do not ask for, and the form cannot accept, a phone number.

We do not use cookies for analytics or tracking. We do not run third-party analytics pixels on this site. Server logs generated by our hosting provider (Cloudflare) may transiently include IP addresses and user-agent strings in accordance with Cloudflare's own privacy practices.

How we use it

  • To respond to your inquiry.
  • To keep a minimal record of inbound communication for continuity across a conversation.
  • When the flood limit is switched on, to count messages per connection by IP hash for ten minutes (see “What we collect”).

We do not add you to any marketing list. We do not sell, rent, or trade your data. We do not use your data to train machine-learning models.

How long we keep it

Your message reaches us as an email and stays in that inbox until we delete it by hand — on our side there is no automatic deletion schedule, so nothing expires on its own. It is not only on our side, though: the form is delivered by FormSubmit, and FormSubmit's own documentation states that it retains form submissions for 30 days. Email hi@sumequities.com and we will remove our copy.

Third parties

The following services process limited data on our behalf:

  • Cloudflare — hosts the site and provides DDoS / TLS. Cloudflare Email Routing is also the mail exchanger for sumequities.com, so any message you send to hi@sumequities.com passes through Cloudflare on its way to our mailbox.
  • FormSubmit (formsubmit.co) — receives contact-form submissions and forwards them to our email inbox. This is the route every submission currently takes. FormSubmit's own documentation states that it retains form submissions for 30 days; we do not control that period.
  • Our email provider (Proton Mail at pm.me) — delivers the contact-form email to us.
  • Cloudflare D1 — a database intended to hold submissions in a table named leads. It is not currently provisioned, so nothing is stored there and it receives no data; submissions reach us through FormSubmit instead, as described above.
  • Resend — intended to notify us of a new submission. It sits behind the same database as above: a notification is only sent for a submission that was stored, so while the database is unprovisioned Resend receives nothing, whether or not its keys are configured.

Each of these services has its own privacy policy. Using our contact form implicitly routes your submission through them.

Your rights

Depending on where you live, you may have rights to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Request deletion.
  • Object to our processing.
  • Request a machine-readable copy of your data (data portability).

Email hi@sumequities.com with "Privacy request" in the subject line. We respond within 30 days.

Children

This site is not directed to children under 16. We do not knowingly collect data from them. If you believe a child has submitted data, email us and we will delete it.

Changes

We may update this policy. The "Last updated" date at the top reflects the most recent version. Material changes will be surfaced in a visible banner for 30 days.