How Summit handles personal information.

Privacy Policy. Effective October 26, 2026. This policy covers our website, our business relationships and the Summit platform that airports use.

This Privacy Policy explains how Summit Airport Systems, LLC ("Summit", "we") handles personal information on our website, summitairportsystems.com, in our business relationships, and in the Summit platform that airports use: the Summit portal, airport displays and Integrations – API + MCP.

1. Our role

Information Summit decides how to use. For our website, sales and customer relationships, recruiting, billing, the security of our services, and our legal obligations, Summit decides how personal information is used.

Information we process for airports. In the Summit platform, we process information on behalf of the airport that subscribes to Summit. The airport decides who has access, which can include its employees and contractors and, where the airport chooses, airline, ground-handler and other partner personnel. The airport also decides what information is entered. Our written agreement with each airport governs that processing, and this Policy does not replace it.

2. Information we collect

Website

  • Contact and careers forms: the information you submit, such as your name, email address, organization, phone number and message.
  • Airport preview: our server may use your IP address to estimate a broad location and show the nearest large-hub airport from a stored historical snapshot. We do not request precise device location, and this feature does not store your IP address.
  • Form protection: Cloudflare Turnstile checks form submissions for abuse. We verify its single-use token but do not store the token. With a form submission we store a one-way, keyed code derived from your IP address, which lets us spot repeated abuse without keeping the address itself.
  • Website cookie: the website sets one preference cookie, summit_privacy_notice, for up to 180 days, to remember that you dismissed our notice. It does not use advertising or analytics cookies. See our Cookie Notice.
  • Website statistics: we count visits to our public website with Cloudflare Web Analytics, which does not use cookies or store your IP address, so we can see which pages are read and how people find us. It is skipped if your browser sends a Global Privacy Control or Do Not Track signal.

Business relationships

  • Prospects, customers and partners: business contact details, correspondence, meeting and demonstration notes, and proposals, kept in our customer relationship records.
  • Billing: billing contacts, purchase order numbers, invoices and payment records. When a customer pays by card, our payment processor collects and stores the card details directly. Summit receives only confirmation of the payment and limited card information, such as the card type and last four digits, and never sees or stores the full card number.

Summit platform

  • Accounts: name, work email address, role, and the airports a user can access.
  • Passwords and recovery: passwords and security-question answers are stored only as one-way hashes, never in readable form.
  • Airport badge verification: an airport administrator enters each airport user's SIDA badge number when creating the account, and the user enters it when signing in. Summit uses it to confirm the user for that airport, and to verify callers who contact Summit Support. We store a keyed one-way hash of the number and its last four characters, not the full number. Summit never asks for badge numbers by email.
  • Sign-in and security records: sign-in sessions, browsers a user has chosen to trust, failed sign-in counts used to lock accounts after repeated failures, and records of security-relevant actions.
  • Activity in the portal: changes users make, such as flight changes, display publishing and user management, with the user's identity, so the airport has an audit trail.
  • Support: support tickets and replies, including replies from Summit Support Assistant, the AI that answers support tickets for Summit.
  • Integrations: integration credentials (stored only as one-way hashes), records of which user authorized a connected tool and what access it was given, and monthly usage counts.
  • Display screens: screen names, when each screen last checked in, and its clock offset. Display screens do not collect information about passengers.

Technical information

  • Request and security logs: to deliver and protect our services, our hosting, Cloudflare and our application process standard request information, such as IP address, browser type, the address requested and the time. Our application logs record this information for troubleshooting and security and are kept for up to 30 days. These logs are separate from the website features above, which do not store your IP address.
  • Platform cookies: the Summit portal uses only essential cookies: a session cookie (summit.sid, up to 8 hours), a trusted-browser cookie (summit.trusted, which expires at 8:00 PM the day it is set, or the next day if set after 8:00 PM, and is set only if you choose to trust a browser after verifying), and a security token that protects forms from forgery.

3. How we use information

  • To provide, operate, secure and support the Summit platform, including account setup, password resets, security notices and service alerts.
  • To respond to inquiries and review job applications.
  • To manage sales and customer relationships, contracts, invoicing and payments.
  • To prevent abuse and fraud, and to investigate security incidents.
  • To improve our services using de-identified, aggregated information, such as anonymous on-time and delay summaries, which we do not attempt to re-identify.
  • To comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use it for targeted advertising. Summit does not currently send marketing emails. If we do in future, we will send them only as the law allows, and every message will include a way to unsubscribe.

4. How we share information

  • Within an airport's account: airport administrators and other authorized users see information according to their permissions, for example the users of their airport and the activity records of its portal.
  • Service providers: companies that help us run our services under contract, such as our hosting, backup, network security, email and payment-processing providers, as listed in our Third-Party Services & Subprocessors list, which is available to customers on request.
  • AI support assistant: when an airport user raises or replies to a support ticket, Summit Support Assistant sends the ticket, its conversation, the airport's name and products, and the current status of its screens and flight information to Anthropic, the company that provides the AI model, to prepare a reply. It does not send the contact details of the person who raised the ticket. Under its commercial terms, Anthropic does not use this information to train its models and deletes it within 30 days.
  • Tools an airport connects: an airport can connect its own systems and AI-enabled tools through Integrations – API + MCP. Those tools receive only the information the airport authorizes, and they handle it under their own terms and privacy practices.
  • Flight data: our commercial flight-data provider receives the airport codes and technical request information needed to supply flight schedules and status. It does not receive account details or other personal information about platform users.
  • Advisers and transactions: our professional advisers, auditors and insurers under confidentiality obligations, and a buyer or successor in a merger, acquisition or sale of our business, subject to appropriate safeguards.
  • Legal and safety: when required by law, or to protect the rights, safety and security of Summit, our customers or others.

5. How long we keep information

  • Website inquiries: sales inquiries are deleted automatically after 24 months and careers inquiries after 12 months. If a prospect becomes a customer, the relevant contact details move into our customer records and are kept for the customer relationship.
  • Platform accounts: kept while the user's airport subscribes to Summit. Removing a user's access stops them signing in. Their account details and the activity records described above remain part of the airport's records until the airport's data is deleted, as described below.
  • Detailed flight history, including the editing user: 13 months, where the airport enables it. Anonymous daily performance summaries: 5 years.
  • Request logs: up to 30 days.
  • Short-lived security records: portal sessions last up to 8 hours, trusted browsers until 8:00 PM the day they are trusted, and setup, password-reset and email-change links up to 1 hour or 30 minutes.
  • When an airport's subscription ends: Summit deletes the airport's information from its production systems within 60 days after the subscription ends, or later if the airport has asked for an export that has not yet been delivered. Backup copies are overwritten within a further 90 days. We may keep a minimal record that deletion happened, de-identified aggregated information, and information we must keep by law or under a legal hold.
  • Contracts and business records: signed Order Forms, agreements, statements of work and sign-offs are kept for at least 3 years after the contract ends or is cancelled, even if the airport's account has been deleted. Invoices and related correspondence are kept for as long as accounting, tax and legal requirements need.

6. Security

We use encryption for information sent over the internet, keep each airport's information separate from other airports', store passwords and other credentials as one-way hashes, and back up our production systems regularly. Airport users sign in with a password and then airport badge verification; these are two steps but both are things the user knows, so they are not multi-factor authentication in the usual sense. Airport administrators also enter a code from an authenticator app, and Summit personnel sign in with a password and a code from an authenticator app. Customers can ask Summit for more detail about these controls. No system is completely secure, but we work to protect the information we hold.

7. Your choices and requests

You may ask to access, correct or delete personal information Summit holds about you by emailing [email protected]. We will confirm your identity before acting, usually by replying to the email address on record. If your request concerns information in an airport's Summit account, we will refer it to that airport or work with them, because the airport controls that account. We may be unable to delete information we must keep by law, for security, or for legitimate business records, and will tell you if so. Depending on where you live, you may have additional rights under state privacy law; we will honor them where they apply.

8. Do Not Track and Global Privacy Control

Our website and platform do not track you across other websites and do not sell or share personal information for advertising, so they do not change behavior in response to Do Not Track or Global Privacy Control signals.

9. Children

Our services are for businesses and airport operations. They are not directed to children under 13, and we do not knowingly collect their information.

10. Changes to this Policy

We will post changes on this page and update the effective date. For material changes affecting platform users, we will notify airport administrators. Changing this Policy does not amend, or reduce the protections in, any written agreement between Summit and a customer. Before using personal information in a materially new way, we will give any notice or obtain any consent the law requires.

11. Contact us

Summit Airport Systems, LLC. Email: [email protected].