Summit Bullion Incorporated
Last updated: August 30, 2026
Effective: August 30, 2026
This Privacy Policy describes how Summit Bullion Incorporated ("Summit," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit summitbullion.io, create an account, or purchase from us.
Account: name, email, phone, password.
Order: shipping and billing addresses, order contents, delivery instructions.
Identity verification: legal name, date of birth, residential address, government-issued identification, biometric selfie, and where applicable proof of address and source of funds documentation. Collected and held by our verification provider, not by us. See Section 5.
Payment: processed by our payment processor. We receive confirmation, the last four digits, card brand, and result. We do not receive or store full card numbers or bank credentials.
Digital asset payments: the wallet address used and transaction hash.
Communications: the content of emails, support tickets, and calls, which may be recorded where permitted and disclosed.
IP address and derived location, browser and device type, operating system, referring URL, pages viewed, timestamps, and interaction data. Collected through cookies and similar technologies. See Section 7.
Verification and screening results from our identity provider. Sanctions, politically exposed persons, and adverse media screening results. Fraud and risk signals from our payment processor. Delivery status from carriers.
| Purpose | Basis |
|---|---|
| Process, fulfil, and deliver orders | Contract performance |
| Verify identity and screen against sanctions lists | Legal obligation |
| Detect and prevent fraud | Legitimate interests; legal obligation |
| Send transactional communications about orders | Contract performance |
| Provide customer support | Contract performance |
| Comply with tax, AML, and reporting obligations | Legal obligation |
| Maintain records required by law | Legal obligation |
| Improve the Site and our services | Legitimate interests |
| Send marketing communications | Consent, withdrawable at any time |
Transactional communications are not marketing. Order confirmations, shipping notices, delivery updates, and account or security notices are sent regardless of marketing preferences because they are necessary to perform our contract with you.
We do not store your identity documents.
Government-issued identification, selfies, proof of address, and source of funds documentation are collected and retained by our third-party verification provider, which acts as the system of record.
Summit retains only:
This design is deliberate. It allows us to meet our obligations while minimizing the sensitive data we hold.
We do not sell your personal information. We share it only as described below.
Service providers, each contractually limited to processing on our behalf:
| Category | Purpose |
|---|---|
| Payment processing | Charging, refunds, fraud screening |
| Identity verification and AML screening | Verification, sanctions and PEP screening |
| Fulfilment and supply partners | Order fulfilment and shipment |
| Shipping carriers | Delivery, tracking, insurance claims |
| Email delivery | Transactional and marketing email |
| Cloud infrastructure and analytics | Hosting, storage, service operation |
| Review platform | Post-purchase review invitations |
Government and regulatory authorities, where required by law, subpoena, court order, or lawful request, or to comply with anti-money-laundering, sanctions, or tax reporting obligations. Certain reports required by law may be made without notice to you where notice is prohibited.
Professional advisers, legal, accounting, and audit, under confidentiality.
Successors, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy or a successor policy providing comparable protection.
We use three categories of cookies and similar technologies.
Strictly necessary. Authentication, shopping cart, security, and fraud prevention. These cannot be disabled without breaking the Site.
Functional. Remembering your preferences and settings.
Analytics. Understanding how the Site is used. We use Google Analytics 4 to measure traffic volume, referral sources, and which pages visitors view.
We do not use advertising, retargeting, or cross-site tracking technologies. Google Signals is disabled on our Google Analytics property and we do not link it to any advertising platform. Your activity on this Site is not used to target advertising to you elsewhere.
You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent the Site from functioning.
Global Privacy Control. We honor Global Privacy Control signals. If your browser or extension transmits a GPC signal, we treat it as a valid opt-out request under applicable state privacy law.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
Under California and several other state privacy laws, "sale" and "sharing" are defined broadly and can include disclosing personal information to advertising platforms even where no money changes hands. We do not do this.
Specifically:
Our analytics use is limited to measuring Site traffic and usage, as described in Section 7.
We honor Global Privacy Control signals regardless.
If this changes, we will update this Policy, provide notice, and implement the opt-out mechanisms required by applicable law before making any such disclosure.
| Category | Retention |
|---|---|
| Identity verification records and AML audit trail | 5 years from account closure or last transaction, per Bank Secrecy Act |
| Transaction and order records | 5 years, per Bank Secrecy Act and tax requirements |
| Account information | Duration of account plus 2 years |
| Support communications | 3 years |
| Analytics and usage data | 14 months |
| Marketing preferences and suppression list | Indefinitely, to honor opt-outs |
Records we are legally required to retain cannot be deleted on request during the applicable period.
Where we cannot delete, we will tell you why.
Depending on where you live, you may have the right to:
To exercise a right, contact Contact@SummitBullion.io or write to the address in Section 1.
We verify identity before responding, which may require confirming information already on file. We respond within 45 days, extendable by a further 45 days where permitted, with notice.
Authorized agents may submit requests with written authorization and verification of your identity.
We send marketing email only with your consent. Every marketing email includes a one-click unsubscribe.
Unsubscribing from marketing does not stop transactional communications about orders, delivery, account security, or legal notices.
We maintain administrative, technical, and physical safeguards including encryption in transit and at rest, access controls and least-privilege permissions, logging and monitoring, and periodic review.
No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for safeguarding your account credentials.
If we become aware of a breach affecting your personal information, we will notify you and applicable regulators as required by law.
The Site is not directed to anyone under 18 and we do not knowingly collect information from minors. If we learn we have, we will delete it. Contact Contact@SummitBullion.io if you believe a minor has provided information.
Summit is based in the United States and processes information here. If you access the Site from outside the United States, you understand your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.
We currently direct our services to customers in the United States only, and do not ship internationally.
We may update this Policy by posting a revised version with an updated date. Material changes take effect 30 days after posting, and we will provide notice where required. Prior versions are available on request.
We will not use previously collected personal information for a materially different purpose without providing notice and, where required, obtaining consent.
