Privacy Policy
Surface collects business contact and audit data to deliver its AI-search service, shares it only with listed sub-processors, retains it while your account is active, and honours GDPR data rights.
Last updated: 2026-06-06
1. Who we are
Surface (surfacehq.co) is a self-serve AI software product for GEO. This policy explains what personal data we collect, why, and the rights you have over it. For data requests, contact privacy@surfacehq.co.
2. Data we collect
We collect data you provide and data we enrich to deliver the service:
- Contact data: business email, name, role, and LinkedIn, including data enriched from your business email domain.
- Company data: company name, website, industry, and market.
- Audit inputs: the domain, competitors, and product details you submit for an AI-visibility audit.
- Service data: the audit results and reports we generate for you.
- Billing data: subscription references held by our payment processor (we never store full card numbers).
- Technical data: standard server logs and, where consented, cookies.
3. Why we use it (legal bases)
We use your data to deliver and improve the service, to communicate with you, and to bill your subscription. Under the GDPR our legal bases are: performance of our contract with you, our legitimate interest in operating and securing the service, your consent (for non-essential cookies and marketing), and compliance with legal obligations.
4. Sub-processors
We share data with the third parties listed below, each only for the purpose stated. We do not sell personal data, and we do not use client data to train public AI models.
Each third party receives only the data it needs for its stated purpose.
| Sub-processor | Purpose |
|---|---|
| Apollo.io | Company data enrichment from a business email domain. |
| Enrich.so | Professional contact enrichment (name, role, LinkedIn). |
| Anthropic | AI analysis and content generation (Claude models). |
| DataForSEO | On-demand AI-search and SERP data for audits and reporting. |
| Supabase | Primary database hosting (PostgreSQL) for account and project data. |
| Stripe | Recurring billing. Card data is held by Stripe, never by Surface. |
| Vercel | Web hosting and content delivery for this site. |
| Resend | Email delivery for reports and operational messages. |
5. International transfers
Some sub-processors are located outside the European Economic Area. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. Retention
We keep personal data for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and dispute-resolution obligations. When data is no longer needed, we delete or anonymise it.
7. Your rights
If you are in the EEA or the UK, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data, subject to legal limits.
- Restrict or object to certain processing.
- Port your data to another provider.
- Withdraw consent at any time, and lodge a complaint with your supervisory authority.
8. Cookies
We use essential cookies required to run the site and, only with your consent, analytics cookies to understand usage. You can change your choice at any time in your browser settings.
9. Contact
For any privacy request, or to exercise a right above, contact privacy@surfacehq.co. The data controller's full legal entity and any Data Protection Officer details will be confirmed here following legal review.