Privacy notice

Who is responsible?

Data Surfer is operated by Sure Scale Private Limited, Singapore. Contact nick@data-surfer.com for privacy questions or requests. We are responsible for account administration, billing, security and the public-source collection we operate. Where we process workspace content on a business customer’s instructions, that customer also has responsibilities for its use of personal information.

Information we handle

• Accounts: your name, email, verification status, passkey public credentials and authentication records. Passkey private keys and device biometrics are not sent to Data Surfer.
• Workspace activity: workspace membership, watched organisations and URLs, page selections, signals, source evidence, analysis instructions, generated reports, schedules and notification preferences.
• Payments: Stripe customer and checkout references, purchases, amounts, payment status and the credit ledger. Stripe collects payment-card details through its checkout; we do not store full card numbers.
• Communications: your name, email and the messages or requests you send us. Contact-form submissions are delivered to our email inbox.
• Technical information: IP addresses, browser/request details, session identifiers, security and service logs, and usage records needed to operate and troubleshoot the service.

Account and payment information is needed to provide the associated features. Optional analysis instructions and enquiries are your choice; do not include sensitive personal information or confidential material you are not authorised to share.

Information from public sources

We collect accessible website content, supported public LinkedIn information and web-search results about organisations. This can include names, roles, biographies, posts and business contact information published on those sources. We retain source references, snapshots or extracts and changes to help establish evidence over time.

Shared collection can serve more than one customer watching the same organisation. Workspace settings and private analysis instructions are separate from that shared public-source collection. Deleting a watcher does not necessarily remove public-source records needed by other watchers.

The current product monitors changes; it is not the former bulk contact-database or email-finder service. If a signal concerns you, send us the source URL and the information at issue so we can investigate correction, removal or an objection.

Why we use information

We use information to create and secure accounts, deliver monitoring and analysis, process payments, account for credits, send service notifications, answer requests and maintain reliable systems. Where UK or EU data-protection law applies, our bases are contract for services you request, legal obligations for required records, and legitimate interests in operating a secure service and identifying relevant public organisational changes. We consider the impact on the people concerned when relying on those interests. Optional promotional communications require any consent applicable law calls for; you can ask us to stop them.

AI analysis

We use Google Vertex AI to interpret source content and generate analyses. Relevant evidence, organisation information and your analysis instructions may be sent to this provider. We store reports and execution/usage records to deliver the result, account for charges and investigate errors. Automated interpretations can be incomplete or wrong; inspect the source evidence before acting. Data Surfer does not make employment, credit or other legally significant decisions about people for you.

Service providers and other recipients

Our providers include Google Cloud/Firebase for hosting and infrastructure, Google Vertex AI for AI processing, Google services for contact email and form abuse prevention, Amazon Web Services SES for account and notification emails, and Stripe for payments. Public-source collection also uses retrieval, search and network providers; requests to those services can reveal the public URLs or organisation queries being collected.

Workspace information is available to authorised members of that workspace and to personnel who need access to operate or support the service. We may disclose information where legally required, to protect rights and security, or in a business transfer with appropriate protection. We do not provide customer account details, private prompts or billing records as contact lists for sale. Public-source evidence is delivered to customers as part of monitoring.

International processing

Data Surfer operates from Singapore and uses international providers, including processing in the United States. AI requests use a global endpoint; this is not a UK-only or EU-only hosting service. Provider terms describe contractual protections for international processing, including standard contractual clauses and UK provisions where applicable: Google Cloud’s data-processing terms, AWS’s data-processing information and Stripe’s data-processing agreement. Contact us for the arrangements and safeguards relevant to your data.

Retention

Account and workspace records support the service and its history while the account is in use. Public-source evidence supports comparisons, provenance and shared monitoring. Payment and credit records are retained where needed for accounting, legal obligations and disputes. Support correspondence and security records are retained according to the issue, operational need and applicable legal requirements.

Monitoring suspension is not account deletion. We do not currently apply one automatic deletion period to all these records. On a verified closure or deletion request, we assess which information can be removed and which must remain for those purposes, including shared-workspace interests. Backup copies can remain until their normal rotation and are not a reason to restore deleted information to ordinary use. We explain material exceptions when handling a request.

Your choices and rights

Depending on the law that applies, you can request access, correction, deletion, a portable copy or restriction of personal information, and withdraw consent where processing depends on it. Email nick@data-surfer.com. We may verify identity and workspace authority, and will explain any limits on a request.

Right to object: you can object to processing based on legitimate interests, including public-source monitoring concerning you. Identify the relevant information or source URL and tell us your concern. You can also object to direct marketing at any time.

Turn signal and Insight emails on or off in Settings. Essential account, security and payment messages may still be sent. Cookies and browser storage are described in our cookie notice.

You can complain to the Singapore Personal Data Protection Commission, the UK Information Commissioner, or your relevant local data-protection authority. You do not have to contact us first.

Changes and earlier products

This notice describes the current monitoring product and website. It does not promise that records from an earlier Data Surfer product have automatically been deleted; contact us about earlier accounts or the legacy extension. We update this page when practices change and provide additional notice for material changes where required.