From 1990125458790d3ff80c2ffd981ec7d68acc7fb5 Mon Sep 17 00:00:00 2001 From: "DESKTOP-RTLN3BA\\$punk" Date: Thu, 21 May 2026 21:13:30 -0700 Subject: [PATCH] feat: update Privacy Policy with detailed data collection practices and usage information --- surfsense_web/app/(home)/privacy/page.tsx | 393 ++++++++++++++++------ 1 file changed, 286 insertions(+), 107 deletions(-) diff --git a/surfsense_web/app/(home)/privacy/page.tsx b/surfsense_web/app/(home)/privacy/page.tsx index 1bc939a1f..22833ae4a 100644 --- a/surfsense_web/app/(home)/privacy/page.tsx +++ b/surfsense_web/app/(home)/privacy/page.tsx @@ -1,190 +1,369 @@ import type { Metadata } from "next"; +import Link from "next/link"; export const metadata: Metadata = { title: "Privacy Policy | SurfSense", - description: "Privacy Policy for SurfSense application", + description: + "Privacy Policy for SurfSense. Learn how we collect, use, and protect your data, and how third-party services such as Google AdSense use cookies on our site.", alternates: { canonical: "https://www.surfsense.com/privacy", }, }; +/** + * Update this date whenever you make a material change to the policy. Keeping + * it as a static constant (rather than `new Date()`) avoids hydration + * mismatches and makes the policy look professionally maintained to reviewers + * (including AdSense reviewers). + */ +const LAST_UPDATED = "May 21, 2026"; + export default function PrivacyPolicy() { return (

Privacy Policy

-

Last updated: {new Date().toLocaleDateString()}

+

Last updated: {LAST_UPDATED}

1. Introduction

- Welcome to SurfSense. We respect your privacy and are committed to protecting your - personal data. This privacy policy will inform you about how we look after your personal - data when you visit our website and tell you about your privacy rights and how the law - protects you. + Welcome to SurfSense ("SurfSense", "we", "us", or "our"). We operate the website at{" "} + www.surfsense.com and the SurfSense application + (collectively, the "Service"). We respect your privacy and are committed to protecting + your personal data. This Privacy Policy explains what data we collect, how we use it, + who we share it with, and the rights you have over your data.

- By using our services, you acknowledge that you have read and understood this Privacy - Policy. We reserve the right to modify this policy at any time, and such modifications - shall be effective immediately upon posting the modified policy on this website. + By accessing or using the Service, you acknowledge that you have read and understood + this Privacy Policy. If you do not agree with our policies and practices, do not use + the Service. We may modify this policy from time to time; material changes will be + reflected by updating the "Last updated" date above.

2. Data We Collect

-

- We may collect, use, store and transfer different kinds of personal data about you which - we have grouped together as follows: -

+

We collect the following categories of personal data:

  • - Identity Data includes first name, last name, username or similar - identifier. + Identity Data includes first name, last name, username, or similar + identifier you provide when registering for an account.
  • - Contact Data includes email address and telephone numbers. + Contact Data includes email address and any contact information you + provide when reaching out to support or completing the contact form.
  • - Technical Data includes internet protocol (IP) address, your login - data, browser type and version, time zone setting and location, browser plug-in types - and versions, operating system and platform, and other technology on the devices you - use to access this website. + Account and Authentication Data includes hashed passwords (for local + authentication) and OAuth tokens issued by identity providers such as Google when you + sign in with a third-party account.
  • - Usage Data includes information about how you use our website and - services. + Chat and Knowledge Base Data includes the messages, prompts, + documents, and notes you submit through the Service when signed in. Anonymous chat + sessions on our free pages are not stored in any user-linked database.
  • - Surf Data includes information about surf sessions, preferences, and - equipment settings. + Document and Integration Data includes content from files you upload + and data fetched from third-party services you connect (such as Slack, Google Drive, + Notion, Confluence, GitHub, and others) under the scopes you authorize.
  • - Marketing and Communications Data includes your preferences in - receiving marketing from us and your communication preferences. + Billing Data includes information necessary to process payments + (such as transaction identifiers and credit balances). Card details are handled by + our payment processor and are not stored on our servers.
  • - Aggregated Data which may be derived from your personal data but is - not considered personal data as it does not directly or indirectly reveal your - identity. + Technical Data includes internet protocol (IP) address, browser type + and version, time zone, operating system, device identifiers, and other technology + identifiers from the devices you use to access the Service. +
    • +
  • + Usage Data includes information about how you interact with the + Service, such as pages visited, features used, referring URLs, and timestamps. +
    • +
  • + Advertising Data includes cookie identifiers, ad interaction data, + and pseudonymous identifiers set by Google AdSense and its partners on pages that + serve ads. See Section 5 for details. +
    • +
  • + Marketing and Communications Data includes your preferences for + receiving marketing communications from us. +
    • +
  • + Aggregated Data derived from any of the above and stripped of + identifiers. Aggregated data is not considered personal data under most laws.
-

- We may also collect, use and share Aggregated Data such as statistical or demographic - data for any purpose. Aggregated Data may be derived from your personal data but is not - considered personal data in law as this data does not directly or indirectly reveal your - identity. -

3. How We Use Your Data

+

We use your personal data only where we have a lawful basis to do so, including:

+
    +
  • + To create and manage your account, authenticate you, and provide the Service you have + requested. +
    • +
  • + To process payments, manage your credit balance, and prevent fraud and abuse of the + Service. +
    • +
  • + To answer your queries by sending prompts and content you submit to large language + model providers (see Section 8) and return the responses to you. +
    • +
  • + To synchronize data from third-party services you have explicitly connected (such as + Slack, Google Drive, or Notion) so that the Service can search and reference that + content on your behalf. +
    • +
  • + To monitor, analyze, and improve the Service, diagnose issues, and detect security + incidents. +
    • +
  • + To communicate with you about product updates, security notices, support requests, + and (with your consent where required) marketing. +
    • +
  • + To serve and measure advertising on pages where ads are shown (currently, our free + public pages). See Section 5 for details. +
    • +
  • To comply with legal obligations and enforce our Terms of Service.
    • +
+
+ +
+

4. Cookies and Tracking Technologies

- We will only use your personal data when the law allows us to. Most commonly, we will - use your personal data in the following circumstances: + We and our partners use cookies, local storage, and similar technologies to operate the + Service, remember your preferences, measure usage, and serve advertising. The + categories include:

  • - Where we need to perform the contract we are about to enter into or have entered into - with you. + Strictly necessary cookies and storage required for authentication, + session management, security (including CAPTCHA), and core functionality.
  • - Where it is necessary for our legitimate interests (or those of a third party) and - your interests and fundamental rights do not override those interests. -
    • -
  • Where we need to comply with a legal obligation.
    • -
  • - To provide and maintain our services, including to monitor the usage of our service. + Preference cookies and storage that remember choices such as theme, + language, and onboarding state.
  • - To improve our services, products, marketing, and customer relationships and - experiences. + Analytics cookies that help us understand how the Service is used so + we can improve it. We use PostHog for product analytics.
    • -
  • To communicate with you about updates, security alerts, and support messages.
    • -
  • To provide customer support and respond to your requests or inquiries.
  • - For business transfers, such as in connection with a merger, sale of company assets, - financing, or acquisition. + Advertising cookies set by Google AdSense and its partners on pages + that serve ads. These cookies are used to deliver relevant ads, measure ad + performance, and limit how often an ad is shown to the same user. See Section 5.

- We may use your information for marketing purposes, such as sending you information - about our products, services, promotions, and events. You can opt-out of receiving these - communications at any time. + You can control cookies through your browser settings. Blocking strictly necessary + cookies will prevent the Service from functioning correctly. Where required by law, we + request your consent before setting non-essential cookies.

-

4. Data Security

+

5. Advertising and Google AdSense

- We have put in place appropriate security measures to prevent your personal data from - being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. - In addition, we limit access to your personal data to those employees, agents, - contractors and other third parties who have a business need to know. -

-

- While we implement safeguards designed to protect your information, no security system - is impenetrable and due to the inherent nature of the Internet, we cannot guarantee that - information, during transmission through the Internet or while stored on our systems, is - absolutely safe from intrusion by others. -

-
- -
-

5. Data Retention

-

- We will only retain your personal data for as long as necessary to fulfill the purposes - we collected it for, including for the purposes of satisfying any legal, accounting, or - reporting requirements. To determine the appropriate retention period for personal data, - we consider the amount, nature, and sensitivity of the personal data, the potential risk - of harm from unauthorized use or disclosure of your personal data, the purposes for - which we process your personal data and whether we can achieve those purposes through - other means, and the applicable legal requirements. -

-
- -
-

6. Your Legal Rights

-

- Under certain circumstances, you have rights under data protection laws in relation to - your personal data, including: + Our free public pages (currently www.surfsense.com/free) are + supported by advertising served through Google AdSense, a service provided by Google + LLC.

    -
  • The right to request access to your personal data.
    • -
  • The right to request correction of your personal data.
    • -
  • The right to request erasure of your personal data.
    • -
  • The right to object to processing of your personal data.
    • -
  • The right to request restriction of processing your personal data.
    • -
  • The right to request transfer of your personal data.
    • -
  • The right to withdraw consent.
    • +
  • + Google, as a third-party vendor, uses cookies (including the DoubleClick DART + cookie) to serve ads to you based on your visits to our Service and other websites + on the Internet. +
    • +
  • + Google's use of advertising cookies enables it and its partners to serve ads to you + based on your visit to our Service and/or other sites on the Internet. +
    • +
  • + You may opt out of personalized advertising by visiting{" "} + Google Ads Settings. You may also + opt out of some third-party vendors' use of cookies for personalized advertising at{" "} + www.aboutads.info/choices (US) or{" "} + youronlinechoices.com (EU). +
    • +
  • + For users in the European Economic Area, the United Kingdom, and Switzerland, we + use a Google-certified Consent Management Platform to obtain your consent for + personalized advertising before such cookies are set. You may change or withdraw + your consent at any time through the consent banner. +
    • +
  • + We do not knowingly serve personalized advertising to children. See Section 11. +

- Please note that these rights are not absolute, and we may be entitled to refuse - requests where exceptions apply. If you wish to exercise any of the rights set out - above, please contact us. We may need to request specific information from you to help - us confirm your identity and ensure your right to access your personal data. + For more information about how Google uses data when you use our Service, see{" "} + + How Google uses information from sites or apps that use our services + + .

-

7. Third-Party Services

+

6. Data Security

- Our service may contain links to other websites that are not operated by us. If you - click on a third-party link, you will be directed to that third party's site. We - strongly advise you to review the Privacy Policy of every site you visit. We have no - control over and assume no responsibility for the content, privacy policies, or - practices of any third-party sites or services. + We implement technical and organizational measures designed to protect your personal + data against accidental loss, unauthorized access, alteration, and disclosure. Access + to personal data is limited to personnel who need it to operate the Service. +

+

+ No system can be guaranteed to be fully secure. We cannot guarantee that personal data + transmitted to or stored by the Service will be free from unauthorized access. You are + responsible for keeping your account credentials confidential.

-

8. Contact Us

+

7. Data Retention

- If you have any questions about this privacy policy or our privacy practices, please - contact us at: + We retain personal data only for as long as necessary to provide the Service and to + comply with our legal, accounting, and reporting obligations. Account data is retained + for the life of your account; you can request deletion at any time. Aggregated data + that no longer identifies you may be retained indefinitely for analytics and product + improvement purposes. Anonymous chat sessions on our free pages are not retained in + any user-linked database. +

+
+ +
+

8. Third-Party Services

+

+ We rely on the following categories of third-party processors and providers to operate + the Service. Each is bound by its own privacy policy, which we encourage you to + review: +

+
    +
  • + Authentication: Google (OAuth sign-in). +
    • +
  • + Hosting and infrastructure: Vercel, Cloudflare (CAPTCHA via + Cloudflare Turnstile, DNS, and edge protection). +
    • +
  • + Analytics: PostHog (product analytics). +
    • +
  • + Advertising: Google AdSense (see Section 5). +
    • +
  • + Large language model providers: OpenAI, Anthropic, Google, and + other LLM providers process the prompts and content you submit to the Service in + order to generate responses. +
    • +
  • + Integration providers: When you explicitly connect a third-party + service (such as Slack, Google Drive, Notion, Confluence, GitHub, Jira, Linear, or + similar), data is exchanged with that service under the scopes you authorize. +
    • +
+

+ We do not sell personal data to third parties. We share data with the providers above + only to the extent needed to operate the Service. +

+
+ +
+

+ 9. Your Legal Rights (Including GDPR) +

+

+ Subject to applicable law, you have the following rights in relation to your personal + data: +

+
    +
  • The right to access the personal data we hold about you.
    • +
  • The right to request correction of inaccurate or incomplete data.
    • +
  • The right to request erasure of your personal data ("right to be forgotten").
    • +
  • The right to object to or restrict certain processing of your data.
    • +
  • The right to data portability (to receive your data in a portable format).
    • +
  • + The right to withdraw consent at any time where we rely on consent to process your + data (such as for advertising cookies in the EEA, UK, and Switzerland). +
    • +
  • + The right to lodge a complaint with your local supervisory authority if you believe + our processing of your data infringes applicable law. +
    • +
+

+ To exercise any of these rights, please contact us using the details in Section 13. We + may need to verify your identity before responding to your request. +

+
+ +
+

10. California Residents (CCPA / CPRA)

+

+ If you are a California resident, you have additional rights under the California + Consumer Privacy Act (as amended by the CPRA), including: +

+
    +
  • + The right to know what categories of personal information we have collected about + you and how it is used and shared. +
    • +
  • The right to delete personal information we have collected from you.
    • +
  • The right to correct inaccurate personal information.
    • +
  • + The right to opt out of the "sale" or "sharing" of personal information for + cross-context behavioral advertising. We do not sell personal data; however, + advertising cookies set by Google AdSense may be considered "sharing" under + California law. To opt out, you can use the consent controls described in Section 5 + or enable a Global Privacy Control (GPC) signal in your browser, which we honor. +
    • +
  • The right not to be discriminated against for exercising your privacy rights.
    • +
+

+ To exercise your CCPA rights, please contact us using the details in Section 13. +

+
+ +
+

11. Children's Privacy

+

+ The Service is not directed to children under 13 (or under 16 in the EEA, UK, and + Switzerland). We do not knowingly collect personal data from children. If you believe + a child has provided us with personal data, please contact us and we will take steps + to delete it. We do not knowingly serve personalized advertising to children. +

+
+ +
+

12. Changes to This Policy

+

+ We may update this Privacy Policy from time to time to reflect changes in our + practices, technology, legal requirements, or for other operational reasons. When we + make material changes, we will update the "Last updated" date at the top of this page + and, where appropriate, provide additional notice (such as an in-product notification + or email). Your continued use of the Service after the updated policy becomes + effective constitutes your acceptance of the revised policy. +

+
+ +
+

13. Contact Us

+

+ If you have questions about this Privacy Policy or our privacy practices, or if you + want to exercise any of your rights, please contact us at:

- Email: rohan@surfsense.com + Email:{" "} + rohan@surfsense.com