Privacy policy

This Privacy Policy explains how UpgradIQ, Inc. (a Delaware corporation, “we,” “us,” and “our”), which owns and operates Surfil at surfil.com, collects, uses, and protects personal information when you visit the site, use our products, buy a plan, add the Surfil Pixel to your website, or otherwise interact with the services we provide.

1. Information we collect

1a. Site visitors

When you visit the site we collect limited technical information automatically, including IP address (anonymized before storage), user-agent string, referring URL, and interaction events via PostHog (product events are recorded on our servers, without cookies) and Sentry (error monitoring). Neither service receives your full IP address. On surfil.com we also use Mixpanel for product analytics: the pages you view and a few key actions, tied to a random identifier (your account id once you sign in) and never to your name or email address. That in-browser analytics does not run when your browser sends Do Not Track or Global Privacy Control. Our servers also record a few account events (start of checkout, trial, payment, cancellation and first score) to run and improve the service, tied only to your account id, never to your name or email.

When you use your dashboard we also keep a random device id in a cookie, shared across surfil.com and its sub-domains, and record which devices an account has been used on. We use it only to limit how many devices share one account and to end access on a device that has been revoked. It holds no name or email address.

1b. Contact form submissions

If you submit the contact form, we store your name, email address, message content, and the timestamp of submission.

1c. Orders and billing

When you start a trial or buy a plan, we collect your name, email address, and the order details necessary to grant access and deliver the service. When a trial starts, we also keep a fingerprint of the card and the website so that one trial is given per person, card and website. Payment is processed by Stripe. Where a member paid by bank transfer before we moved to cards only, we keep the receipt they uploaded and the amount and reference of that transfer, so the payment can be matched and confirmed; the receipt is held in private storage that only an administrator can read. Card payments: we do not store card numbers or payment instrument details on our servers. Stripe holds and processes all payment card data and is subject to PCI-DSS compliance obligations. We receive and store a Stripe customer ID, payment confirmation, and order metadata (item type, amount, date) for accounting and service delivery purposes. Where you hold a membership we also store its plan, its status and the date the current period ends, because that date is what grants you access to everything on the site.

1c(ii). People added to a team plan

A team plan lets the account holder give the seats it includes to other people by entering their email address. That address reaches us from the account holder rather than from the person it belongs to, so we use it for one thing only: creating that person’s own account and sending them the link to set their password. We do not add them to any mailing list, and the account holder can remove a seat at any time, which ends that person’s access. Anyone added this way can ask us to delete their account by writing to hello@surfil.com, whether or not the account holder agrees.

1c(iii). Your business and its numbers

Members can describe their business (its name, website, type, stage, currency and a goal) and enter figures for it month by month, such as visitors, customers, revenue, marketing spend and margin. Members can also save their inputs in the site’s tools. We use this only to show those figures and the metrics worked out from them back to the member, and to tailor the tools and recommendations they see. We do not sell it, share it, show it to other members, or use it for advertising. We also use members’ figures in aggregated, de-identified form, combined with many other businesses so that no one of them can be identified, to operate and improve the service. A member can switch this off at any time in Settings, under Privacy and data; it applies from the next daily update, and the member’s own screens do not change. It is included in your data export and deleted when you delete your account.

We read the public pages, files and email records of the website you give for your business, as described in 1e, to run the site checks and show you the results. Advisor, our assistant, answers from our own content and, for a member, from the member’s own account data. It does not send questions to any AI provider to answer them. We keep a count of the questions a member asks. When a question cannot be answered, we keep the text of the question, without your name, email, account or IP address. We may use it internally, with contact details removed first, to write better answers; that drafting may use a contracted text-processing service provider. Please do not put personal details, such as names or contact information, in a question.

1d. Connected Google accounts

If you choose to connect your Google account, we request read-only access to your Google Analytics (GA4) and Google Search Console data (OAuth scopes analytics.readonly and webmasters.readonly). We use this data only to show your own metrics back to you inside your dashboard, to work out your Growth Score and recommendations, and to pre-fill your monthly visitors. For each workspace we store three things. Monthly totals for the last 12 months (users, sessions, your top traffic sources, and search clicks, impressions and average position). A daily series of up to 16 months (users, sessions, key events, and search clicks, impressions and average position). And, for the last 28 days and the 28 days before, the search queries and pages from Search Console and the landing pages from Google Analytics, with their clicks, impressions, position, sessions and key events. Each daily read replaces the previous one. We read only the property or site you select, and nothing else.

We never modify anything in your Google account, never use this data for advertising, never use it to train any AI model, and never sell it to anyone.

Who we share Google user data with. We do not share, transfer or disclose data received from Google APIs to anyone, except the following service providers, only to run the features you use, and only under contract:

• Supabase stores the figures we read and the OAuth tokens (database, EU region).
• Cloudflare hosts the application that reads and shows them.

We also disclose it if the law requires us to. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We store the OAuth tokens needed to read this data on your behalf; you can disconnect at any time from your dashboard, which revokes our access and deletes both the stored tokens and all the monthly, daily and page-level data we read with them from Google.

1e. Your website and the Surfil Pixel

Every day we read the public pages of the websites you add, including a rival’s if you add one, as any visitor could, to run the checks and show you the results. We do not log in to these sites.

If you install the Surfil Pixel on your website, it sends us page views, sources and AI referrals, real-user speed, conversions (form submits and tagged clicks), JS errors and 404s, with page paths cut at the query string, together with a visitor hash. The hash is built with a salt that rotates every day and is then discarded, so it cannot be linked to a person or followed across days. The Pixel sets no cookies and collects no name, email address, IP address or other personal data. Raw Pixel events are kept for up to 7 days; the daily summaries made from them are kept while your account exists. For this data, you are the controller and we act as your processor, under our Data Processing Addendum, which sets out how we handle it.

1f. Stripe revenue you connect

If you connect Stripe, you give us a restricted key that can only read. We store it encrypted (in Supabase Vault) and use it to read revenue figures shown back to you in your dashboard and reports. We never move money or change anything in your Stripe account. You can disconnect at any time, which deletes the key and the revenue figures we read with it.

2. How we use information

• To provide your plan: run site checks, scores, reports and recommendations, and process payments and renewals.
• To send the reminder before a trial converts to a paid plan, and other billing notices.
• To show members the metrics and recommendations worked out from their own business figures, and to send a monthly reminder to update them (which can be turned off in settings).
• To respond to inquiries submitted through the contact form.
• To send transactional emails related to your order (access links, receipts, course updates). All email goes through Amazon SES, and we keep its bounce and complaint notices, so we stop writing to any address that bounced or complained.
• To operate and improve the site and our products, using product events recorded on our servers via PostHog, without cookies, product analytics via Mixpanel, and error monitoring via Sentry.
• To operate site security and abuse prevention: rate limiting on form submissions and sign-in attempts.
• To comply with applicable legal and accounting obligations, including tax record-keeping.

2a. Shared workspaces

Inside a workspace, its owner and the editors and collaborators they invite can see the workspace’s numbers, tasks, Sprints, decisions, comments and votes, and who wrote each one. We record who invited whom and handovers in our audit log. When a workspace is handed to a new owner, its records move with it; your own account data stays with your account.

A share link shows only the sections its owner picked, to anyone holding the link, until it is withdrawn or expires. A public record page, if you turn it on, shows your name, handle and results as percentages, and nothing else. We process this information to provide the service you and your workspace owner asked for.

3. Legal bases

Where the EU General Data Protection Regulation, UK GDPR, the Brazilian LGPD, or comparable laws apply, we rely on the following legal bases: the performance of a contract or pre-contractual steps at your request (for processing orders and delivering services), our legitimate interests (for site security, fraud prevention and measuring how the site is used, where in-browser measurement stops when your browser sends Do Not Track or Global Privacy Control), and compliance with legal obligations (for accounting and tax records).

4. Cookies and tracking

We use a small set of first-party cookies and similar technologies for essential site functionality and for analytics, which we run on our legitimate interests and which, in your browser, stop when it sends Do Not Track or Global Privacy Control. We show no consent banner. See our Cookies Policy for the full list of technologies in use.

Essential cookies include Supabase sign-in cookies for your session, admin_session for administrator access, uiq_dev for the random device id kept for 1 year, uiq_dok for a 10-second device check, uiq_business for your selected workspace, OAuth state cookies such as g_oauth_state, for 10-minute connection checks, uiq_support for a 4-hour support session, ip_claim for a short payment reservation, admin_action_result for one admin confirmation message, and geo_country for signed-in country previews. uiq_for remembers a site audience for 30 days, and your light or dark theme is kept in local storage, as is the random identifier Mixpanel uses (no cookie). PostHog is server-side only here and sets no browser cookie. Stripe (checkout) and Cloudflare (hosting and bot protection) may set their own necessary security or payment cookies when you use their services through this site, for example at checkout.

5. Service providers

We share personal information with service providers acting on our behalf: Cloudflare (hosting, file storage, scheduled jobs, Pixel collection and DNS), Supabase (database, authentication and files not yet moved to Cloudflare, EU region), Stripe (payments), Amazon SES (email), Sentry (error monitoring), Mixpanel (product analytics), Upstash (rate limiting), PostHog (product events recorded on our servers), Google (only when you connect Search Console or Analytics) and AI text service (used only for internal drafting, and it receives text with contact details removed). The full list, with what each does, where it runs and when it is used, is on our subprocessors page. WhatsApp (Meta) is involved only if you choose to message us: the contact button is a link, nothing is sent until you tap it, and what you then write is handled under Meta’s own terms.

Each provider is contractually required to handle personal data consistently with this Policy and applicable law. We do not sell personal information and we do not share it for advertising.

6. International transfers

Surfil is operated by UpgradIQ, Inc., incorporated in Delaware. Some of our service providers are based in the United States or operate globally. Where personal information is transferred from outside the United States, we rely on standard contractual clauses or other lawful transfer mechanisms permitted by the data protection law of your jurisdiction.

This is where each kind of data is held. Accounts and business data are held in Frankfurt, Germany, and files preferably in Eastern Europe; the providers outside the EU, marked United States or Global network, receive the data they need to do their job from there. For Customer Data we process for you, a transfer from the EEA, the UK or Switzerland to them is covered by the Standard Contractual Clauses and, for the UK, the UK addendum, set out in section 10 of our Data Processing Addendum. For other personal information we rely on the transfer mechanisms described above. The full list of providers is on the subprocessors page.

7. Retention

• Order and customer records: retained as long as necessary to fulfil the service and for accounting and tax purposes (typically seven years from the transaction date in accordance with US tax record-keeping standards).
• Business profile, monthly figures and saved tool inputs · kept while the account exists, and deleted when the account is deleted.
• Pixel data: raw events for up to 7 days; daily summaries while the account exists; all of it deleted when the account is deleted.
• Connected-account data: Google totals and Stripe figures while connected, deleted when you disconnect or delete the account.
• Contact-form submissions: retained for up to twenty-four months for follow-up and audit purposes.
• Aggregated and anonymized data: may be retained indefinitely.

8. Export and deletion

You can download your data from Settings at any time. We email a link to the address on the account, and the link works for 7 days. You can ask us to delete your account from Settings: we confirm it with you by email, ask you to sign in again first, and finish within 30 days. A deletion request opened by a team owner for a seat holder, or by the daily privacy sweep for an account that has been over for a year, runs the same steps.

The sweep deletes an account 12 months after its plan ended or after its last failed payment, and warns you by email 60, 30 and 7 days before. It checks payment state again just before it erases anything: an account with an active plan, or a payment made since, is never erased. Your own deletion request is not held back by it. Deleting an account removes your business profile, figures, connected-account data and saved inputs. Payment and invoice records stay for the tax period of the market, and the audit record of account actions stays for 24 months, then is pruned.

9. Who sees what

• You and the people you add: team seat holders see the workspace they are given a seat in, and nothing else of yours.
• Investors you choose: an investor sees only the metrics you share with them, at the level you set, and you can end it at any time. A report taken for an investor is a copy as of its date.
• The public: a Verified certificate has a public check page that shows its scope, date, status and the numbers you picked for the badge, and nothing else. A company appears in the yearly ranking only if you opted in, and only while its certificate is active.
• Other members: never see your figures. Benchmarks use the aggregated, de-identified form described in 1c(iii) and are shown as Surfil Data.
• Our staff: administrators open an account only to give support or to run a request you made, and each such action is written to the audit record.
• Service providers: only those listed in section 5, for the purpose listed there.

10. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise these rights by emailing hello@surfil.com. We will respond within the timeframe required by applicable law. Note that some data (such as transaction records) may be subject to legal retention requirements that limit deletion.

11. Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit and at rest, row-level security on application databases, encrypted storage of connected-account credentials, anonymized IP storage in analytics and monitoring tools, rate limiting, hidden-field abuse detection on forms, and access logging. Card data is handled exclusively by Stripe and never stored on our servers. See our security page for more. No method of transmission is perfectly secure, so we cannot promise anyone absolute security.

12. Children

Our services are intended for adults. We do not knowingly collect personal information from children under sixteen.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent substantive change. Material changes will be communicated to affected users by email or a prominent notice on the site.

14. Contact

Questions about this Policy may be directed to: hello@surfil.com. Operated by UpgradIQ, Inc., a Delaware company. Our representative company in the United Arab Emirates is UpgradIQ FZC LLC (Ajman, UAE), licence 262517503888.