Privacy Notice

This notice explains how LetsGetSurfaced Ltd ("we", "us", "our") collects, uses and protects your personal data when you use LetsGetSurfaced, whether you're in the UK, the EU/EEA, or elsewhere. We've tried to write it in plain language rather than dense legal text.

1. Who we are

LetsGetSurfaced Ltd, a company registered in England and Wales (company no. 17382741, registered office: 66 Paul Street, London EC2A 4NA), is the data controller for the personal data described below. You can reach us at support@letsgetsurfaced.com.

2. What we collect

• Account data: name, email address and authentication details, handled through our sign-in provider (Clerk).
• Billing data: billing address and transaction records, processed through Stripe. We never see or store your full card number ourselves.
• Your inputs and the AI outputs we generate: the brand and content details you give us to run an audit, and the resulting AI visibility, SEO, copy and schema results.
• Free report requests: when you ask for a free AI visibility report on this website, the website address and email address you give us, anything you add in the optional boxes (the brands you compete with, the queries a buyer might type), the campaign tags on the link you clicked (for example, which ad or post sent you), and the page you came from.
• Usage data: how you use the app, so we can keep it reliable and improve it. On this website, and only if you allow analytics cookies, this also includes how you move around the pages.
• Communications: support emails, contact form messages, and anything else you send us directly.

3. Why we process it, and on what basis

We process your data to provide the Service you've subscribed to (performance of a contract), to keep the Service secure and improve it (legitimate interests), to communicate with you about your account and, where relevant, to send scheduled reports you've asked for (contract performance), and to bill you (contract performance and our legal obligation to keep financial records).

Free AI visibility reports. When you ask for one, we use your website address, email address and any optional answers to run the report and email it to you. It is in our legitimate interests to respond to a request you chose to make, and you get your report whether or not you tick the optional follow-ups box on the form. We only send follow-up emails if you tick it: a couple of emails about your report, which may include an invitation to try LetsGetSurfaced. Our basis for those is your consent. You can withdraw it at any time by replying to any of those emails or writing to support@letsgetsurfaced.com, and we'll stop. We also use the campaign tags and the page you came from to see which ads and posts led to requests, in our legitimate interests in knowing which of our marketing works.

Cookies. Analytics and advertising cookies are only used with your consent (see Cookies, below).

4. Who we share it with

We use a small number of specific, named service providers to run LetsGetSurfaced, not an open-ended list of "partners":

• Stripe: payment processing and billing.
• Clerk: account authentication.
• Supabase: our database and application hosting.
• Resend: sending you emails (reports, notifications, and replies to messages you send us), and delivering free report requests to our inbox.
• Vercel: hosting the application and this website, and privacy-friendly, cookieless analytics on this website (see Cookies, below).
• Google: Google Analytics and Google Tag Manager, used on this website for traffic and marketing analytics, only where you've given consent (see Cookies, below).
• Microsoft: Microsoft Clarity, used on this website to see how visitors use the pages, only where you've given consent to analytics (see Cookies, below).
• LinkedIn: we advertise on LinkedIn. Where you've given consent to advertising cookies, the LinkedIn Insight Tag runs on this website and LinkedIn receives details of your visit (see Cookies, below). LinkedIn's use of that data is covered by LinkedIn's privacy policy.
• Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google) and Perplexity: we send the queries needed to test your AI visibility to these providers in order to generate that part of your report. They process this on our behalf to return a response; per each provider's current API terms, inputs sent through their API are not used to train their underlying models. We'd encourage you to review each provider's own policies if you want the detail directly from the source, since terms can change on their end.

We don't sell your personal data, and we don't share it with anyone outside this list except where required by law, to enforce our Terms, or to protect the rights, safety or property of LetsGetSurfaced or our users.

5. International transfers

Several of the providers above are US-based. Where your data is transferred outside the UK or EEA, we rely on the safeguards required by UK and EU data protection law (including Standard Contractual Clauses where applicable) to make sure it's protected to a comparable standard wherever it's processed.

6. How long we keep it

We keep your account data for as long as your account is active, and for a limited period afterwards in case you want to reactivate it or in case we need it to resolve a dispute. Billing records are kept as long as required by UK tax and accounting law. If you'd like your data deleted sooner, get in touch and we'll action it, subject to any records we're legally required to retain.

If you ask for a free AI visibility report and don't go on to create an account, we keep your request details (website address, email address, optional answers and the report we sent) for up to 12 months from your request, so we can follow up and answer questions about your report, and then delete them. If you withdraw your consent or ask us to delete them sooner, we will, and we'll keep only a note that you opted out so that we don't email you again.

7. Cookies

Strictly necessary. This website and the app (app.letsgetsurfaced.com) use cookies that are essential to make them work: session and security cookies, and authentication cookies from our sign-in provider, Clerk. These don't require consent under UK/EU cookie rules, and there's no way to switch them off other than not using the site.

Analytics. We use Vercel Analytics, which is cookieless by design: it doesn't set any cookies or track you individually, so it runs regardless of your cookie choice below. We also use Google Analytics and Google Tag Manager, and Microsoft Clarity, which show us how visitors use the site (Clarity shows us clicks, scrolling and movement on a page, so we can see where people get stuck). Google Analytics and Clarity set cookies and can be used to recognise repeat visits. They only run if you allow analytics in the cookie banner; if you don't, they stay off. We don't use analytics cookies for advertising.

Advertising. We advertise on LinkedIn. If you allow advertising cookies, the LinkedIn Insight Tag runs on this website. It sets cookies that let LinkedIn recognise your browser, so that we can see which LinkedIn ads led to a free report request. If you're a LinkedIn member, LinkedIn may be able to link your visit to your LinkedIn profile. The tag stays off unless you allow advertising cookies, and this website sets no other advertising cookies. The links in our ads carry campaign tags that tell us which ad you clicked; those tags are part of the web address, not cookies.

Your choice. The cookie banner shown when you first visit lets you reject everything, allow analytics only, or accept all. Rejecting is as easy as accepting, and it doesn't stop you using the site or asking for a report. You can change your choice at any time using the cookie preferences link in the site footer. Where you've previously accepted analytics, that choice carries over as analytics only: we ask separately before switching on advertising cookies.

We follow the UK's Privacy and Electronic Communications Regulations (PECR) and UK data protection law for cookies and similar technologies.

8. Your rights

Under UK and EU data protection law, you have the right to access the personal data we hold about you, correct it, ask us to delete it, restrict or object to certain processing, and receive a copy in a portable format. Where we rely on your consent for something, you can withdraw it at any time. To exercise any of these, get in touch or email support@letsgetsurfaced.com; we'll respond within a month.

If you're not satisfied with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you're in the EU/EEA, your local data protection authority.

9. Children

LetsGetSurfaced is a business tool and isn't directed at, or intended for, children. We don't knowingly collect data from anyone under 18.

10. Changes to this notice

We'll update this notice as our processing activities change, and note the date at the top when we do. Material changes will be flagged by email or inside the app before they take effect.

11. Contact

Questions about this notice or your data? Get in touch or email support@letsgetsurfaced.com.