Privacy Notice

This notice explains how LetsGetSurfaced Ltd ("we", "us", "our") collects, uses and protects your personal data when you use LetsGetSurfaced, whether you're in the UK, the EU/EEA, or elsewhere. We've tried to write it in plain language rather than dense legal text.

1. Who we are

LetsGetSurfaced Ltd, a company registered in England and Wales (company no. 17382741, registered office: 66 Paul Street, London EC2A 4NA), is the data controller for the personal data described below. You can reach us at support@letsgetsurfaced.com.

2. What we collect

• Account data: name, email address and authentication details, handled through our sign-in provider (Clerk).
• Billing data: billing address and transaction records, processed through Stripe. We never see or store your full card number ourselves.
• Your inputs and the AI outputs we generate: the brand and content details you give us to run an audit, and the resulting AI visibility, SEO, copy and schema results.
• Usage data: how you use the app, so we can keep it reliable and improve it.
• Communications: support emails, contact form messages, and anything else you send us directly.

3. Why we process it, and on what basis

We process your data to provide the Service you've subscribed to (performance of a contract), to keep the Service secure and improve it (legitimate interests), to communicate with you about your account and, where relevant, to send scheduled reports you've asked for (contract performance), and to bill you (contract performance and our legal obligation to keep financial records).

4. Who we share it with

We use a small number of specific, named service providers to run LetsGetSurfaced, not an open-ended list of "partners":

• Stripe: payment processing and billing.
• Clerk: account authentication.
• Supabase: our database and application hosting.
• Resend: sending you emails (reports, notifications, and replies to messages you send us).
• Vercel: hosting the application and this website, and privacy-friendly, cookieless analytics on this website (see Cookies, below).
• Google: Google Analytics and Google Tag Manager, used on this website for traffic and marketing analytics, only where you've given consent (see Cookies, below).
• Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google) and Perplexity: we send the queries needed to test your AI visibility to these providers in order to generate that part of your report. They process this on our behalf to return a response; per each provider's current API terms, inputs sent through their API are not used to train their underlying models. We'd encourage you to review each provider's own policies if you want the detail directly from the source, since terms can change on their end.

We don't sell your personal data, and we don't share it with anyone outside this list except where required by law, to enforce our Terms, or to protect the rights, safety or property of LetsGetSurfaced or our users.

5. International transfers

Several of the providers above are US-based. Where your data is transferred outside the UK or EEA, we rely on the safeguards required by UK and EU data protection law (including Standard Contractual Clauses where applicable) to make sure it's protected to a comparable standard wherever it's processed.

6. How long we keep it

We keep your account data for as long as your account is active, and for a limited period afterwards in case you want to reactivate it or in case we need it to resolve a dispute. Billing records are kept as long as required by UK tax and accounting law. If you'd like your data deleted sooner, get in touch and we'll action it, subject to any records we're legally required to retain.

7. Cookies

Strictly necessary. This website and the app (app.letsgetsurfaced.com) use cookies that are essential to make them work: session and security cookies, and authentication cookies from our sign-in provider, Clerk. These don't require consent under UK/EU cookie rules, and there's no way to switch them off other than not using the site.

Analytics. We use Vercel Analytics, which is cookieless by design: it doesn't set any cookies or track you individually, so it runs regardless of your cookie choice below. We also use Google Analytics and Google Tag Manager, which do set cookies and can be used to recognise repeat visits. These only run if you accept them in the cookie banner shown when you first visit the site; if you don't accept, they stay off. You can change your choice at any time using the cookie preferences link in the site footer. We don't use these cookies for advertising or share the data they collect with anyone outside Google acting as our processor.

8. Your rights

Under UK and EU data protection law, you have the right to access the personal data we hold about you, correct it, ask us to delete it, restrict or object to certain processing, and receive a copy in a portable format. Where we rely on your consent for something, you can withdraw it at any time. To exercise any of these, get in touch or email support@letsgetsurfaced.com; we'll respond within a month.

If you're not satisfied with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you're in the EU/EEA, your local data protection authority.

9. Children

LetsGetSurfaced is a business tool and isn't directed at, or intended for, children. We don't knowingly collect data from anyone under 18.

10. Changes to this notice

We'll update this notice as our processing activities change, and note the date at the top when we do. Material changes will be flagged by email or inside the app before they take effect.

11. Contact

Questions about this notice or your data? Get in touch or email support@letsgetsurfaced.com.