Privacy Policy

Surfeo ("we", "our", "us") operates the Surfeo platform (https://surfeo.ai), a SaaS service that helps businesses measure and improve their visibility in AI-generated responses. This policy explains how we collect, use, and protect your personal data.

By signing up or using our service, you agree to the practices described in this policy. If you have questions, contact us at hello@surfeo.ai.

1. Data controller

The data controller for your data is Surfeo, based in Spain. You can contact us at hello@surfeo.ai for any privacy-related inquiries.

2. Data we collect

We collect the following types of data:

3. Legal basis for processing

We process your data based on the following GDPR legal bases:

4. Service providers and data processors

We share data with the following providers, all of which have GDPR-compliant data processing agreements:

For transfers outside the EEA, we ensure adequate safeguards are in place (EU Standard Contractual Clauses or adequacy decisions).

5. Cookies

We use the following types of cookies:

You can manage your cookie preferences at any time through the cookie banner or your browser settings.

6. Data retention

We retain your data for the following periods:

When you delete your account, we erase all your personal and business data within 30 days. Payment records are retained as required by law.

7. Your rights

Under the GDPR, you have the following rights:

To exercise any of these rights, send an email to hello@surfeo.ai. We will respond within 30 days.

If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

8. Security

We implement technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Secure authentication with session tokens
• Role-based access policies (Row Level Security)
• Passwords hashed with secure algorithms (bcrypt)
• Periodic security reviews

9. Children

Surfeo is not intended for users under 16 years of age. We do not knowingly collect data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

10. Changes to this policy

We may update this privacy policy from time to time. We will post any changes on this page and indicate the date of the last update. For significant changes, we will notify you by email.

11. Google user data (Search Console)

If you choose to connect your Google Search Console account, Surfeo accesses your website's search performance data (search queries, clicks, impressions, and average position) in READ-ONLY mode through the Google Search Console API, using the "webmasters.readonly" scope that you explicitly authorize on Google's consent screen.

What we use it for

• Showing you your own website’s search visibility and traffic inside the platform.
• Measuring the real effect of the improvements applied to your website and proving it to you with data.
• Prioritizing which improvements the assistant suggests based on your website’s real opportunities.

• We do not sell this data or use it for advertising.
• We do not transfer it to third parties, except to the providers strictly required to deliver the service (section 4).
• No human reads it, except with your explicit permission for support, for security reasons, or where required by law.
• It is NOT used to train generalized artificial intelligence models.

We store your access credentials encrypted. You can revoke Surfeo's access to your Google account at any time from within the platform or from your Google account permissions. When you disconnect Google Search Console or delete your account, we delete the credentials and the imported Search Console data. Manage your Google account permissions.

12. Contact

If you have questions about this privacy policy or how we handle your data, contact us: