1. Overview & Data Controller Identity
Resurfed AI (“Resurfed AI”, “we”, “us”, or “our”) provides an AI Answer Intelligence and Generative Engine Optimization (GEO) platform enabling software brands to monitor, benchmark, and analyze how their products appear in conversational AI search engines (ChatGPT, Google Gemini, and Perplexity).
Operating Entity: Resurfed AI is owned and operated by an independent sole trader based in the United Kingdom. There is no incorporated company, entity, or corporation; we never claim otherwise.
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the sole trader acts as the Data Controller for personal data collected and processed through the Resurfed AI service.
2. Age Requirement & Children's Privacy (18+)
Strict 18+ Age Limit: Resurfed AI is exclusively intended for businesses, professionals, and individuals who are at least eighteen (18) years of age. We do not knowingly collect, solicit, or maintain personal information from persons under 18. If we learn that personal data from a person under 18 has been collected, we will take immediate steps to delete that information permanently.
3. Information We Collect
When you register for, use, or interact with Resurfed AI, we collect:
- Account & Authentication Data: Your name, email address, password hash, and workspace details. If you choose to sign in using Google Workspace or Microsoft Azure Entra ID, we collect your basic profile data (name and email) from those identity providers. We also use essential cookies and local storage to manage secure Supabase authentication sessions.
- Workspace & Brand Monitoring Inputs: Monitored brand names, domain URLs, tracked competitor domains, target categories, customized personas, and prompt battery configurations.
- Billing & Payment Information: Payment card details and invoice receipts are processed directly by our payment gateway partner, Stripe (PCI-DSS Level 1 certified). Resurfed AI never receives or stores raw payment card numbers on our servers.
- GitHub Integration Data: If you install the Resurfed AI GitHub App, we store your installation ID, the repository names you authorize, and the pull requests we open on your behalf.
- Team Collaboration Data: Teammate email addresses and role assignments (Admin, Member, Viewer) invited to your workspace.
- Telemetry, Security & Diagnostics: Timestamps, feature usage counts, browser user-agents, and IP addresses. We utilize Cloudflare Turnstile on public endpoints to process IP addresses and behavioral signals strictly for bot protection and abuse prevention. We also utilize PostHog for product analytics, user journey measurement, and UI interaction telemetry (strictly subject to your cookie consent choices).
- B2B Prospect Data: We may collect publicly available B2B corporate data and infer business email addresses (e.g.,
founder@domain) to generate audit reports and conduct direct sales outreach.
4. How We Use Your Information & Lawful Basis
Under the UK GDPR, we process your personal data relying on the following lawful bases:
A. Contractual Necessity (To provide the service you signed up for)
- Executing scheduled AI visibility scans across external search engines.
- Computing Share of Voice (SOV) metrics, sentiment distributions, and citation authority rankings.
- Generating Generative Engine Optimization (GEO) task recommendations.
- Managing account subscriptions, billing, free trials, and sending requested Slack webhooks to your workspace.
- Admin Support Access: To troubleshoot technical issues or fulfill support requests, authorized operators have the technical capability to temporarily access or “impersonate” user workspaces. This access is strictly limited to technical support contexts.
B. Legitimate Interests (To secure, improve, and grow the platform)
- Using telemetry and Cloudflare Turnstile to protect against API abuse and scraping.
- Analyzing feature adoption and UI ergonomics using PostHog product analytics to guide software improvements (for users who have consented to analytics cookies).
- Sending automated weekly performance email digests via Resend (you may toggle these off at any time in Account Settings, or use the one-click unsubscribe link provided in every report).
- Processing publicly available B2B contact data to send personalized cold outreach emails.
5. Third-Party AI Models & Zero Training Policy
Resurfed AI queries external LLM search engines (OpenAI, Google GenAI, and Perplexity) via standard developer API endpoints.
Zero Public Model Training Policy: We utilize provider APIs under commercial non-training terms where offered. Your customized prompt batteries, financial ROI configurations, and workspace metrics are never used to train or fine-tune public foundation AI models.
6. Data Security, Sub-Processors & International Transfers
We implement industry-standard technical and operational safeguards:
- Database tenant isolation via PostgreSQL Row-Level Security (RLS) policies.
- Encryption of data in transit via TLS.
- Encryption at rest for database storage, as provided by our database host.
Sub-Processors & International Transfers: To operate the service, we share necessary data with trusted third-party service providers, primarily based in the United States. These include Supabase (database/auth), Vercel (web hosting), Render (background job hosting), Upstash (job queue), Stripe (billing), Resend (emails), Slack (alerts), Cloudflare (security), PostHog (product analytics), Sentry (error monitoring), GitHub (optional pull request deployment), OpenAI, Google, and Perplexity. Because we transfer UK data internationally, we rely on approved legal mechanisms, such as the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) provided by these vendors.
Honest Technical Disclosures: Resurfed AI is an independent software product operated by a sole trader. We do not hold SOC2 Type II certifications or formal institutional security accreditations, nor do we offer a 99.9% uptime SLA. We believe in complete transparency and do not make unsubstantiated corporate claims.
7. Data Retention & Deletion
We retain your account and workspace data for the duration of your active subscription or as long as your account remains open.
- Self-Service Data Export: Export all benchmark data, prompt records, and citation audits anytime in CSV or structured JSON formats.
- Instant Account Deletion (Danger Zone): You can permanently purge your workspace, user record, tracked brands, prompt batteries, and cancel active subscriptions directly from Dashboard → Account Settings → Danger Zone → Delete Account.
- Inactive Accounts: If an account remains inactive for 12 months following a canceled subscription, we may delete the workspace and its associated data. You can request deletion sooner at any time using the Danger Zone or by contacting us.
8. Your Rights (UK GDPR)
Under the UK GDPR, you have the right to access, rectify, export, restrict processing of, or permanently erase your personal data.
The Right to Complain: If you are a UK resident and believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Contact the Data Controller
If you have any questions, requests, or privacy inquiries, please contact the Operator directly:
- Data Controller: Oliver Greenwood, sole trader (United Kingdom)
- Postal Address: Wheatleys, Martinsend Lane, Great Missenden, HP16 9BH
- Trading As: Resurfed AI (resurfedai.com)
- Official Contact: team@resurfedai.com
- Privacy Officer: privacy@resurfedai.com
- Technical Support: support@resurfedai.com
- Jurisdiction: England & Wales, UK