1. Customers
What we collect
When you create and use a SurfaceBee account, we collect your name, email address, and billing information.
Why we keep it
We use this information to run your account, provide support, collect payment, prevent abuse, and meet accounting or legal duties.
How long we keep it
We keep account information while your account is active. After closure, we keep only records needed for billing, tax, fraud prevention, disputes, or another legal duty, and only for as long as that duty requires.
2. Prospects and page visitors
Who controls the data
Customers may upload prospects' names, roles, companies, and sometimes photos. The customer decides what to upload, which pages to create, and who may see them.
The customer is the data controller. This means the customer decides why and how the data is used. SurfaceBee is the data processor. We handle that data on the customer's instructions.
What a page view records
When someone visits a published page, SurfaceBee records:
- The visitor's IP address.
- The browser and device user agent.
- An approximate location.
- A visitor identifier.
- Scroll and click events.
Erasure requests
A visitor who wants their data erased should contact the customer that sent or published the page. That customer is the controller. We help customers complete valid requests.
Page and visitor-data retention
We keep page content, uploaded prospect data, and related visitor records for the page lifetime in the customer's plan: 3, 6, or 12 months. If a customer cancels first, we keep them during the 30-day grace period while the pages stay live.
When the applicable period ends, the page shows an expired notice and we remove its personal data. We may keep limited records when needed for security, disputes, or the law.
Where data is processed
Cloudflare processes data through its global edge network. Our primary D1 database is in the APAC region.
Sub-processors
We use:
- Cloudflare for hosting, storage, and email delivery.
- Google Cloud / Gemini for page generation.
- Brandfetch for company logos.
Cloudflare email delivery supports SurfaceBee service messages. SurfaceBee does not send customers' prospect outreach.
What we do not do
We do not sell personal data.
We do not use any customer data—including account data, customer content, uploaded lists, or visitor data—to train models.
Security and breaches
We encrypt data in transit and at rest. Access is scoped to the people and systems that need it.
If a breach affects customer data, we notify affected customers and share the material facts and response steps.
Enterprise DPA
An Enterprise customer may request a Data Processing Agreement.
Contact
Privacy questions? Email support@surfacebee.com.