Privacy Policy

1. Who We Are

Surf Rank Pte. Ltd.
UEN: 202613085N
10 Marina Boulevard, #39-01
Marina Bay Financial Centre
Singapore 018983

SurfRank operates as both a data controller (for data we collect about our users) and a data processor (when processing brand data on behalf of our customers). This distinction is important for understanding your rights and our obligations.

2. Data Protection Officer

SurfRank has designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring compliance with applicable privacy laws.

Data Protection Officer
Chris Milliken
Surf Rank Pte. Ltd.
Email: [email protected]
Address: 10 Marina Boulevard, #39-01, Marina Bay Financial Centre, Singapore 018983

For all privacy-related requests, complaints, or questions, please contact our DPO directly at [email protected]. We will respond to all requests within 30 days.

3. Information We Collect

We collect only the data necessary to provide and improve our Services.

3.1 Account Information

• Full name and email address
• Company name, website URL, and business description
• Target country and industry selection
• Billing information and payment details (processed securely by Stripe — we do not store card details)
• Account preferences and selected AI engine configurations
• Profile settings and team member information

3.2 Usage and Platform Data

• AI visibility queries, scan results, keyword tracking data, and analytics generated by our platform
• Competitor tracking configurations and prompt discovery data
• Report history and visibility scores
• Feature usage patterns and interaction data
• Log data including IP address, browser type, device information, operating system, and pages visited
• Session duration and click-through data

3.3 Brand and Business Data

• Business descriptions, brand voice content, and materials you upload to Brand Overview
• Website URLs submitted for Quick Test or project analysis
• Keywords and prompts you configure for tracking
• Google Analytics data (if you choose to connect your account)

3.4 Communications Data

• Support requests, feedback, and correspondence with our team
• Survey responses and product feedback
• Email engagement data (opens, clicks) for communications you have opted into

3.5 Technical Data

• Cookies and similar tracking technologies (see Section 12)
• API access tokens and authentication data
• Device identifiers and session tokens

4. Lawful Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process your personal data under the following lawful bases as required by Article 6 of the GDPR:

If you wish to object to processing based on Legitimate Interest, please contact [email protected].

5. How We Use Your Information

We use the information we collect to:

• Deliver our Services — provide AI visibility tracking, reports, competitor analysis, prompt discovery, and content generation features
• Process transactions — manage billing, issue invoices, and handle subscription changes
• Generate AI visibility reports — run queries across AI engines using your brand information and keywords to produce your Visibility Score and reports
• Personalise your experience — tailor platform recommendations, content strategy, and Article Studio outputs based on your brand data
• Send platform communications — account confirmations, security alerts, report notifications, and product updates
• Provide customer support — respond to your questions, troubleshoot issues, and handle account requests
• Improve our platform — analyse usage patterns, fix bugs, develop new features, and enhance performance
• Ensure security — detect fraudulent activity, prevent abuse, and protect our platform and users
• Comply with legal obligations — meet our obligations under PDPA, GDPR, CCPA, and other applicable laws
• Send marketing communications — inform you about new features, offers, and AI search intelligence insights (only with your consent, and you can opt out at any time)

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects without human review.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to any third party.

We may share your information only in the following limited circumstances:

6.1 Service Providers

We share data with carefully selected third-party vendors who help us operate our platform. These providers are contractually bound to process your data only on our instructions and in accordance with this policy. See Section 7 for our full sub-processor list.

6.2 AI Engine Queries

When performing AI visibility scans, we send brand-related queries to AI engines (ChatGPT, Gemini, Perplexity, Claude, etc.). These queries contain only the brand keywords, prompts, and domain information you have configured — they do not include your personal information such as name, email, or billing details.

6.3 Google Analytics Integration

If you connect your Google Analytics account, we access your analytics data solely to display AI-referred traffic insights within your SurfRank dashboard. We do not store, share, or process this data beyond what is necessary to provide this feature.

6.4 Legal Compliance

We may disclose your information when required by applicable law, regulation, legal process, court order, or governmental authority. We will notify you of such requests unless prohibited by law.

6.5 Business Transfers

In the event of a merger, acquisition, sale of assets, or financing, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6.6 With Your Explicit Consent

We will share your information with third parties only when you have given us clear, explicit permission to do so.

6.7 Protection of Rights

We may disclose information to protect the rights, property, or safety of SurfRank, our users, or the public, where required or permitted by law.

7. Sub-Processors and Third-Party Services

We use the following categories of third-party sub-processors to deliver our Services:

All sub-processors are bound by data processing agreements and are required to implement appropriate technical and organisational security measures. We conduct regular reviews of our sub-processors to ensure ongoing compliance.

A full and up-to-date list of sub-processors is available upon request at [email protected].

8. Data Security

We implement comprehensive technical and organisational security measures to protect your personal data:

Technical measures:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 industry-standard encryption
• Multi-factor authentication (MFA) is enforced for all internal systems
• Role-based access controls restrict data access to authorised personnel only
• Regular penetration testing and vulnerability assessments
• Continuous security monitoring and intrusion detection

Organisational measures:

• Security awareness training for all staff
• Documented incident response procedures
• Vendor security assessments for all sub-processors
• Regular internal security audits
• Data minimisation practices — we collect only what we need

Breach Notification:

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and affected individuals without undue delay, in accordance with our obligations under GDPR and PDPA.

While we implement industry-leading security measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we continuously work to improve our protections.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements.

When you request account deletion, we will delete or irreversibly anonymise your personal data within 30 days, except where retention is required by applicable law.

10. Your Rights

Depending on your location, you have the following rights regarding your personal data. We will respond to all requests within 30 days.

All Users

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data (subject to legal retention requirements)
• Portability — Request your data in a structured, commonly used, machine-readable format
• Opt-out — Unsubscribe from marketing communications at any time via the unsubscribe link in any email or by contacting [email protected]

EU/EEA Users (GDPR)

All of the above, plus:

• Restriction — Request that we restrict processing of your data in certain circumstances
• Objection — Object to processing based on legitimate interest or for direct marketing purposes
• Withdraw Consent — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
• Complaint — Lodge a complaint with your national data protection authority

California Users (CCPA/CPRA)

All of the above, plus:

• Know — Know what personal information we collect, use, disclose, and sell
• Non-discrimination — We will not discriminate against you for exercising your privacy rights
• Limit sensitive data — Request that we limit the use of sensitive personal information
• Opt-out of sale — We do not sell your personal data. If this changes, you will be notified and given the right to opt out

To exercise any of your rights, please contact us at [email protected]. We may need to verify your identity before processing your request.

11. International Data Transfers

SurfRank is headquartered in Singapore. Your data may be transferred to and processed in countries outside of Singapore, including countries in the European Economic Area, the United States, and other jurisdictions where our sub-processors operate.

We ensure that any international transfer of personal data is subject to appropriate safeguards:

• For transfers to the EU/EEA: We rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal mechanism for data transfers
• For transfers to the US: We use Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework
• For transfers from Singapore: All transfers comply with the PDPA's requirements for cross-border data transfers, including ensuring the recipient country provides a comparable standard of protection

By using our Services, you acknowledge that your data may be processed in jurisdictions with different data protection laws than your own. We are committed to ensuring your data receives an equivalent level of protection regardless of where it is processed.

A copy of our Standard Contractual Clauses is available upon request at [email protected].

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Services.

Cookie categories we use:

• Strictly necessary cookies — Required for the platform to function. Cannot be disabled.
• Performance cookies — Help us understand how users interact with our platform
• Functional cookies — Remember your preferences and settings
• Analytics cookies — Help us improve our platform through usage analysis (only with your consent)
• Marketing cookies — Used to deliver relevant communications (only with your consent)

For EU/EEA users, we obtain your explicit consent before placing any non-essential cookies. You can manage your cookie preferences at any time via our Cookie Settings panel on our website.

13. AI Engine Data Processing

SurfRank's core function involves querying AI engines on behalf of our users. Here is how this works and what data is involved:

What we send to AI engines:

• Brand keywords, prompts, and domain names that you configure in your project
• No personal data (name, email, billing information) is included in AI engine queries

What AI engines return:

• AI-generated text responses to your configured prompts
• Citation links and source references used by the AI engine

How we use this data:

• To calculate your SurfRank Visibility Score
• To generate your project reports and insights
• To power competitor analysis and content gap features

Each AI engine you activate in your project is governed by that engine's own terms of service and privacy policy. By using SurfRank, you acknowledge that brand-related queries will be sent to your selected AI engines. We do not control how those engines process the queries we send.

14. Children's Privacy

Our Services are intended for business use and are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take immediate steps to delete such information. If you believe we may have collected data from a child, please contact [email protected] immediately.

15. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rights described in Section 10.

Categories of personal information we collect:

• Identifiers (name, email, IP address)
• Commercial information (subscription and billing records)
• Internet activity (usage data, log files)
• Professional information (company name, job role)
• Inferences drawn from the above to create a profile

We do not:

• Sell your personal information to third parties
• Share your personal information for cross-context behavioural advertising
• Discriminate against you for exercising your CCPA rights

To submit a CCPA request:

Email: [email protected]
Subject line: "CCPA Privacy Request"
We will respond within 45 days. Complex requests may require an additional 45 days with prior notice.

Authorised Agent:

California residents may designate an authorised agent to make requests on their behalf. We will require written verification of the agent's authority before processing such requests.

16. Singapore PDPA Compliance

SurfRank complies fully with the Personal Data Protection Act 2012 (PDPA) of Singapore and its associated regulations and guidelines issued by the Personal Data Protection Commission (PDPC).

Our PDPA commitments:

• We collect personal data only with your knowledge and consent
• We use personal data only for the purposes notified at the time of collection
• We do not retain personal data beyond the period necessary for its purpose
• We protect personal data using reasonable security measures
• We provide individuals access to and correction of their personal data upon request
• We comply with the mandatory data breach notification obligation — reporting breaches affecting 500 or more individuals to the PDPC within 3 days and notifying affected individuals without undue delay
• We ensure adequate protection for cross-border transfers of personal data

Do Not Call (DNC) Registry:

We comply with Singapore's Do Not Call Registry. We will not send marketing messages to Singapore telephone numbers registered on the DNC Registry without your explicit consent.

For PDPA-related queries or complaints, contact our DPO at [email protected] or write to us at our registered Singapore address above. You may also contact the PDPC directly at pdpc.gov.sg.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Post the updated policy on this page
• Send an email notification to registered users at least 14 days before the changes take effect
• For significant changes, require your acknowledgement before continued use of the Services

We encourage you to review this Privacy Policy periodically. If you disagree with any changes, you may close your account by contacting us at [email protected].

Previous versions of this Privacy Policy are available upon request.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Officer
Surf Rank Pte. Ltd.
Email: [email protected]
Website: surfrank.ai/privacy
Address: 10 Marina Boulevard, #39-01, Marina Bay Financial Centre, Singapore 018983

Response time: We aim to respond to all privacy requests within 30 days. Complex requests may require additional time, in which case we will inform you of the expected timeline.

Supervisory Authorities:

• Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
• European Union: Your local EU Data Protection Authority — edpb.europa.eu
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov