Privacy Policy

This policy explains how AS IT Solutions ("we", "us") collects and uses personal data when you use Surfaced. We collect what we need to run the Service, we do not sell personal data, and we do not use advertising trackers.

Effective 4 November 2026 · AS IT Solutions, Mumbai, Maharashtra, India

1. What we collect#

Data you give us

Account: name, email address, password (stored only as a secure hash) or Google sign-in details, and an optional profile picture.
Workspace: workspace and agency name, reply-to address, and the members of the workspace.
Sites and reports: website addresses, business descriptions, competitor lists, AI-visibility questions, brand settings and logos, and the email addresses of report recipients you add.
Payments: the pack bought, amount, currency, status and Razorpay order and payment references. Card, UPI and bank details are entered with Razorpay and never reach our servers.
Support: anything you send us by email.

Data collected automatically

Sessions and security: sign-in sessions with the IP address and browser user agent, verification codes and sign-in links (short-lived), and API key usage times. API keys are stored only as hashes.
Usage: credit transactions, audit history, emails sent by the Service and error logs.

Data about websites you audit

Our crawler fetches publicly available pages of the sites and competitors you add. Those pages can contain names or contact details published by the site owner. We use this content only to produce your reports and keep it as part of the report.

2. Why we use it#

To create and secure your account, verify your email, and sign you in.
To run audits, produce and store reports, and email them to the recipients you choose.
To process payments, keep credit balances, issue receipts and meet tax and accounting duties.
To send service emails: verification codes, sign-in links, receipts, low-credit notices and important changes. We do not send marketing email without your consent, and you can opt out at any time.
To prevent abuse, enforce limits, fix problems and improve the Service.

We process personal data on the basis of your consent when you sign up, to perform our contract with you, to meet legal obligations, and for legitimate uses such as security and fraud prevention, as allowed under the Digital Personal Data Protection Act, 2023 and other applicable law.

3. Who we share it with#

We share personal data only with service providers that help us run the Service, under contracts or terms that limit their use of it:

Hosting and database providers, which store the Service and its data.
Anthropic (Claude API), which receives website content, findings, business descriptions, competitor names and AI-visibility questions to generate fix plans, suggestions and AI-visibility answers. Under its commercial terms, Anthropic does not train its models on data sent through its API.
Google, for PageSpeed Insights (receives the page addresses being tested) and, if you choose it, Google sign-in.
Open PageRank, which receives domain names to return authority scores.
Razorpay, which processes payments.
Our email delivery provider, which sends Service and report emails.

We may also disclose data where the law requires it, to protect our rights or users' safety, or as part of a business transfer, in which case this policy continues to apply. Some providers process data outside India, including in the United States. Where we transfer data abroad we do so as permitted by Indian law and with safeguards in place.

4. Reports and share links#

Each report has a private share link. Anyone with the link can view the report, so share it only with people you choose. When you add recipients, we send them the report on your behalf; you are responsible for having a reason to send it. Recipients can ask the sender, or us, to stop.

5. How long we keep it#

Account, workspace, site and report data: while your account is active. When you ask us to delete your account, we delete it within 30 days, and remove it from backups as they roll over.
Payment and invoice records: as long as Indian tax and accounting laws require, even after the account is deleted.
Verification codes and sign-in links expire within minutes. Security logs are kept for a limited period.

6. Security#

Data is sent over encrypted connections, passwords and API keys are stored as hashes, and access to production data is limited. No system is completely secure, so we cannot guarantee absolute security, but we will notify you and the authorities of a personal data breach as the law requires.

7. Cookies and local storage#

We use only essential cookies, to keep you signed in and protect your session. We do not use advertising or third-party analytics cookies. Your browser's local storage remembers small preferences, such as a dismissed notice or your best score in the waiting-room game; this stays on your device.

8. Your rights#

Depending on where you live, you can:

ask for a summary of the personal data we hold about you and how we use it;
correct or update inaccurate data (most of it you can edit in Settings);
ask us to delete your data, subject to what the law requires us to keep;
withdraw consent, which stops future processing based on it but may mean we can no longer provide the Service;
nominate someone to exercise your rights if you die or become unable to;
if you are in the EU, UK or a similar jurisdiction, also object to or restrict processing and receive your data in a portable format;
raise a grievance with us, and if unresolved, complain to the Data Protection Board of India or your local data protection authority.

Email support@getsurfaced.in from your account address. We will reply within the time the law requires.