Privacy Policy

1. Information You Provide to Us

We collect information you give us directly when you use Surbee, including:

• Account information: name, email address, password, and profile details when you register
• Survey content: questions, logic, media, and any data you create or import
• Survey response data: answers, files, and other information respondents submit to your surveys
• Payment information: billing details, processed securely by our payment provider (we do not store full card numbers)
• Communications: messages, support requests, and feedback you send us

2. Information We Collect Automatically

When you or your respondents use Surbee, we automatically collect certain technical and usage data:

• Device and browser data: device type, operating system, browser, language, and screen settings
• Log data: IP address, access times, pages viewed, referring URLs, and actions taken
• Usage data: features used, surveys created, and how you interact with the platform
• Cookies and similar technologies: see our Cookie & Tracking Policy for the full list

We use the Vercel platform for hosting and infrastructure-level analytics. See "Cookies, Tracking & Analytics" below for how this works and how you can control it.

3. Survey Response & Fraud-Detection Data

When respondents complete surveys created on Surbee, we process:

• The survey responses and answers provided
• Response timing, completion, and progress data
• Behavioral and integrity signals used for fraud detection (response patterns, timing analysis, duplicate detection)
• Device and network information used for quality assurance

These signals power our Cipher fraud-detection system, which helps survey creators identify and filter fraudulent or low-quality submissions. As a survey creator, you are the controller of the responses you collect and are responsible for telling your respondents how their data will be used.

To tell real people apart from automated bots, published surveys run Cloudflare Turnstile, an invisible check that works in the background while a respondent completes a survey. It processes information about the respondent's browser and device, including the IP address, and its result is stored with the response. A response is never refused because of this check; a failed check is shown to the survey creator as a flag for review. Cloudflare processes this information as described in the Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/ (opens in a new tab)

Written answers may also be classified by TypeSafe, which judges whether an answer responds to the question, how much effort it shows, and whether it appears to be AI-generated or copied. Only the question and answer text are sent for this.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, secure, and improve the Surbee platform
• Power AI-assisted survey generation, editing, and analysis
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Process payments, manage subscriptions, and prevent billing fraud
• Communicate with you about service updates, security notices, and support
• Understand usage patterns and conduct internal research to improve the product
• Comply with legal obligations and enforce our Terms of Service

We do not use the content of your surveys or responses to train third-party foundation models, and we do not sell your personal information.

5. Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases to process your information:

• Contract: to provide the services you have signed up for
• Legitimate interests: to secure the platform, prevent fraud, and improve our products
• Consent: for non-essential cookies, analytics, and marketing communications (which you can withdraw at any time)
• Legal obligation: to comply with applicable laws, tax, and accounting requirements

6. Cookies, Tracking & Analytics

We use cookies, local storage, and similar technologies to keep you signed in, remember your preferences, measure usage, and improve the service.

• Essential: required for core functionality such as authentication and security
• Preferences: remember your settings and personalization choices
• Analytics: help us understand how the platform is used so we can improve it
• Marketing: measure the effectiveness of campaigns and deliver relevant content

On our public website, non-essential cookies are only set after you give consent through our cookie banner, and you can change your choices at any time. For the full breakdown of the technologies we use and how to manage them, see our Cookie & Tracking Policy.

7. AI Processing & Third-Party Subprocessors

To deliver AI-powered features, survey content you create may be processed by trusted AI providers, including OpenAI and TypeSafe. These providers process content under agreements that restrict use to delivering the service.

We also rely on the following categories of subprocessors to operate Surbee:

• Supabase: database, storage, and authentication
• Vercel: hosting, edge infrastructure, and platform analytics
• Stripe: payment and subscription processing
• ImageKit: media storage and delivery
• OpenAI: AI model inference
• TypeSafe: classification of written survey answers for response-quality checks
• Cloudflare: bot detection on published surveys (Turnstile)

Each subprocessor only receives the data needed to perform its function and is contractually required to protect it.

8. How We Share Information

We do not sell your personal information. We share information only:

• With subprocessors and service providers who help us operate the platform
• When you direct us to, or with your consent
• To comply with law, legal process, or enforceable governmental requests
• To protect the rights, property, and safety of Surbee, our users, and the public
• In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy

9. Data Security

We implement industry-standard safeguards to protect your information, including encryption in transit, secure authentication, access controls, and ongoing monitoring. No method of transmission or storage is completely secure, so while we work hard to protect your data, we cannot guarantee absolute security.

10. Data Retention

We retain your information for as long as your account is active or as needed to provide the service. Survey response data is retained according to your account and project settings. We also retain information where necessary to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account and associated data at any time.

11. Your Rights & Choices

Depending on where you live, you may have the right to:

• Access, correct, or update your personal information
• Delete your account and associated data
• Export or obtain a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent for analytics, marketing, or non-essential cookies
• Opt out of marketing communications at any time

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

12. International Data Transfers

Surbee operates globally, and your information may be transferred to, stored in, and processed in countries other than your own, including the United States. Where required, we use appropriate safeguards such as Standard Contractual Clauses to protect your data when it is transferred internationally.

13. Children's Privacy

Surbee accounts are only for people aged 18 or older, and our services are not directed to children. We do not knowingly create accounts for, or collect account information from, anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data.

Survey respondents do not need an account. A customer may choose to send a survey to people under 18. In that case, the customer controls that survey and its responses, and is responsible for getting any parental or guardian consent the law requires and for meeting children's privacy laws such as COPPA and the GDPR. We process those responses only on the customer's behalf and under their instructions, including through our automated fraud detection and analysis features, which never contact or interact with respondents.

If you believe a child has provided us with personal information without proper consent, contact us at [email protected] and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. For material changes, we will provide additional notice, such as by email or an in-product notice.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: [email protected]