Privacy Policy

• Account information — your name, email address, organization name and role, provided when you register or are invited.
• Lead information — if you run a free scan, the name, work email, phone number, business name and the company you scanned, along with your consent to be contacted.
• Workspace content — the vendors you monitor, contact details you enter for them, notes, risk records, memos and generated reports.
• Monitoring findings — publicly available articles, filings, reviews and technical signals we retrieve about the companies you monitor.
• Usage data — basic product analytics events and technical logs used to operate and secure the Service.
• Payment data — handled by our payment processor. We receive only the subscription status and identifiers; we never see or store full card details.

We use information to:

• provide monitoring, scoring, risk records and reports inside your workspace;
• send scan results, alert digests and service notifications by email;
• manage subscriptions, billing and plan entitlements;
• secure the Service, prevent abuse and debug failures;
• contact you about RepSurf where you asked us to or where we have a legitimate interest.

Monitoring uses AI models to search public sources, verify whether a finding genuinely refers to your vendor, and classify severity. Vendor names, aliases and retrieved public content are sent to our AI and search providers to perform this work. We do not permit those providers to use your workspace content to train their models.

The vendors you monitor are businesses, and the findings we surface come from publicly available sources. Where such a finding incidentally names an individual, we process it for the legitimate interest of risk assessment. If you believe a finding about you is inaccurate or should not be retained, contact us and we will review it.

We do not sell personal information. We share it only with service providers who help us operate RepSurf — hosting and database infrastructure, AI and web-search providers, our email delivery provider, and our payment processor — and where required by law or to protect our rights. Within your organization, content is visible to the users your administrator invites.

Every record is scoped to your organization and enforced at the database layer, so users of one organization cannot read another's data. Access is authenticated, data is encrypted in transit, and internal access is limited to what is needed to run the Service. No system is perfectly secure, so we cannot guarantee absolute security.

We keep account and workspace data while your account is active, and for a reasonable period afterwards to meet legal, accounting and dispute-resolution needs. Lead details from free scans are kept until you ask us to remove them. You may delete vendors, risks and reports at any time from within the app.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to processing, or to withdraw consent to marketing contact. Email us and we will respond within the timeframe required by applicable law. Every marketing email includes an unsubscribe option.

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

RepSurf is a business tool and is not directed to anyone under 16.

We will post updates to this policy here and note the new effective date. Questions or privacy requests: support@repsurf.com.