Privacy Policy

1. Information We Collect

We collect or access information you provide, information created through your use of SignalSurf, and information from sources you connect or direct us to use.

• Account and workspace data, such as your name, work email, organization, role, workspace membership, preferences, and authentication information.
• Customer content and business data, including projects, files, sheets, records, items, lists, prompts, workflow instructions, research, drafts, campaigns, messages, replies, and meeting artifacts.
• Connection data, access and refresh tokens, account identifiers, permissions, and content made available through services you choose to connect.
• Public web, company, professional, and social data, plus enrichment data obtained from sources and providers you select or use through SignalSurf.
• Usage, device, cookie, diagnostic, and security data, including IP address, browser or device information, activity logs, and feature interactions.
• Subscription and transaction metadata from our payment provider. We do not receive or store your full payment-card number.

2. How We Use Information

We use information to operate and improve SignalSurf and to fulfill your instructions, including to:

• Provide the shared GTM workspace, projects, files, records, lists, workflows, campaigns, content, listening, inbox, meeting, and agent experiences.
• Research, enrich, organize, summarize, classify, generate, and personalize content and recommendations with AI and rules.
• Carry out actions you configure or approve, such as enriching records, updating connected systems, scheduling content or meetings, and sending or managing outreach and replies.
• Send service, support, security, billing, and product communications.
• Authenticate users, prevent abuse, protect the Service, debug problems, measure performance, and improve reliability.
• Comply with law, enforce our terms, and establish or defend legal claims.

3. AI Processing and Automated Actions

SignalSurf uses artificial intelligence and rules to research, enrich, summarize, classify, draft, and automate work.

• Prompts and the minimum context needed to produce a result may be processed through Vercel AI Gateway and selected model providers.
• AI outputs may be incomplete or inaccurate. You should review outputs before relying on them or sending them to another person.
• Agents and workflows may prepare or carry out actions in connected services within the instructions, permissions, and approval controls you configure.

4. Connected Services and Google User Data

When you connect a third-party service, SignalSurf accesses data allowed by the permissions you grant and uses it to provide the features or actions you request. Other services may include CRM, productivity, code-hosting, communication, social, and email systems.

Google user data for Meeting Recorder

• calendar.events: read upcoming events and video-conference details so an AI notetaker can join meetings you select, and create or update events, Google Meet links, and attendees when you ask SignalSurf to schedule a meeting.
• calendar.freebusy: check availability before proposing meeting times.
• contacts.readonly and contacts.other.readonly: resolve an attendee display name only when the attendee email exactly matches an entry in Google Contacts or Other Contacts.
• gmail.readonly: when Contacts has no name, search for messages from the exact attendee email and read only the sender-authored display name in the From header. SignalSurf does not fetch message bodies for this lookup.
• userinfo.email: identify the Google account you connected.

Meeting audio, video, and transcripts are processed by Recall.ai so the Meeting Recorder can join, record, and transcribe selected meetings. Resulting meeting artifacts may be stored in your SignalSurf workspace.

You can disconnect an integration in SignalSurf. Disconnecting stops future access through that connection but does not automatically remove content already imported or created in your workspace. You can delete associated records or contact us to request deletion.

SignalSurf does not sell Google user data, use it for advertising, or use it to train generalized or non-personalized AI/ML models. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

5. How We Disclose Information

We disclose information only as needed for the purposes described in this Policy, including:

We do not sell personal data for money. Where a disclosure is treated as a sale or sharing under applicable law, we will provide the notices and choices that law requires.

• With service providers that support hosting, databases, AI processing, integrations, meeting recording, billing, email delivery, analytics, customer support, and security, under appropriate contractual restrictions.
• With third parties when you direct SignalSurf to connect, publish, send, schedule, enrich, import, export, or otherwise act on your behalf.
• With authorities or other parties when reasonably necessary to comply with law, protect rights or safety, prevent fraud or abuse, or investigate a security incident.
• As part of a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice requirements.

6. Retention and Deletion

Retention depends on the type of information, why we use it, workspace settings, contractual commitments, and legal requirements.

• We keep account and workspace data while your account is active and for as long as reasonably necessary to provide the Service, resolve disputes, enforce agreements, and meet legal obligations.
• We retain connected-service credentials only while needed to maintain the connection. Disconnecting an integration stops future access; deleting imported content or meeting artifacts is a separate action.
• Deleted data may remain for a limited period in backups, security logs, or records we must retain by law, then be deleted or de-identified under our retention practices.

7. Security

• We use reasonable technical and organizational safeguards designed to protect information, including access controls, encryption in transit and at rest where appropriate, logging, and data minimization.
• No system is completely secure. You are responsible for protecting your credentials and promptly notifying us of suspected unauthorized access.

8. Your Rights and Choices

Depending on where you live, you may have privacy rights over your personal data.

• Request access to, correction of, deletion of, or a portable copy of personal data, subject to identity verification and legal exceptions.
• Withdraw consent or disconnect an integration where processing depends on consent. You may also manage cookies through the choices presented on our website.
• Where California law applies, request to know, correct, or delete personal information, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service. SignalSurf does not sell personal information.
• Contact us at support@signalsurf.ai to exercise a right. You may also have the right to appeal our response or complain to your local data protection authority.

9. International Data Transfers

SignalSurf is operated from the United States, and we and our service providers may process information in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers.

10. Children

SignalSurf is a business service and is not directed to children under 16. If you believe a child has provided personal data to us, contact us so we can review and delete it where appropriate.

11. Changes to This Policy

We may update this Policy as SignalSurf, our providers, or applicable laws change. We will post the revised version here, update the date above, and provide additional notice when a change is material and notice is required.

12. Contact Us