Privacy Policy

01Controller

ceed digital innovation GmbH, Martinstraße 25/4, 3400 Klosterneuburg, Austria. Email: hello@surge-search.com. We have not appointed a data protection officer because we are not legally required to.

02Visiting our website

When you visit surge-search.com, our hosting provider processes technical data your browser sends (IP address, date and time, requested page, referrer, browser and operating system) to deliver and secure the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Server logs are deleted after no more than 30 days.

We do not use analytics or advertising cookies on our marketing website. The search bar on our website sends your query to our API; it is processed like any other search (see “Search requests”).

03Account, trial and dashboard

When you start a trial or create an account we process your email address, the website URL you provide, your workspace settings, API keys (stored only as hashes) and login data. The dashboard stores a login token in your browser's local storage, which is strictly necessary for signing in. Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual steps). We keep this data for as long as your account exists and delete it within 30 days after termination, unless statutory retention obligations apply.

04Payments

Payments are handled by Stripe. We receive your name, billing address, email, VAT ID and payment status, but not your full card details. Legal basis: Art. 6(1)(b) and (c) GDPR. Invoices are kept for 7 years as required by Austrian tax law (§ 132 BAO).

05Emails

We send transactional emails needed to provide the Service (indexing finished, trial ending, billing). Legal basis: Art. 6(1)(b) GDPR. We may send occasional product updates to customers about similar services based on Art. 6(1)(f) GDPR and § 174(4) TKG 2021; you can unsubscribe at any time via the link in each email or by writing to hello@surge-search.com.

06Search requests on customer websites

When a visitor uses a search bar powered by Surge on a customer's website, we process the query text, the answer, and technical data such as the IP address. The IP address is used only for rate limiting and abuse prevention and is deleted automatically within a few minutes. Query text is stored without the IP address to provide analytics to the customer.

For this processing the respective website operator is the controller, and we act as their processor (Art. 28 GDPR). Please contact the website operator to exercise your rights; we will support them.

07Service providers (sub-processors)

We use the following service providers, bound by data processing agreements:

• Amazon Web Services EMEA SARL (Luxembourg) / Amazon Web Services, Inc. (USA): Hosting, database, storage and authentication (Amazon Cognito). Data is stored in the AWS region us-east-1 (USA).
• OpenAI, L.L.C. (USA): Creating embeddings of indexed content and queries, and generating answers. Data sent via the API is not used by OpenAI to train models.
• Stripe Payments Europe, Ltd. (Ireland): Payment processing, invoicing and subscription management.
• Sendinblue SAS / Brevo (France): Sending transactional emails (e.g. trial and indexing notifications) and managing our contact list.
• Google Ireland Ltd. (Google Fonts): Delivery of web fonts on our website; your browser connects to Google servers and transmits your IP address.

08Transfers outside the EU

Some providers process data in the USA. Transfers are based on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with additional safeguards such as encryption in transit and at rest.

09Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. Contact hello@surge-search.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in Austria the Datenschutzbehörde (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

10Security and changes

We use TLS encryption, encryption at rest, isolated per-workspace indexes, hashed API keys and least-privilege access. We may update this policy when our services or legal requirements change; the current version is always available on this page.