Privacy notice

Surge Solutions operates Studio365 and is the data controller for the personal data described here: we decide why and how it is processed. For data your organization stores inside the apps it builds, your organization is the controller and we process it on its behalf.

• Account data (name, email, login credentials, organization and role) — to create and secure your account and provide the service.
• Project content (prompts, chat with Amanda, code, files, settings) — to build, preview, version and export your software.
• Voice data, if you enable it — to transcribe requests. Microphone audio is not stored by default.
• Usage and technical data (credit usage, logs, IP address, device and browser identifiers) — for billing limits, security, fraud prevention, troubleshooting and product improvement.
• Support and marketing (messages you send, early-access requests, email preferences) — to respond to you and, with your consent, send updates.

We rely on performance of our contract with you (providing the service), legitimate interests (security, fraud prevention, improvement), consent (optional marketing, voice features and non-essential cookies), and legal obligation (tax and record keeping).

• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing. Paddle processes payment details under its own privacy notice; we do not receive full card numbers.
• Service providers for hosting, databases, AI model processing, preview sandboxes, email and support tooling, under contracts limiting their use of data.
• Professional advisers such as lawyers and accountants.
• Authorities where required by law.

Your project content is private to your project by default and is not used to train models for other customers. Any broader use requires explicit opt-in and review.

We keep account and project data while your account is active. After closure, data is deleted or anonymised within a reasonable period (target 90 days), except records we must keep for legal, tax, security or dispute purposes. Backups expire on their normal schedule.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent. UK/EEA users may complain to their data protection authority. We respond within one month. You can also export your projects at any time.

Our providers may process data outside your country. Where required, we use safeguards such as Standard Contractual Clauses.

We use technical and organisational measures including encryption in transit, access controls, organization isolation, encrypted secret storage and audit logging. No system is perfectly secure.

We use essential cookies and local storage for sign-in and security, and limited analytics to understand site use. You can manage cookies in your browser; blocking essential cookies may stop sign-in from working.

To exercise your rights or ask a privacy question, reach Surge Solutions through our contact page.