Privacy Policy

This Privacy Policy explains how IT Consulting Marek Frueauff, NIP 631-107-40-96, registered at Szopena 11c/5, 44-120 Pyskowice, Poland (the data controller, "we", "us"), collects and uses personal data through SurfaceDiff. We process data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data we collect

• Account data: the email address and account/company name you register with, and a hashed (never plaintext) password.
• Domain and scan data: the domains you choose to monitor, and the scan results, snapshots, diffs and incidents we generate from them.
• Billing data: payment details are collected and processed directly by our payment processor (Stripe) - we do not store your card details.
• Support correspondence: anything you send to support@surfacediff.com.
• Technical data: standard web server logs (IP address, timestamp, requested URL) for security and abuse prevention.

2. Legal basis for processing

We process account, domain and billing data to perform our contract with you (providing the Service). We process technical logs and security-relevant data on the basis of our legitimate interest in keeping the Service secure and reliable.

3. How we use your data

• To operate your account and run the scans you configure;
• To generate and show you incidents, reports and history;
• To bill you for your subscription;
• To respond to support requests;
• To maintain the security and integrity of the Service.

We do not sell your personal data, and we do not use it for advertising.

4. Cookies

SurfaceDiff uses a single essential cookie to keep you signed in (a session token). We do not use analytics or advertising cookies, and this cookie is not used to track you across other sites.

5. Where data is stored

Application data is hosted on infrastructure located in the European Union. Where we use processors located outside the EU (for example, our email or payment providers), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. Processors we use

We share data with processors only as needed to run the Service: our hosting provider, our transactional email provider (for account and alert emails), and Stripe for payment processing. Each acts under our instructions and is contractually bound to protect your data.

7. Retention

We keep account and scan data for as long as your account is active. If you close your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain records for legal, tax or accounting purposes.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data ("right to be forgotten");
• Request a portable copy of your data;
• Object to or request restriction of certain processing;
• Lodge a complaint with your local data protection authority - in Poland, the Urząd Ochrony Danych Osobowych (UODO).

To exercise any of these rights, contact support@surfacediff.com.

9. Security

Passwords are hashed with bcrypt and never stored in plain text. All traffic to and from SurfaceDiff is encrypted with TLS. Access to production data is restricted. More detail is available on our Security page.

10. Children

The Service is intended for business use and is not directed at individuals under 16.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last updated" date.

12. Contact

For any privacy question or request: support@surfacediff.com.