Privacy Policy

SurfaceMap.cc (“SurfaceMap,” “we,” “us”) is operated by CC Marketing Group, a business based in Ontario, Canada. CC Marketing Group is the organization responsible for the personal information handled through the service.

For any privacy question, request, or complaint, contact our privacy contact at privacy@surfacemap.cc.

This policy applies to the SurfaceMap.cc website, the signed-in application, and the emails we send about the service. It does not apply to third-party websites, AI providers, or other services we link to, which have their own privacy policies.

SurfaceMap tests how supported AI models respond to a defined set of buyer-journey questions about a brand, audience, and market. We do not observe or collect your conversations with ChatGPT, Claude, Gemini, Grok, or any other AI assistant; we only process the inputs you give us and the responses the providers return to our requests.

Depending on how you use SurfaceMap, we collect:

• Account information — your name, email address, hashed password (for email sign-in), email-verification status, role, and team memberships.
• Brand and analysis inputs — the brand profiles you create and the questions we run on your behalf: brand name, category, region, target audience, use case, competitors, and key features.
• Analysis results — the AI responses, scores, cited sources, search queries, and reports generated from your runs, together with the models, prompts, and dates tested.
• Payment records — your purchase history, credit balance, and transaction identifiers. Card payments are processed by Stripe; we do not receive or store your full card number.
• Support and other communications — messages you send us and your email preferences.
• Technical and usage information — IP address, device and browser type, pages viewed, and similar analytics data collected automatically (see Cookies and analytics below).

We obtain information from:

• You, when you register, create brands, run analyses, buy credits, or contact us.
• Sign-in providers, when you choose to sign in with Google or Microsoft. We receive your name and email address from the provider; we do not receive your account password.
• Stripe, which confirms payment outcomes and returns transaction records.
• AI providers and public web pages, which return the responses and cited sources that make up your analysis results.
• Automatically, through cookies and analytics when you visit the site.

We use personal information to:

• Run the analyses you request and generate your reports.
• Save your brands, history, and results so you can track changes over time.
• Process credit purchases, maintain your balance, and keep billing records.
• Provide support and respond to your messages.
• Keep the service secure, prevent abuse, and enforce our Terms.
• Improve and develop the product, using aggregated or de-identified data where practical.
• Send service messages (for example, verification, receipts, and analysis-complete notices), and, with your consent, marketing email you can unsubscribe from at any time.

Running an analysis is the core of the service, and it requires sending your questions to third-party AI providers. When you run an analysis, we send the rendered prompt — which includes the brand name, category, region, target audience, use case, competitors, and key features you entered — to the models you selected:

• ChatGPT — OpenAI
• Claude — Anthropic
• Gemini — Google
• Grok — xAI

To ground their answers in current sources, these models may also run web searches derived from your questions. We access these models through their developer/API interfaces rather than their consumer products.

Each provider processes that input under its own terms, which govern whether and how long it retains the input and whether it may use it to improve its own services. We do not control those practices, and we encourage you to review the provider policies linked above. Because of this, you should treat the inputs you submit as information that leaves our systems, and you should not include sensitive personal information in your brand inputs (see our Terms).

We share personal information with vetted service providers that help us operate SurfaceMap, limited to what each needs to perform its role:

• Vercel — application hosting and content delivery.
• MongoDB Atlas — the database that stores your account, brands, and results.
• Stripe — payment processing and card handling.
• Twilio SendGrid — transactional and marketing email delivery.
• Upstash — the scheduling and background-job queue that runs scheduled analyses.
• Google — Google Sign-In and Google Analytics.
• Microsoft — Microsoft sign-in.
• The AI providers listed in Section 6 — to generate analyses.

We do not sell personal information. We may also disclose information if required by law, to protect our rights or users, or in connection with a corporate transaction such as a merger or sale, subject to this policy.

SurfaceMap and the providers above operate primarily in the United States and may process information in other countries. This means your information — including personal information — may be stored and processed outside Canada, where it is subject to the laws of those jurisdictions and may be accessible to their courts and authorities.

Using service providers outside Canada does not reduce our responsibility to protect your personal information. We take reasonable steps to ensure our providers offer a comparable level of protection through their terms and security commitments.

We use the following in your browser:

• Essential sign-in storage — a session cookie and/or local storage used to keep you signed in. The site does not function without it.
• Preference storage — local storage that remembers choices such as light/dark theme.
• Google Analytics — we use Google Analytics 4, which sets cookies (for example _ga) to measure traffic and usage. You can opt out with Google’s browser add-on or by blocking cookies in your browser.

Our web fonts are self-hosted, so loading a page does not send your details to a font provider.

Google Analytics and consent (EEA/UK). Google Analytics cookies are not essential to the service. If you are in the European Economic Area or the United Kingdom, consent is the legal basis we rely on for these analytics cookies. You can decline or withdraw consent at any time — through any cookie controls we provide, your browser’s cookie settings, or Google’s opt-out browser add-on — and declining analytics does not affect your ability to use SurfaceMap.

Your brands, analyses, and reports are private to your account by default. If you invite other people to a brand as members, they can view that brand’s data and reports according to their role. SurfaceMap does not publish your reports and does not create public, search-indexable report links.

If you export a report (for example, as a PDF or image) and share it yourself, you are responsible for who then sees it.

We keep account information and results for as long as your account is active and as needed to provide the service. Billing and transaction records are kept as long as required for tax, accounting, and legal purposes. Backups and logs are retained for a limited period and then overwritten on a rolling basis.

You can ask us to delete your account and associated personal information by contacting privacy@surfacemap.cc. We will delete or de-identify it except where we must retain certain records (for example, payment records for tax and accounting). Information already sent to AI providers is governed by their retention practices and may persist in their systems.

We use reasonable technical and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit (HTTPS/TLS), hashing of account passwords, payment handling by Stripe so we never store full card numbers, and access controls tied to accounts and brand memberships.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affecting your personal information creates a real risk of significant harm, we will notify you and the relevant authorities as required by law.

Subject to applicable law, you can ask us to access the personal information we hold about you, correct inaccuracies, delete it (see Section 11), or withdraw a consent you previously gave. You can also unsubscribe from marketing email at any time (see Section 14).

To make a request, contact privacy@surfacemap.cc. We may need to verify your identity first. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your local data-protection authority.

We send two kinds of email. Service messages — such as email verification, password resets, payment receipts, and analysis-complete notices — are part of the service and are not marketing. Marketing messages — such as product tips and re-engagement emails — are sent only on the basis permitted by Canada’s anti-spam law (CASL) and include our identity and a working unsubscribe link in every message.

You can unsubscribe from marketing email with one click from any such message, and we honor the request promptly. Unsubscribing from marketing does not stop essential service messages.

If you are in the European Economic Area or the United Kingdom, our lawful bases for processing are performing our contract with you (running analyses, billing), your consent (marketing, non-essential cookies), and our legitimate interests (securing and improving the service). You have rights to access, correct, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with your supervisory authority. For transfers outside your region, we rely on appropriate safeguards such as the providers’ standard contractual clauses.

SurfaceMap is a business tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under the age of majority in their province or country of residence.

We may update this policy as the service changes. When we make a material change, we will update the effective date above and, where appropriate, notify you. Your continued use of SurfaceMap after an update means you accept the revised policy.

Questions or requests: privacy@surfacemap.cc.