Privacy Policy

1. Who we are

Group Alba Nova Limited (company number SC838019), trading as Surfacely, is the data controller for personal data processed through https://www.surfacely.me. Our registered office is 3 Hill Street, Third Floor, New Town, Edinburgh, Scotland, EH2 3JP. Contact: support@surfacely.me.

2. What data we collect

3. What we do not collect

• Store admin passwords or Shopify API credentials (unless you later connect an optional integration we offer)
• Pages behind login, paywalls, or authentication
• Your private analytics, order databases, or customer records

4. How we use your data

• Provide audits, reports, and account features
• Process subscriptions and send transactional emails
• Enforce usage limits and prevent abuse
• Maintain, secure, and improve the service
• Respond to support requests

We do not sell your personal data. We do not send marketing emails unless you separately opt in to a mailing list we may offer in future.

5. Legal bases (UK GDPR)

• Contract — to provide the service you sign up for
• Legitimate interests — security, fraud prevention, service improvement, and enforcing acceptable use
• Consent — where required for optional communications or non-essential cookies (we currently use essential cookies only)
• Legal obligation — where we must retain or disclose data to comply with law

6. How audits work

Audits request publicly accessible URLs associated with the domain you submit. We extract the same kind of information an AI crawler or search engine bot could access without credentials. Audit outputs are stored in our database and linked to your account when you are signed in.

7. Service providers

We use trusted third-party service providers to host, operate, and deliver the service — for example cloud infrastructure, payment processing, email delivery, and AI analysis. They process personal data only on our instructions and under contractual safeguards appropriate to their role. We do not publish a public inventory of providers.

8. International transfers

Some service providers may process data outside the United Kingdom. Where required, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or equivalent mechanisms recognised under UK data protection law.

9. Retention

We retain account and audit data while your account remains active. If you request deletion, we will delete or anonymise personal data within 30 days of verifying your request, except where we must retain data for legal, billing, or dispute-resolution purposes. Backup copies may persist for a limited period before being overwritten.

10. Your rights

Under UK data protection law you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability where applicable. To exercise these rights, email support@surfacely.me. We may need to verify your identity before acting on a request.

You may lodge a complaint with the UK Information Commissioner's Office: ico.org.uk.

11. Children

The service is not directed at anyone under 18. We do not knowingly collect personal data from children.

12. Security

We implement reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Changes

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated by email or in-product notice where appropriate.

14. Contact

Group Alba Nova Limited (trading as Surfacely)
3 Hill Street, Third Floor, New Town, Edinburgh, Scotland, EH2 3JP
Email: support@surfacely.me

See also our Terms of Service and Cookie Policy.