Privacy Policy

This policy covers two groups: account holders who use Surgedeck to build funnels, and visitors who enter an email address on a funnel page hosted by us on an account holder's behalf.

1. What we collect from account holders

• Account details: email address, display name, and the short bio you choose to add.
• Content you create: funnel names, offer links, generated page copy, and email copy.
• Integration data: an encrypted access token for your email provider when you connect one, plus the list and tag you select.
• Usage data: generation counts, page views, and error logs used to run and support the service.

2. What we collect from funnel page visitors

• The email address entered on the opt-in form.
• A non-identifying click identifier used for the account holder's own traffic reporting.
• A page-view record, without profiling or advertising cookies.

Those email addresses belong to the account holder who runs the funnel. They act as data controller for their subscribers; we act as processor and pass the address to the account holder's connected email provider.

3. How we use data

To provide the service, generate copy you request, host your pages, deliver opt-ins to your email provider, enforce fair-use limits, prevent abuse, and provide support. We do not sell personal data and we do not use subscriber email addresses for our own marketing.

4. Cookies

The app uses a session cookie or local storage entry so you stay signed in. Hosted funnel pages do not set advertising or tracking cookies.

5. Processors we use

• Cloud hosting and database, for the app and hosted pages.
• An AI provider, which receives the offer text you submit in order to draft copy.
• Your connected email service provider, which receives opt-in email addresses.
• An email delivery provider for account emails such as password resets.

6. Security

Data is isolated per account at the database level. Email-provider access tokens are encrypted with AES-256-GCM using a key held only as a server-side secret, never stored beside the encrypted values.

7. Retention

We keep account data while your account is open. Delete a funnel and its pages, copy, and opt-in records are removed. Close your account and we delete your personal data within 30 days, except where we must keep records for legal or accounting reasons.

8. Your rights

Depending on where you live you may request access, correction, deletion, export, or restriction of your personal data, and you may object to processing. Subscribers should contact the account holder whose funnel they opted in through; if you reach us instead, we will forward the request.

9. Children

The service is not intended for anyone under 18 and we do not knowingly collect their data.

10. International transfers

Data may be processed in countries other than yours, using appropriate safeguards for transfers out of the UK and EEA.

11. Changes and contact

We will post changes on this page. Privacy requests and questions: seth@johnsondaily.com.