Surpasso

Privacy Policy

How Surpasso collects, uses, shares, and protects personal information

Last updated: October 13, 2026

This Privacy Policy explains how Surpasso collects, uses, discloses, retains, and protects personal information when you visit, apply for early access to, or use Surpasso’s websites, applications, APIs, SEO/GEO research, content generation, analytics, and publishing services (collectively, the “Service”).

“Surpasso,” “we,” “us,” and “our” mean the person or entity operating the Service under the Surpasso brand. For information we use to operate the website, waitlist, accounts, billing, security, and our own business, Surpasso acts as the controller or business responsible for that information.

When a customer submits or connects personal information and instructs us to process it through the Service, the customer is generally responsible for deciding why and how it may be used, and Surpasso acts as its processor or service provider where applicable. Customers must give required notices, obtain required permissions, and avoid submitting regulated or highly sensitive data unless appropriate written terms are in place. Contact us before using the Service if your organization requires a data processing agreement.

1. Information we collect

The information we process depends on the features you use.

Account and contact information

We may collect your name, email address, profile image, preferred language, email-verification status, sign-in method, authentication-provider identifiers, and support or business communications. If you sign in through a third party, we receive the profile information and tokens authorized by that provider.

Workspace, website, and content information

We process website and product URLs, domains, company and brand details, target markets, audiences, competitors, keywords, prompts, instructions, article settings, briefs, drafts, generated articles, edits, images, files, publishing schedules, feedback, and other material you provide. Public pages we retrieve from a website may contain names, business contact details, author information, images, testimonials, or other personal information.

Research and performance information

We process SEO/GEO research inputs and results, search terms, search-volume and difficulty data, rankings, SERP features, competitor and content opportunities, source URLs, provider receipts, and workflow status. When you connect Google Search Console, we may process query, page, country, device, date, click, impression, position, indexing, inspection, and related property information used by the Analytics features.

Integration and publishing information

For connected services, we may store account or site identifiers, account email, property or destination URLs, permission levels, connection status, encrypted access and refresh tokens, API credentials, configuration, validation results, remote content identifiers, publication URLs, and publication attempt records. Content sent to a publishing destination may include article text, metadata, media, author information, categories, and tags.

Billing and transaction information

If paid services are offered, we may collect plan, order, invoice, transaction, payment-provider, amount, currency, tax, subscription, and billing-contact information. Payment providers generally process full payment-card or bank details; we receive transaction records and identifiers needed to administer purchases, refunds, disputes, and subscriptions.

Early-access and marketing information

If you apply for early access, we collect your email, website or product URL, website platform, selected SEO/GEO challenge, language, referral and campaign information, referring website, consent time, application status, and related communications. Submitting the form does not create a product account or automatically start a full website scan, although we may manually review the public website to evaluate fit.

We may collect IP address, user agent, device and browser information, approximate location inferred from IP, session and request identifiers, pages and features used, referring URL, UTM source, timestamps, cookie values or hashes, API activity, integration events, error codes, performance data, audit records, and security signals. We avoid placing Customer Materials or credentials in routine provider-health telemetry, but limited diagnostic metadata may be processed to investigate failures.

2. Sources of information

We obtain information:

  • directly from you and authorized users;
  • from your browser, device, and use of the Service;
  • from public websites, sitemaps, pages, search results, and other public sources you ask us to analyze;
  • from Google Search Console and publishing platforms you authorize;
  • from authentication, payment, analytics, research, crawling, AI, and other service providers; and
  • from an organization, agency, or account administrator that gives you access to the Service.

3. Why we use information

We use personal information to:

  • create and secure accounts, authenticate users, and manage workspaces;
  • analyze websites, build brand context, perform research, generate and edit content and media, recommend opportunities, and provide requested features;
  • connect third-party accounts, retrieve authorized data, validate integrations, and create drafts or publish content at your direction;
  • operate workflows, save progress, measure results, troubleshoot errors, prevent duplicate charges or actions, and provide support;
  • process early-access applications, communicate about the beta, and send product updates you requested;
  • administer plans, usage, orders, invoices, subscriptions, credits, and payments;
  • monitor reliability, protect the Service, prevent fraud and abuse, enforce terms, and investigate incidents;
  • improve usability, performance, safety, and feature quality using aggregated, de-identified, or appropriately limited operational data; and
  • comply with law, respond to lawful requests, establish or defend legal claims, and complete corporate transactions.

For people in the EEA, United Kingdom, or another jurisdiction that requires a legal basis, we rely as appropriate on: performance of a contract or steps requested before a contract; our legitimate interests in operating, securing, supporting, and improving a business service; your consent for optional connections, marketing, or non-essential technologies where required; and compliance with legal obligations. Where we rely on legitimate interests, we consider the effect on individuals and do not use that basis where their rights override our interests.

You are generally not legally required to provide information, but account, website, connection, billing, and instruction data may be necessary to provide the feature you request. Without it, some or all of the Service may not work.

4. Website analysis, AI, and provider data

When you add a website, the Service may discover and retrieve publicly available pages and assets, store bounded copies or extracts, and use them to create editable brand context, research, links, briefs, articles, and media. You must not direct us to bypass access controls or analyze a site without authority.

For AI features, relevant Customer Materials and public-source extracts may be sent to OpenRouter and the model providers selected through it. A request may also use a provider’s web-search capability. Website crawling may be performed through Firecrawl, and keyword or search research may use providers such as DataForSEO and SE Ranking. Those providers receive only the information reasonably needed for the requested operation, but they may process it in other countries and retain limited records under their terms, settings, and abuse-prevention requirements.

Surpasso does not use Customer Materials to train a Surpasso general-purpose AI model. Unless a product notice or written agreement expressly promises a particular retention setting, do not assume that an external AI or search provider offers zero retention. Do not include personal information, trade secrets, credentials, or confidential material in an AI request unless you are authorized to send it and the selected feature is suitable for it.

AI and research features support content workflows; they do not make solely automated decisions about individuals that produce legal or similarly significant effects.

5. Google Search Console and Google API data

Connecting Google Search Console is optional and requires your authorization through Google. Surpasso requests Google account identity and email information and the read-only Search Console permissions displayed on the consent screen. It does not request permission to change Search Console settings or site ownership.

The Service reads the sites you can access and may automatically match the complete Domain property for a workspace domain. We may store your Google account identifier, email, property or matching URL, permission level, authorization revision, connection status, encrypted access and refresh tokens, and token expiry. One authorization may be reused to match other workspaces you own, including workspaces you add later. Search-performance and indexing reports retrieved for Analytics may be stored so the Service can show history and avoid unnecessary repeated requests.

We use Google API data only to provide or improve user-facing features you request, maintain security, comply with law, or for other uses Google expressly permits. We do not sell Google user data, use it for advertising, use it to determine creditworthiness, or use it to train general-purpose AI models. We do not send Google Search Console data to general-purpose AI models unless a future feature clearly explains that use and obtains any required authorization first. Human access is limited to your instruction or consent, security and support needs, legal requirements, or appropriately aggregated internal operations.

Surpasso’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

You may disconnect Google in the Workspace. This removes the saved Google authorization and connection records from the active application database and stops new access for all workspaces using that authorization. You may also revoke access in your Google account connections. Previously retrieved reports, audit records, or content are handled under the retention and deletion rules below; disconnecting does not remove information held independently by Google.

6. Cookies and similar technologies

We use necessary cookies and similar technologies for authentication, security, OAuth connection state, rate limiting, language or interface preferences, and essential operation. We may use a first-touch campaign cookie or URL parameters to understand how users found the Service.

Depending on current configuration and your choices, we may use analytics providers such as Vercel Analytics, Google Analytics, Microsoft Clarity, Plausible, or OpenPanel to understand visits, feature usage, device characteristics, and performance. These providers may use cookies or similar identifiers and process IP, browser, page, interaction, and referral information under their own policies. Where applicable law requires prior consent for a non-essential technology, we will request it before enabling that technology for you.

You can restrict cookies in your browser, but necessary cookies are required for sign-in and some features. Because there is no universally accepted response to legacy “Do Not Track” signals, the Service does not currently respond to them. Where a legally recognized universal opt-out signal applies to a sale or sharing, we will treat it as required; as described below, we do not currently sell personal information or share it for cross-context behavioral advertising.

7. How we disclose information

We may disclose personal information to:

  • infrastructure and operations providers, such as Vercel, Cloudflare, Supabase, email-delivery, monitoring, and support providers;
  • AI, crawling, search, and research providers, such as OpenRouter and its selected model providers, Firecrawl, DataForSEO, and SE Ranking, when you use the relevant feature;
  • authentication, analytics, and payment providers when their services are configured or requested;
  • Google and connected publishing platforms, such as WordPress, WordPress.com, Shopify, Webflow, Wix, Ghost, Framer, Content API recipients, and webhook endpoints, when you connect them or direct an action;
  • your organization and its administrators, including an agency or workspace owner that manages your access;
  • the public and destination audiences, when you publish content or configure a public asset or endpoint;
  • professional advisers, authorities, and other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or establish and defend claims; and
  • transaction participants and advisers in a financing, merger, acquisition, reorganization, sale, or transfer, subject to appropriate confidentiality and any legally required notice or consent.

Providers may change as the Service evolves, and not every provider processes data for every user. We require providers to process information for contracted purposes and apply appropriate protections where required.

We do not sell personal information for money. We do not knowingly share personal information for cross-context behavioral advertising or use sensitive personal information to infer characteristics. If these practices change, we will update this Policy and provide any legally required notice and choice before the change applies.

8. International transfers

Surpasso and its providers may process information in the United States and other countries that may have different data-protection laws from your country. Where applicable law requires a transfer mechanism, we use a recognized mechanism or other lawful basis as appropriate, which may include adequacy decisions, contractual safeguards, or approved provider terms. You may contact us for information relevant to your transfer.

9. Retention and deletion

We retain information only for as long as reasonably necessary for the purposes described above, including to provide the Service, maintain continuity and backups, honor your choices, prevent fraud and duplicate actions, resolve disputes, enforce agreements, and meet tax, accounting, security, and legal requirements.

Retention depends on the type of information, account status, feature, sensitivity, contractual requirements, provider limits, and applicable law. For example:

  • active account, workspace, content, research, analytics, and integration records are generally kept while the account or feature remains active;
  • short-lived OAuth state and verification records expire after their security purpose ends;
  • waitlist information is kept while we evaluate and operate the early-access program or until you ask us to remove it, subject to suppression and legal records;
  • transaction and invoice records may be kept for legally required accounting and dispute periods; and
  • logs, provider receipts, deleted records, and encrypted backups may remain for limited security, reliability, recovery, and legal periods before being overwritten or deleted.

We may retain aggregated or de-identified information that cannot reasonably identify you. When deletion is requested, we remove or de-identify information from active systems unless retention is required or permitted, and remaining backup copies age out under normal cycles. Information already published to or held by a third party must be removed from that third party separately.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. Depending on the data and feature, these measures include access controls, least-privilege service roles, encryption in transit, server-side encryption or application-level encryption for certain credentials, ownership checks, bounded requests and responses, audit or attempt records, and security monitoring.

No transmission or storage system is completely secure. You are responsible for protecting your devices, passwords, API keys, webhook URLs, and connected accounts, limiting team access, and reviewing destination-site activity. If you believe your account or data may be at risk, contact us promptly.

11. Your choices and privacy rights

You can update some account and workspace information in the Service, disconnect integrations, revoke third-party authorization with the provider, and unsubscribe using a marketing email’s link where available. Operational, security, billing, and requested-service messages may still be sent.

Depending on your location and subject to legal exceptions, you may have rights to request access, correction, deletion, portability, restriction, or objection; withdraw consent; opt out of certain processing; and appeal a denied request. You may also complain to your local data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal.

Right to object: where we rely on legitimate interests, you may object based on your particular situation. You may object to direct marketing at any time.

California residents may, where the California Consumer Privacy Act applies, request to know the categories and specific pieces of personal information collected, sources, purposes, and recipient categories; request correction or deletion; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service without unlawful discrimination. We do not currently sell or share personal information as those terms are used for cross-context behavioral advertising, so we do not offer a sale/share opt-out link. The categories described in Sections 1, 2, 3, and 7 also describe our practices during the preceding 12 months.

To make a request, email support@supasso.ai and describe the account, information, and right involved. We may verify your identity and authority, for example through the account or email on file. An authorized agent may submit a request where local law permits, but we may request proof of authorization and identity. We will respond within the time required by applicable law.

12. Children

The Service is for business and professional users and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child provided information to us, contact us so we can investigate and delete it where appropriate.

13. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. The date above identifies the latest version. If a change materially affects how we use personal information, we will provide reasonable notice through the Service, email, or another appropriate channel before the change takes effect when required. We will seek consent if law requires it for a new use.

14. Contact

For privacy questions, rights requests, complaints, or security concerns, contact support@supasso.ai. If you have an account, writing from its email address helps us verify and respond to your request.