Legal
Privacy Policy
This policy explains what SurgeLab collects, why, and what we do with it.
SurgeLab is operated by SurgeLab AI Ltd, 17297397, 81 Fernhead Road, First Floor, London, United Kingdom, W9 3EA. We are the data controller for the information described here. You can reach us at support@surgelab.co.
Who this covers
- Customers who sign up for a SurgeLab account.
- The businesses ("brands") our customers manage inside SurgeLab.
What we collect
Your account. Your email address, and the details you give us about your brand: business name, website, location, opening hours, services, tone of voice and similar marketing information.
Billing. Payments are handled by Stripe. We never see or store your full card number. We keep a record of your plan, invoices and payment status.
Accounts you connect. If you choose to connect a third-party account (Google, Metricool, Square, Reddit and similar), we store the access keys needed to keep that connection working, plus the data the feature needs. You can disconnect any of them at any time from inside SurgeLab, which deletes the stored keys for that connection.
How you use the product. Basic product analytics so we can see which features are used and where people get stuck.
Google user data
SurgeLab asks for these Google permissions, and only these. Each is used only to provide the feature named beside it, shown back to you inside your own SurgeLab account.
- See Google Analytics data (read only) — to show you how visitors reach and move through your site. We never change anything in your Analytics.
- Manage your Google Business Profile — to read your business information and, only when you ask us to, publish posts, update details or reply to reviews on your behalf.
- Upload YouTube videos — to upload a video to your channel, only after you have reviewed and approved that specific video. We cannot read, edit or delete anything else on your channel.
Limited Use. SurgeLab's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we do not sell Google user data, we do not use it for advertising, and we do not transfer it to others except as needed to provide the features above, to comply with the law, or as part of a merger or acquisition. We do not allow humans to read your Google data except where you have explicitly asked us to help, where it is needed for security, or where the law requires it.
We keep your Google connection keys stored in our database with access restricted to your own account and brand. You can revoke SurgeLab's access at any time, either by disconnecting inside SurgeLab or from your Google Account permissions page at myaccount.google.com/permissions. Revoking access stops all further use immediately.
We do not send your Google Analytics data to AI model providers. Your Google Business Profile is the one exception: if you use the review reply feature, the text of a review is sent to an AI model so a reply can be drafted for you. A draft is only ever a draft. Nothing is published to your Google Business Profile until you have read it and approved it.
How we use your information
- To run the product you signed up for and show you your own results.
- To generate content for your brand, which you review before anything is published.
- To take payment and manage your subscription.
- To contact you about your account, and to give support.
- To keep the service secure, and to fix faults.
We do not sell your personal information, and we do not use it to target advertising.
Who we share it with
We use a small number of trusted suppliers to run SurgeLab. Each one only receives what it needs for its part, and only to provide its service to us. None of them are permitted to use your information for their own purposes.
- Payments. Stripe. We never see or store your full card number.
- Hosting, database and email. The providers that run our application, store your data and send you account emails.
- AI model providers. For generating text, images, voice and video for your brand, and for checking how AI assistants describe your business.
- Web and search data providers. For reading public web pages and search demand information.
- Publishing and scheduling. For sending content you have approved to your own social accounts.
- Product analytics. To understand which parts of the service are used.
We keep a current list of the specific companies in each category. If you would like it, email support@surgelab.co and we will send it to you.
We may also disclose information where the law requires it, or to protect our rights or the safety of others.
AI processing
SurgeLab sends your brand information and marketing content to the AI providers listed above so it can generate copy, images and video, and so it can check how AI assistants describe your business. Content you upload or we generate is processed for those purposes only.
Where your data is held
Our systems are hosted in the United Kingdom and the European Union. Some of the providers above process data in the United States. Where that happens, the transfer is covered by the safeguards those providers offer, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
How long we keep it
We keep your account information for as long as you have an account with us. If you close your account we delete or anonymise your personal information within 90 days, except where we must keep records for legal or accounting reasons, which for invoices in the UK is six years.
Connected account keys are deleted as soon as you disconnect that account.
Your rights
If you are in the UK or the EU you have the right to ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can also withdraw consent where we rely on it.
Email support@surgelab.co and we will respond within one month.
If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk.
Cookies
We use cookies that are necessary to keep you signed in, and product analytics to understand how the service is used. We do not use advertising cookies.
On surgelab.co we also use Google Analytics to count visits and see which pages are read. It is switched off until you accept it on the cookie notice, and you can decline without losing anything on the site.
Children
SurgeLab is a business tool and is not intended for anyone under 18.
Changes
If we change this policy we will update the date at the top, and tell you by email if the change is significant.