Legal
Privacy Policy
Effective
This policy applies to the personal information Gateway Futures Inc. ( “Surface”, “we”) collects when you visit this website or use our products and services. It covers visitors to our website, customers, and users of our products.
“Personal information” means any information relating to an identified or identifiable individual. We may amend this policy from time to time; material changes will be announced on this page, and the effective date above will change.
What we collect
Information you give us
When you create an account, contact us, or request information, we collect what you provide. That is typically your name, email address, company name and job title, and billing details where you are a paying customer.
Information collected automatically
When you use the website or the application we collect your IP address, browser and device information, and information gathered by cookies and similar technologies. Those are described in our Cookie Policy.
Our application records product analytics and session replay through PostHog, hosted in the European Union. Session replay captures how the interface was used, including pages visited, clicks and navigation, so that faults can be reproduced and diagnosed.
Customer content
Our products store the traces, sessions and evaluation data that customers send to us. That content belongs to the customer, and we handle it as a processor on their instructions rather than for our own purposes. Where you are an end user of one of our customers, that customer’s privacy policy governs their use of your data and you should direct requests to them.
Why we use it
- To provide, operate and secure the products and services.
- To communicate with you about your account, support and changes to the service.
- To understand how the product is used, so we can improve it.
- To meet legal, accounting and regulatory obligations.
Where the GDPR applies, we rely on the performance of a contract for providing the service, our legitimate interests for securing and improving it, your consent for non-essential cookies, and legal obligation where the law requires us to keep records.
Who we share it with
We do not sell personal information for money. We share it with service providers who process it on our behalf and under contract. These are currently our analytics provider (PostHog), our consent manager (Osano), our payment processor (Stripe), our bot-protection provider (Cloudflare), and our hosting and infrastructure providers. We may also disclose information where we are legally required to, or in connection with a merger or acquisition.
Use of advertising and analytics technologies can constitute a “sale” or “share” under California law even where no money changes hands. You can opt out at any time. See Do Not Sell or Share My Personal Information.
How long we keep it
We keep personal information for as long as needed for the purposes above and to meet our legal obligations, then delete or anonymise it. Customer content is retained according to the customer’s configured retention settings and their agreement with us.
International transfers
We are based in the United States and our service providers may process data in the United States and elsewhere. Where personal information is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses and equivalent UK provisions.
Your rights
Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information; to object to or restrict how we use it; to withdraw consent; and to opt out of the sale or sharing of personal information. We will not discriminate against you for exercising these rights.
To make a request, use our privacy request form. You can also email us at privacy@surfacearea.ai. We will verify your identity before acting, and you may use an authorised agent. If you are in the EEA or UK you also have the right to complain to your local supervisory authority.
Global Privacy Control
We honour the Global Privacy Control (GPC) signal. If your browser broadcasts GPC, we treat it as a request to opt out of the sale or sharing of your personal information.
Children
Our products are for business use and are not directed at children. We do not knowingly collect personal information from anyone under 16.
Contact us
Gateway Futures Inc.
399 Fremont Street, San Francisco, CA 94105
privacy@surfacearea.ai