SurfBuddy Privacy Policy

Last updated: June 13, 2026

This Privacy Policy explains how R28 AI, Inc., a Delaware corporation that operates the SurfBuddy product ("SurfBuddy," "we," "us," or "our"), collects, uses, discloses, and protects personal data when you use the SurfBuddy web application or browser extension (the "Service"). It is incorporated into the SurfBuddy Terms of Service.

R28 AI, Inc. also operates a separate developer platform called R28. R28 has its own privacy notice and is not covered by this Policy.

By creating an account, installing the extension, or using the Service in any other way, you accept this Policy. If you do not agree, do not use the Service.

1. Where the Service is available

The Service is offered only to users located in the United States, Canada, Australia, New Zealand, Singapore, and Israel. The Service is not directed to, and is not available to, residents of any other country, including the European Economic Area, the United Kingdom, Switzerland, mainland China, Russia, Belarus, Iran, North Korea, Cuba, Syria, the Crimea region of Ukraine, or any country or person subject to U.S. or other applicable trade sanctions. We may detect your location and block access from other regions. Region-specific rights for users in Canada, Australia, New Zealand, Singapore, and Israel are described in Section 11.

2. Data we collect

A. Information you provide

Account data: name, email address, and profile details supplied through our identity provider.
Billing data: payment method, billing address, and transaction history, processed by our payment processor.
Conversation content: prompts, messages, attachments, and any context you submit to an Agent.
Outputs: responses, drafts, and tool-call results generated for you.
Feedback and support: ratings, reports, surveys, and help requests.
Preferences: notification choices, cookie consent, and other settings.

B. Information collected automatically

Device and app information: device type, operating system, browser, application version, locale, and time zone.
Network and logs: IP address (for security and rate-limit enforcement), request timestamps, error and latency logs, and feature flags.
Cookies and similar technologies: for sign-in, session continuity, preferences, analytics, and abuse prevention.
Server-side fetching: when our servers fetch a web page on your behalf, the destination site sees our server's IP, not yours.

C. Information from connected third-party services

When you connect a third-party service through OAuth (for example, Google Workspace or YouTube), we access only the scopes you authorize and only to perform actions you request through an Agent. You can disconnect any integration at any time, and you can revoke our access from inside the third-party provider's account settings.

For Gmail, the connection is made through a third-party integration provider acting on our behalf rather than through a direct Google API client. Section 7 (Google user data) applies regardless of which path is used.

D. Browser extension

The browser extension can attach the page you are currently viewing, a selection of text, a YouTube transcript, or other in-tab content as context for an Agent. The extension extracts page text via a readability library and converts it to markdown; it does not capture screenshots. Anything you attach is transmitted to AI inference providers to generate a response.

You are responsible for what you attach. Do not attach pages, selections, or transcripts that contain passwords, security tokens, API keys, session cookies, financial credentials, identity documents, health records, or confidential information you are not authorized to share with cloud AI providers. The Service does not inspect attachments for sensitive content before transmitting them.

3. How we use your data

Provide the Service you request, including running Agents, executing Agent Actions, and processing your conversations.
Operate and secure the Service, including fraud and abuse detection, rate-limit enforcement, incident response, and audit logging.
Maintain and improve performance and reliability, fix bugs, and develop new features.
Communicate with you, including service messages (account, security, billing, legal, and technical notices) you cannot opt out of, and product or marketing emails you can unsubscribe from.
Process payments and manage subscriptions through our payment processor.
Comply with law, respond to lawful requests, and handle disputes.
Conduct internal research and analytics on de-identified or aggregated data.

Model training

We do not train SurfBuddy's first-party models on your conversations, attachments, outputs, or other content.
When you invoke an Agent, the necessary inputs and context are sent to third-party AI inference providers to generate a response. Where their settings allow, we configure them to disable training and retention on our content. Their own terms still apply.
We do not retain or use Google user data to develop, improve, or train any AI/ML model. See Section 7.
Content flagged for safety or abuse may be reviewed by us or our security providers as needed to enforce our Terms or comply with law.

We do not sell your personal data, and we do not process personal data for cross-context behavioral advertising or targeted advertising of any kind.

We share data only in the following categories:

Service Providers (acting as processors). Cloud hosting and edge compute, application database, in-memory cache, AI inference, identity, payments, third-party API integration providers, web crawling and search, analytics, observability, and customer support. They may use the data only to perform services for us under written agreements with confidentiality obligations and may not use your data for their own purposes.
Connected third-party services. When you instruct an Agent to act in a service you have connected (for example, sending an email through Gmail), the relevant content is sent to that service to complete the action. That third party's own terms and policies govern the data once it is in their system.
Compliance, safety, and legal disclosures. Where we are required to disclose by law, court order, or lawful government request, or where disclosure is necessary to protect our rights, the Service, our users, or the public.
Business transfers. In connection with a merger, acquisition, financing, or sale of assets, your data may be transferred to a successor entity, subject to this Policy or a successor policy at least as protective.
With your consent. Any sharing you specifically direct.

A current list of named subprocessors is available on request by emailing privacy@surfbuddy.ai.

5. Data location

All conversation data, account data, database records, primary AI inference, hosting, and operational logging are located in the United States. Application servers that handle your data are pinned to U.S. regions. Static assets may be served from a global content delivery network, but the assets do not contain personal data.

6. Retention and deletion

Conversations and attachments are retained until you delete them or close your account. Soft-deleting a conversation in the Service hides it from your interface; hard deletion of conversation and account data is available on request by emailing privacy@surfbuddy.ai.
Account data is retained while your account is active and for a reasonable period after closure to comply with legal, billing, and security obligations.
Logs and telemetry are retained for limited operational periods.
Billing records are retained as required by tax and accounting law.
Backups and security logs may persist briefly after deletion of primary data and are overwritten on a rolling schedule.

To request account closure or hard deletion, email privacy@surfbuddy.ai from the address tied to your account. We will respond and act within the timelines required by applicable law.

7. Google user data

This section applies to all Google user data we receive or process in connection with the Service, regardless of whether we obtain it through a direct Google API integration or through a Service Provider acting on our behalf.

Limited purposes only. We access Google user data only to provide user-facing features you request (for example, reading selected threads, drafting and sending email, listing and creating calendar events, reading and updating documents, reading and appending spreadsheets, reading file metadata).
No advertising. We do not use Google user data for advertising.
No model training. We do not retain or use Google user data to develop, improve, or train generalized AI/ML models.
No sale. We do not sell Google user data.
Processor-only disclosure. We disclose Google user data only to Service Providers acting as processors under written agreements, only as necessary to operate the Service, and subject to confidentiality obligations.
No human review by default. We do not allow human review of Google user data, except with your explicit consent, to comply with law, or as needed for security or abuse investigations.
User control. You can disconnect at any time in the Service and revoke access via your Google Account permissions. On disconnection, tokens are revoked.
Compliance. Our handling of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.

8. What you must not submit

The Service is not designed for, and is not certified for, the categories of data listed below. You must not submit them through any input, attachment, or connected integration:

Protected health information regulated by HIPAA;
Cardholder data subject to PCI DSS;
Financial account data regulated by GLBA;
Government identification numbers (Social Security numbers, driver's license numbers, passport numbers, equivalent foreign identifiers);
Special categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, health data, or data concerning sex life or sexual orientation;
Children's personal information regulated by COPPA or equivalent.

Submitting such data is a breach of the Terms and is at your own risk.

9. Security

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the data, including encryption in transit, access controls, secrets management, audit logging, and vulnerability management. No system is perfectly secure. You are responsible for protecting your account credentials, your devices, and what you choose to attach to a conversation.

If we become aware of a security incident affecting your data, we will notify you and applicable authorities to the extent required by law.

10. Children

The Service is intended for users 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided personal data to the Service, contact us at privacy@surfbuddy.ai and we will delete it.

11. Your rights and choices

Subject to your jurisdiction and verification of your identity, you may have the right to:

Access the personal data we hold about you;
Correct inaccurate personal data;
Delete your personal data;
Receive a portable copy of personal data you provided to us;
Object to or restrict certain processing;
Withdraw consent to optional processing.

We do not sell personal data and we do not share personal data for cross-context behavioral advertising under U.S. state privacy laws. Marketing emails carry an unsubscribe link, and you can opt out of marketing at any time without losing access to the Service.

To exercise any right, email privacy@surfbuddy.ai from the address tied to your account. We will respond within the timelines required by applicable law. If we deny a request, you may appeal by replying to our decision.

United States state privacy laws

California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, Texas, and other state privacy laws may apply to residents of those states. We do not sell personal data and do not engage in cross-context behavioral advertising. You may submit access, correction, deletion, and portability requests as described above, and you may appeal a denial by replying to our decision.

Designated privacy contact

Our Privacy Officer is responsible for our handling of personal data and for responding to your requests and complaints. You can reach the Privacy Officer at privacy@surfbuddy.ai.

Authorized agents

Where the law of your jurisdiction permits, you may submit a rights request through an authorized agent or representative. To protect your data, we will verify the agent's identity and confirm that you authorized them to act for you before we act on the request.

Canada

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector (Law 25) apply. You may:

Access and correct the personal information we hold about you;
Withdraw consent to optional processing, subject to legal or contractual limits;
(Quebec) Receive personal information you provided to us in a structured, commonly used, and machine-readable format, and request that we transmit it to another organization where technically feasible;
(Quebec) Request that we stop disseminating personal information, or de-index a link that allows access to it, where dissemination contravenes the law or a court order.

We will respond within 30 days, or within the period required by applicable law. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or, for Quebec residents, the Commission d'accès à l'information du Québec.

Australia

If you are in Australia, the Privacy Act 1988 and the Australian Privacy Principles apply. You may request access to, and correction of, the personal information we hold about you. We will respond within a reasonable period, generally 30 days. If you are not satisfied with how we handle a request or complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

New Zealand

If you are in New Zealand, the Privacy Act 2020 applies. You may request access to, and correction of, the personal information we hold about you. We will respond within 20 working days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner.

Singapore

If you are in Singapore, the Personal Data Protection Act 2012 (PDPA) applies. You may request access to, and correction of, your personal data, and you may withdraw consent to our processing, subject to legal or contractual limits. Our Data Protection Officer can be reached at privacy@surfbuddy.ai. If you are not satisfied, you may contact the Personal Data Protection Commission (PDPC).

Israel

If you are in Israel, the Protection of Privacy Law applies. You may request access to, and correction of, the personal information we hold about you. Submit requests at privacy@surfbuddy.ai.

12. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure usage, and detect abuse. You can manage cookies through your browser settings; disabling some cookies may break parts of the Service (for example, sign-in).

13. Communications

We may send you service messages necessary to operate the Service (account, security, billing, legal, and technical notices). You cannot opt out of these while you maintain an account. We may also send product news, launch announcements, and other marketing emails. Each marketing email includes an unsubscribe link, and you can also unsubscribe by emailing support@surfbuddy.ai. Unsubscribing from marketing does not affect service messages.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted with an updated "Last updated" date and, where required, with additional notice through the Service or by email. Changes made for legal or compliance reasons may take effect immediately. Continued use of the Service after the effective date of a change indicates acceptance.

15. Contact

For privacy questions, deletion requests, and rights requests: privacy@surfbuddy.ai. For copyright notices and any other matter: support@surfbuddy.ai.

R28 AI, Inc. is the company responsible for the Service.