surfawiki
How it works Storage Pricing Support
Your data stays yours

Privacy Policy

We built surfawiki so your knowledge stays private. This policy explains, in plain language, what we collect, why, and the limits of our responsibility.

Last updated June 22, 2026 · Effective June 22, 2026

Contents

  1. Who we are
  2. What we collect
  3. How we use it
  4. Sharing & sub-processors
  5. Google user data
  6. Privacy by design
  7. Security
  8. Retention & deletion
  9. Your choices
  10. Disclaimer & limits
  11. Changes
  12. Contact
In short: we do not sell your data, we do not use the contents of your files to train foundation models, and we never use them to serve advertising. To answer a question, the question and the relevant passages from your documents are sent to the AI provider that generates the answer — see Sharing and sub-processors. Your wiki is private to you and accessible only with your credentials. At the same time, surfawiki is a tool, and as set out below, you remain responsible for your own data and for how you act on what the service produces.

1. Who we are

surfawiki is a product of SurfAWiki LLC ("surfawiki," "we," "us," or "our"), a limited liability company organized in the State of Florida, United States. This Privacy Policy applies to the surfawiki.ai website, the surfawiki web application, and the standalone surfawiki desktop application (together, the "Services").

2. What we collect

We collect only what we need to provide the Services:

  • Account information — your name, email address, and authentication details. Sign-in is handled through our identity provider, which holds your password; we never receive it. Where a legacy direct-login account exists, we store only a salted one-way hash of the password, never the password itself.
  • Content you connect or upload — the files, documents, and data from the storage locations and folders you explicitly grant us permission to ingest, and the wiki we build from them.
  • Credentials and access tokens — API keys you create, and the limited, scoped access tokens needed to read the storage you connect. Where possible these are read-only.
  • Usage and diagnostic data — basic logs about how the Services are used (for example, queries volume, errors, and performance) so we can keep the product working and secure.
  • Billing data — processed by our payment provider. We receive confirmation of payment and limited details such as the last four digits of a card; we never receive or store your full card number.

3. How we use your information

We use the information above to: create and secure your account; ingest the content you authorize and build and serve your private wiki; answer the queries you and your authorized tools submit; provide support; process payments; and maintain, troubleshoot, and improve the reliability and security of the Services.

We do not sell your personal information. We do not use the contents of your private files to serve advertising, and we do not use your content to train third-party foundation models.

4. Sharing and sub-processors

We do not share your content with other customers, and we do not disclose it to third parties except in the limited circumstances below:

  • Service providers (sub-processors) who help us run the Services under confidentiality obligations — for example, cloud hosting and infrastructure, our authentication provider, and our payment processor. They may process data only to provide their service to us.
  • AI model providers — if you use features that send a query and relevant retrieved context to a large-language-model provider to generate an answer, that content is transmitted to the provider you or we configure, solely to return your result. You may use your own API keys ("bring your own key") where supported.
  • Legal requirements — where we are required by law, subpoena, or valid legal process, or to protect the rights, safety, and security of users, the public, or surfawiki.
  • Business transfer — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Google user data

surfawiki's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace user data and developer policy, including the Limited Use requirements.

Specifically:

  • We use Google Workspace data only to provide and improve the document indexing, search and question-answering features that are visible and prominent in the surfawiki interface — the features you connected your drive in order to use.
  • We do not retain, use, or transfer Google Workspace data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Indexes and embeddings derived from your documents are built and stored per workspace, are used only to answer your own queries, and are deleted when your workspace is deleted.
  • To answer a question, surfawiki transmits your question and the specific passages retrieved from your documents to the AI provider named in the sub-processor table on our Security page. Those providers do not train their models on content sent through their APIs. Under their current published terms they may retain it for a limited period — up to 30 days — for safety and abuse monitoring, and we are pursuing zero-retention configurations with each of them. We transfer Google Workspace data to no other party except as required to provide these features with your consent, for security purposes, or to comply with applicable law.
  • surfawiki gets better over time by learning generic industry vocabulary — for example, that a particular manufacturer part number names a recloser. Only terms we can independently corroborate against at least two public sources enter that shared vocabulary, and your document contents, file names, quantities, prices and counterparty names never do. Nothing derived from your Google Workspace data is used to train, fine-tune, or evaluate a model shared with anyone else.
  • No human at surfawiki reads your documents. Access to content is limited to automated processing, except where you explicitly ask us to look at a specific file to help you, where data is aggregated and anonymized, or where access is necessary for security or legal compliance.
  • We do not sell Google user data, transfer it to data brokers or advertising platforms, or use it to serve advertising or to determine credit-worthiness.

6. Privacy by design

Each customer's wiki is isolated and reachable only with that customer's credentials. surfawiki supports private, repository, and air-gapped storage arrangements so that, depending on your configuration, your source content can remain within your own environment. We design the Services so that access is bound to your account and the keys you control.

7. Security

We use commercially reasonable administrative, technical, and organizational measures to protect your information, including encryption in transit, encryption at rest on our hosting provider's infrastructure, scoped access tokens, and credential-gated access to your wiki. We request read-only permission from any drive you connect, so we can never move, modify, or delete your files. API keys are stored only as a one-way hash, are shown to you exactly once, are scoped to a single workspace and role, and can be revoked at any time. We maintain an automated test suite that checks workspace isolation on every change. No method of transmission or storage is perfectly secure, however, and we cannot and do not guarantee absolute security. You are responsible for safeguarding your own credentials and API keys. Our Security page sets out these measures in full detail, names every sub-processor, and lists the gaps we have not yet closed.

8. Retention and deletion

We retain your content and account data for as long as your account is active or as needed to provide the Services. You may request deletion of your data or account by contacting us; we will delete or de-identify it within a reasonable period, except where we must retain limited records to comply with legal, tax, or security obligations. Backups and logs may persist for a limited time before being overwritten.

9. Your choices

You may access, correct, export, or delete your account information, disconnect any storage you previously connected, and revoke API keys at any time. Depending on where you live, you may have additional rights under applicable privacy laws; to exercise any of them, email us using the contact details below and we will respond as required by law.

10. Disclaimer and limits of responsibility

The Services are provided on an "as is" and "as available" basis. While we take privacy and security seriously, SurfAWiki LLC is not liable for loss, corruption, or unauthorized access to data arising from causes outside our reasonable control, from your own configuration or credential handling, or from third-party services you connect or direct us to use. surfawiki organizes and surfaces information automatically and using AI, which can be incomplete or inaccurate; you are responsible for independently verifying any output before relying on it. Your use of the Services is also governed by our Terms of Service, including its limitation-of-liability provisions, which are incorporated here by reference.

11. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you. Your continued use of the Services after a change takes effect means you accept the updated Policy.

12. Contact us

Questions about this Policy or your data? Email admin@surfawiki.ai and we will be glad to help.

This page is provided for general informational purposes and does not constitute legal advice.