Privacy Policy

Last updated: October 30, 2026

This policy explains what personal information Surplyst collects, why, and what we do with it. Questions: contact@surplyst.com.

What we collect

• Account details: your work email address, and the name and organisation name you give when you create an account.
• Sign-in records: one-time sign-in links (stored only as a secure hash), the IP address a sign-in was requested from (used to prevent abuse), and your active sessions.
• Billing status: your plan, subscription status and renewal date, and the payment provider's customer and subscription identifiers. Card details are collected and stored by our payment provider, never by Surplyst.
• Account activity: a record of security- and billing-related events, such as account creation and plan changes.
• Website visits: a privacy-friendly count of page views on our public pages: the page, the website or campaign link you came from, your country and device type (phone or computer). It uses no cookies and does not store your IP address; a daily-changing code made from your connection and browser is used only to count visitors once per day and cannot follow you across days or sites. We also record which features you open after you sign in, to run and improve the product. Browsers that send a Do Not Track signal are not counted.

We do not use advertising or tracking cookies. The only cookie we set is a session cookie that keeps you signed in; our visit counts need no cookie.

How we use it

• To sign you in and keep your account secure.
• To provide the service you subscribe to and manage billing.
• To contact you about your account, billing, or important changes to the service.

We do not sell your personal information or share it for advertising.

Service providers

We use a small number of providers to run Surplyst. They process data only on our behalf:

• Cloudflare for hosting, the database, and file storage.
• Paddle (Paddle.com, our reseller and merchant of record) for payments, sales tax, invoices, and subscription management. Paddle processes your payment details as an independent controller under its own privacy policy.
• Resend for sending sign-in, account, alert and weekly digest emails. Every digest has a one-click unsubscribe link.
• Anthropic (Claude), when AI writing is switched on: the questions you type into Ask Surplyst and aggregate public market figures are sent to write briefs and answers. Your name, email, organisation and billing details are never sent.

How long we keep it

• Sign-in links expire after 15 minutes and are deleted within a day of expiring.
• Sessions expire after 14 days, or immediately when you sign out.
• Account and billing records are kept while your account is open and afterwards only as long as needed for legal, tax, and accounting obligations.

Market data

The market data in Surplyst comes from publicly available, aggregate reports published by state surplus lines offices and regulators. It contains carrier- and market-level statistics only. We do not collect or display insured-level or confidential policy information.

Your choices and rights

You can ask us to access, correct, export, or delete your personal information by emailing contact@surplyst.com. Depending on where you live, you may have additional rights under local law, and we will honour them.

Security

Traffic is encrypted with HTTPS. Sign-in links and session tokens are stored only as one-way hashes, and payments are handled entirely by Paddle.

Changes

If we change this policy in a material way, we will update the date above and notify account owners by email.