Privacy Policy

Surgbly is operated by Yash Amin (yash@surgbly.com) and Vishvam Amin (vishvam.amin@surgbly.com), based in Ahmedabad, Gujarat, India.
Privacy contact: author@surgbly.com

Surgbly may act as a processor for customer website, analytics, and client data, and as a controller for account, billing, security, and marketing data.

Account information, organization and site information, site crawl data, search/analytics data (GSC, GA4), SEO/AEO/GEO monitoring data, CMS and integration credentials, Fix Pack and deployment data, AI prompts and generated outputs, usage analytics, billing information, marketing site data, security/audit logs, and support communications. We do not intentionally collect sensitive personal data.

Directly from you, from integrations you authorize, through crawling and monitoring jobs, from third-party data providers, via cookies and telemetry, from our billing provider, and from public/customer-authorized sources.

Each data category is mapped to a purpose (account creation, diagnosis, deployment, billing, security, support) and a legal basis (contract necessity, legitimate interest, legal obligation, or customer instruction). We do not sell personal data and do not use customer website content to train Surgbly-owned models.

Surgbly sends bounded customer content to AI/LLM providers (OpenAI, Anthropic, Perplexity, Google/Gemini) to classify issues, draft Fix Packs, and generate reports. We do not opt customer content into provider training.

Credentials are encrypted at rest and in transit, scoped to the connected site, never returned to the browser, and never exposed to AI systems. Connection, rotation, and revocation events are logged.

Before snapshots, proposed diffs, approvals, deployment attempts, verification results, and rollback records are retained to support rollback, support, and dispute resolution.

Raw crawl snapshots: 30–90 days. Fix/deployment rollback evidence: 12-month baseline. Billing, audit, and security records are kept as required by law. Deletion requests purge customer content while preserving only legally required records.

Reports, audit logs, findings, deployment history, and configuration can be exported through the app or by support request, subject to identity verification.

Access, correction, deletion, portability, objection, restriction, consent withdrawal, marketing opt-out, and the right to complain to a regulator. Contact author@surgbly.com; baseline response target is 30 days.

Strictly necessary, preference, analytics, marketing, and support cookies. Consent is requested where required by law.

Service, security, billing, and legal notices are sent regardless of marketing preferences. Marketing emails can be unsubscribed via the footer.

Data may be processed in India, the US, the EEA, and the UK, using SCCs, the UK IDTA, and provider DPAs where required.

Managed authentication, tenant isolation, encryption in transit and at rest, scoped integration access, audit logging, read-before-write snapshots, and rollback workflows. No system can be guaranteed secure.

Customer notice without undue delay, targeting no later than 72 hours after confirming a reportable incident, consistent with DPDP Rule 7 and GDPR Article 33.

The Service is for business use and not directed to children.

Agencies are responsible for their own client authorization and for providing required notices to clients and their users.

Surgbly may crawl public website content, which can still contain personal data. Customers are responsible for their sites' compliance.

Material changes are communicated through the app, email, or website before taking effect.

author@surgbly.com
Operated by Yash Amin (yash@surgbly.com) and Vishvam Amin (vishvam.amin@surgbly.com)
Ahmedabad, Gujarat, India