🔒 Privacy

Privacy Policy

Last updated: August 17, 2026

We take your privacy seriously. This policy explains what data we collect, why we collect it, who we share it with, and how you can control it. We are GDPR-compliant and committed to data minimisation.

1. Data Controller

Surf-Connect operates this platform. For GDPR purposes, Surf-Connect is the data controller for personal data collected through this website and app. Contact: privacy@surf-connect.com.

2. Data We Collect

Account data — name, email address, profile photo, role, bio, phone number. Collected when you register via Supabase Auth.

Booking data — lesson preferences, dates, payment status, instructor communications. Stored in our Supabase database.

Payment data — Stripe processes your payment card details. We never store raw card numbers. We receive tokenised payment confirmations and payout records.

Location data — if you grant permission, the Radar page uses your browser's geolocation to find nearby instructors. Your position is never stored on our servers. To label your position with a place name, our server looks it up against a geocoding service using a coarsened coordinate (rounded to ~1 km) — your precise position and your IP address are never sent to the geocoder.

Usage data — error and performance diagnostics (in-browser only with your consent, see Cookie Policy) and server-side error logs configured not to contain personal data.

3. How We Use Your Data

To create and manage your account (legal basis: contract).
To process bookings and payments (legal basis: contract).
To send transactional emails: booking confirmations, reminders, and session photos notifications (legal basis: contract).
To verify instructor certifications (legal basis: legitimate interest).
To prevent fraud and abuse (legal basis: legitimate interest).
To improve the platform via aggregated analytics (legal basis: legitimate interest).

4. Third-Party Services

Supabase — our database and auth provider. Data is stored on servers within the EU (Frankfurt region).
Stripe — payment processing. Stripe is PCI-DSS Level 1 compliant. See Stripe's Privacy Policy.
Vercel — hosting and content delivery. Your IP address is processed to deliver the site.
CARTO / OpenStreetMap — map tiles for the Radar and listing maps. When a map loads, your browser requests tiles directly from CARTO, which technically transmits your IP address and the requested map area. Tiles load only when you open a page with a map — a feature you actively request.
Komoot Photon — geocoding (place search and reverse geocoding). Called exclusively from our servers: only the search text or a coarsened (~1 km) coordinate is transmitted — never your IP address or precise position.
Sentry — error and performance diagnostics. In-browser monitoring runs only with your consent; server-side error logging is configured not to contain personal data. See the Cookie Policy.
Upstash — infrastructure for rate limiting and short-lived caching; request throttling is keyed by IP address.
Google — if you sign in with Google, your profile picture is loaded from Google's image servers, which technically transmits your IP address to Google.

5. Data Retention

We retain account data for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law (e.g. financial records for 7 years under EU accounting rules).

6. Your Rights (GDPR)

Access — request a copy of your data.
Rectification — correct inaccurate data via your profile settings.
Erasure — request deletion of your account and personal data.
Portability — receive your data in a machine-readable format.
Objection — object to processing based on legitimate interest.
Restriction — request limited processing in certain circumstances.

To exercise your rights, email us at privacy@surf-connect.com. We will respond within 30 days.

7. Cookies

We use strictly-necessary cookies (Supabase authentication, Stripe payment security, and the cookie that remembers your consent choice) without asking for consent, as permitted under ePrivacy rules. The only optional category is Diagnostics (in-browser Sentry error monitoring), which is off until you opt in via the consent banner. We do not use advertising or cross-site tracking cookies. Full details, including how to change your choice, are in the Cookie Policy.

8. Security

All data is transmitted over HTTPS. Passwords are hashed by Supabase Auth (bcrypt). Payment processing is handled entirely by Stripe — we never touch raw card data. Database access is row-level secured (RLS) via Supabase policies.

9. Changes

Material changes to this policy will be communicated via email 14 days in advance. The "Last updated" date above reflects the most recent revision.

📬 Data Protection Enquiries

Email: privacy@surf-connect.com

You also have the right to lodge a complaint with your national data protection authority (e.g. CNPD in Portugal, CNIL in France).

2. Data We Collect

Account data — name, email address, profile photo, role, bio, phone number. Collected when you register via Supabase Auth.

Booking data — lesson preferences, dates, payment status, instructor communications. Stored in our Supabase database.

Payment data — Stripe processes your payment card details. We never store raw card numbers. We receive tokenised payment confirmations and payout records.

Usage data — error and performance diagnostics (in-browser only with your consent, see Cookie Policy) and server-side error logs configured not to contain personal data.

3. How We Use Your Data

To create and manage your account (legal basis: contract).

To process bookings and payments (legal basis: contract).

To send transactional emails: booking confirmations, reminders, and session photos notifications (legal basis: contract).

To verify instructor certifications (legal basis: legitimate interest).

To prevent fraud and abuse (legal basis: legitimate interest).

To improve the platform via aggregated analytics (legal basis: legitimate interest).

4. Third-Party Services

Supabase — our database and auth provider. Data is stored on servers within the EU (Frankfurt region).

Stripe — payment processing. Stripe is PCI-DSS Level 1 compliant. See Stripe's Privacy Policy.

Vercel — hosting and content delivery. Your IP address is processed to deliver the site.

CARTO / OpenStreetMap — map tiles for the Radar and listing maps. When a map loads, your browser requests tiles directly from CARTO, which technically transmits your IP address and the requested map area. Tiles load only when you open a page with a map — a feature you actively request.

Komoot Photon — geocoding (place search and reverse geocoding). Called exclusively from our servers: only the search text or a coarsened (~1 km) coordinate is transmitted — never your IP address or precise position.

Sentry — error and performance diagnostics. In-browser monitoring runs only with your consent; server-side error logging is configured not to contain personal data. See the Cookie Policy.

Upstash — infrastructure for rate limiting and short-lived caching; request throttling is keyed by IP address.

Google — if you sign in with Google, your profile picture is loaded from Google's image servers, which technically transmits your IP address to Google.

6. Your Rights (GDPR)

Access — request a copy of your data.

Rectification — correct inaccurate data via your profile settings.

Erasure — request deletion of your account and personal data.

Portability — receive your data in a machine-readable format.

Objection — object to processing based on legitimate interest.

Restriction — request limited processing in certain circumstances.

To exercise your rights, email us at privacy@surf-connect.com. We will respond within 30 days.

7. Cookies