Legal

Privacy policy

Effective 17 July 2026

Surface is built and operated by Dolphin Analytics Ltd, a company registered in the United Kingdom ("we", "us"). This policy covers two things: what we collect when you visit asksurface.ai, and what Surface processes when your agency connects marketing accounts to it. Questions to olam@dolphinanalytics.co.uk.

Data we collect on this website

The early access form asks for your agency name, work email and rough number of clients. We store this in our database and use it for one purpose: talking to you about Surface early access. We do not add you to marketing lists or share these details with anyone.

This site sets no cookies and runs no analytics or tracking scripts.

Data Surface processes when you connect accounts

When your agency connects a client's marketing platforms (Google Analytics 4, Google Ads and Meta today; further platforms as they roll out), Surface pulls read-only reporting data: campaign metrics, spend, traffic and conversion figures. Surface does not read or write ads, audiences, creative or personal profiles, and never modifies anything in a connected account.

That data is stored in our database, hosted on Supabase in the European Union, and is used solely to provide the service to you: computing metrics, answering your questions and generating your reports. Every figure is computed in SQL from this data.

We do not sell this data, use it for advertising, or use it to train AI models. When Surface generates narrative text, pre-computed figures are sent to our AI provider (Anthropic) whose API terms prohibit training on that data.

Google user data

Surface's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google data is used only to provide the analytics features you see, is never sold or used for advertising, and is only transferred where necessary to provide the service, to comply with law, or with your explicit consent.

Meta platform data

Data received from Meta's APIs is handled the same way: read-only reporting data, used only to provide Surface's features to the agency that connected the account, retained only while the connection is active, and deletable on request. See our data deletion page.

Legal bases

Under UK GDPR we rely on: performance of a contract (providing Surface to your agency), legitimate interests (responding to early access enquiries, keeping the service secure), and consent (the account connections you explicitly grant, which you can revoke at any time).

Retention

Platform data is kept while the connection is active. When you disconnect an account or end your subscription, the associated data is deleted within 30 days. Early access form details are deleted on request, or when no longer needed.

Your rights

You can request access, correction, deletion or export of your data at any time by emailing olam@dolphinanalytics.co.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.

Sub-processors

We use a small number of service providers to run Surface: Supabase (database hosting, EU), Anthropic (AI narration), Railway (application hosting), and Vercel (this website's hosting). Each processes data only on our instructions.

Security

Data is encrypted in transit and at rest. Access within Surface is isolated per agency, and every client's data is scoped at the database level.

Changes

If this policy changes materially we will note the new effective date here and, for significant changes affecting connected accounts, email account owners.