Privacy Policy

1. About this Privacy Policy

AI Surf is currently in a controlled development and testing phase and is not yet generally available to the public.

This Privacy Policy explains how information may be processed when AI Surf is accessed or tested.

Before general public or commercial availability, this Privacy Policy will be updated with the full legal identity, registered address and privacy contact details of the entity operating AI Surf, together with the final processor, subprocessor, retention and international-transfer information.

2. Information We Process

Depending on how AI Surf is used, we may process:

• account and identity information, including name, email address, authentication information and account identifiers;
• workspace information, including organisation membership, roles, invitations, permissions, subscriptions and entitlements;
• prompts and instructions submitted to AI Surf;
• final AI-generated responses;
• uploaded or connected content where a feature allows it;
• AI-agent execution information;
• web-search queries and search results;
• retrieved web content;
• usage, error, security and audit information;
• support or other communications.

For agent runs, the current system stores the prompt and final answer associated with the run.

For web searches, the current implementation stores the search query up to 200 characters, together with result titles, URLs without query-string values, and snippets of up to 200 characters.

For retrieved webpages, AI Surf may store a content preview of up to 1,500 characters. Credential-shaped strings are redacted before the stored page preview is persisted.

Prompts themselves are not currently filtered for credentials or sensitive information before they are stored and sent to the AI-model provider. Users should therefore never enter passwords, API keys, authentication secrets or unnecessary sensitive personal information into prompts.

3. Why We Process Information

Information may be processed during development to:

• provide and test AI Surf;
• authenticate users;
• operate workspaces, roles and permissions;
• process invitations and account access;
• execute AI and agent requests;
• perform public web search and web-content retrieval;
• provide subscriptions and entitlements;
• maintain security and prevent misuse;
• diagnose failures and technical problems;
• maintain auditability;
• measure technical usage and service performance; and
• improve the reliability and operation of the service.

Where the GDPR applies, processing will rely on an appropriate legal basis depending on the activity, including performance of or preparation for a service agreement, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is required.

4. AI Processing

AI Surf uses artificial-intelligence models to generate responses and perform authorised agent tasks.

The current production system uses Anthropic as its enabled AI-model provider.

Information included in a prompt or agent task may therefore be transmitted to Anthropic where necessary to execute the requested operation.

Prompts and resulting responses may also be stored within AI Surf as part of the relevant execution record.

Users should not submit unnecessary sensitive personal information, credentials or confidential information to AI Surf.

AI-generated content may be incomplete or inaccurate and should be appropriately reviewed before being relied upon for important decisions.

Unless specifically disclosed for a particular feature, AI Surf is not intended to make decisions producing legal or similarly significant effects about individuals solely through automated processing.

5. Web Search and External Information Retrieval

Some AI Surf agents can obtain current information from the public Internet.

The current production implementation uses Tavily for web-search functionality and AI Surf's Web Fetch capability to retrieve selected webpages.

When web search is used, the search query required to perform the request is transmitted to Tavily.

Before a search query is sent externally, AI Surf applies automated safeguards designed to refuse queries containing certain categories of sensitive information or credential-like data. Current protections include detection of patterns associated with:

• API keys and authentication credentials;
• payment-card numbers;
• IBANs;
• Hungarian TAJ identifiers;
• Hungarian personal tax identification numbers; and
• United States Social Security numbers.

These safeguards apply to web-search queries. They do not currently filter the user's original AI prompt.

The current Tavily account is configured with “Allow use of query data” disabled.

Tavily may nevertheless process query data as necessary to provide its search service and may, in certain circumstances, send queries to third-party search-index providers where required to fulfil a search request.

Tavily may process data in the United States.

A Data Processing Agreement and the final contractual treatment of query retention, Zero Data Retention and Tavily subprocessors will be reviewed and documented before general public availability.

6. Service Providers

AI Surf relies on third-party technology providers to operate the service. The current architecture includes:

• Supabase — database, authentication and backend infrastructure;
• Vercel — application hosting and deployment;
• Anthropic — AI-model processing;
• Tavily — public web-search functionality;
• Upstash Redis — technical rate limiting and related request-identifier processing;
• Resend — delivery of authentication, account-recovery, magic-link and invitation emails sent through Supabase Auth.

A definitive processor and subprocessor list, including applicable contractual safeguards, will be maintained before general public availability.

7. International Data Transfers

AI Surf's primary Supabase database is currently hosted in Ireland within the European Union.

Other providers used by AI Surf, including Anthropic, Tavily and Vercel, may process data in the United States or other jurisdictions.

Where personal data protected by the GDPR is transferred outside the European Economic Area, AI Surf will use an appropriate lawful transfer mechanism where required, including applicable contractual safeguards.

The final transfer mechanisms for each relevant provider will be documented before general public availability.

8. Data Retention

Different categories of information may require different retention periods.

During development, prompts, AI responses, agent execution information, web-search information, retrieved-content previews and technical records are retained where reasonably necessary for testing, operation, troubleshooting, security and auditability.

Audit records are currently designed as append-only records and may be retained separately from ordinary application data.

Accordingly, AI Surf does not currently apply a single deletion period to every category of stored information.

A formal retention schedule covering application data, agent runs, search data, technical logs and audit records will be established before general public availability.

9. Cookies, Analytics and Similar Technologies

AI Surf uses browser-based technologies where technically necessary for authentication, security, session management and operation of the service.

AI Surf does not currently operate web analytics.

If AI Surf introduces analytics, or cookies or other technologies for purposes that require consent under applicable law, this Privacy Policy will be updated and the appropriate information and consent controls will be provided.

AI Surf does not currently use personal data for third-party advertising.

10. Data Sharing

AI Surf does not sell personal data.

Information may be disclosed to technology providers acting on behalf of AI Surf where necessary to provide, secure or operate the service.

Public web-search queries may be transmitted to Tavily and, where required to fulfil the search request, may subsequently be processed through third-party search-index providers used by Tavily.

Information may also be disclosed where required by applicable law.

11. Your Data Protection Rights

Where the GDPR applies, individuals may have rights including:

• access to their personal data;
• correction of inaccurate information;
• deletion in applicable circumstances;
• restriction of processing;
• data portability where applicable;
• objection to certain processing;
• withdrawal of consent where processing relies on consent; and
• lodging a complaint with the competent data-protection authority.

Some legal, security or audit obligations may limit the extent to which particular records can immediately be deleted.

During the controlled development phase, privacy requests should be made through the same project administrator or communication channel through which access to AI Surf was provided.

Dedicated controller and privacy contact details will be published before general availability.

12. Security

AI Surf uses technical and organisational safeguards intended to protect information against unauthorised access, disclosure, alteration or loss. Current protections include:

• protected credential storage;
• role and permission enforcement;
• workspace authority controls;
• audit records;
• server-side execution controls;
• agent-tool guardrails;
• search-query validation; and
• rate limiting.

Audit records are designed to contain operational identifiers, status codes, event codes and counts rather than prompts, search queries or fetched page content.

No online service can guarantee absolute security.

13. Children

The development version of AI Surf is not intended for use by children.

A specific age and parental-consent framework will be established before AI Surf is made available in circumstances where such requirements apply.

14. Changes to this Privacy Policy

This Privacy Policy will be updated as AI Surf moves from development into general availability and as its features, providers and legal requirements change.

Material changes will be reflected by updating the date at the top of this document.

15. Contact

AI Surf is currently operated as a development project.

The legal identity, registered address and dedicated privacy contact details of the final data controller will be added before AI Surf is opened for general public or commercial use.