Privacy Policy

Surfbook ("we", "our") operates the platform at surfbook.io, connecting students to surf schools and wave pools. This Policy describes what personal data we collect, why, how we use it, and your rights.

1. Data we collect

We collect only what we need to operate the platform:

• Account data: name, email, phone, profile picture.
• Class data: booking history, packages, payments, lesson reviews.
• Sign in with Google: we receive only your name, email, and public profile picture. We never access Gmail, Drive, contacts, or any other Google service.
• Technical data: IP address, browser type, error events (via Sentry) to keep the platform stable.

2. How we use your data

• Enable class booking and account management.
• Process payments via Stripe (we never store card data).
• Send confirmations, reminders, and essential class communications.
• Improve the platform via aggregated, anonymized metrics.

We do not sell your data. We do not use your data for third-party advertising.

3. Sharing

• Your surf school: sees your name, contact, class history, and payments — needed to serve you.
• Infrastructure providers: Supabase (database), Fly.io (servers), Vercel (frontend), Resend (email), Stripe (payments), Sentry (monitoring).
• Authorities: only when legally required.

3.1 Messaging integrations (Meta Platforms)

When a Surfbook-connected school uses our integration with WhatsApp or Instagram (via Meta Platforms, Inc.), we receive and store the content of the messages exchanged between you and the school — including text, media, and conversation identifiers provided by Meta. We use this data solely to display the conversation to the school owner inside the Surfbook admin panel. We do not share your messages with third parties except Meta (the channel provider) and the infrastructure providers listed above.

Messages are retained while the school's Surfbook account is active. You may request deletion of your messages at any time by emailing [email protected].

4. Your rights (LGPD/GDPR)

You may request access, correction, export, or deletion of your personal data at any time. Contact us at the email below; we respond within 15 days.

5. Retention

We keep your data while your account is active. When you delete your account, we remove your personal data within 30 days, except records we are legally required to retain (tax/fiscal).

6. Security

We use HTTPS in transit, encryption at rest, httpOnly cookies for sessions, and JWT authentication. Database backups are taken regularly.

7. Cookies

We use essential cookies only. No advertising or third-party tracking cookies.

8. Changes to this policy

We may update this Policy occasionally. Significant changes are announced by email or in-app.

9. Contact

Questions, access or deletion requests: [email protected]