Surge

Privacy Policy

Last updated 1 October 2026

Surge is an AI assistant that runs on WhatsApp and LINE. It helps businesses (the owners who set it up) serve their customers (people who message a business through Surge). This policy explains what we collect from both, why, and your choices.

Who we are

Surge is operated by [company name — set LEGAL_NAME], [address — set LEGAL_ADDRESS]. Contact: [contact email — set CONTACT_EMAIL].

For customers of a business: that business decides how it uses your information (it is the "controller"). We process it on its behalf to provide the service. For business owners: we are responsible for your account information.

What we collect

How we use it

We do not sell your information, and we do not use it for advertising.

AI processing

Messages, photos and voice notes are processed by AI models (currently Google's Gemini API) to understand requests and draft replies. A business owner stays in control of sensitive actions such as payments and messages to many people.

Who we share it with

Some of these providers may process data outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.

How long we keep it

We keep information while a business uses Surge and for as long as needed to provide the service, meet legal obligations (e.g. records of orders and payments), and resolve disputes. When a business closes its account, we delete or anonymise its data within a reasonable period unless we must keep it by law.

Your choices and rights

Thailand (PDPA)

If you are in Thailand, the Personal Data Protection Act B.E. 2562 applies. We process personal data to perform our contract with you (providing the service), for our legitimate interests (security, fraud prevention, improving the service), to meet legal obligations, and with your consent where required. You have the right to access, obtain a copy of, correct, delete, restrict or object to processing of your data, to data portability, to withdraw consent at any time, and to complain to the Office of the Personal Data Protection Committee (PDPC). Some processing takes place outside Thailand (e.g. AI and cloud providers) with appropriate safeguards. To exercise your rights, contact [contact email — set CONTACT_EMAIL].

Security

We use encryption in transit, access controls, signed webhooks, isolated browser profiles per business, and owner approval for sensitive actions. No system is perfectly secure, so please don't send us passwords or full card numbers in chat.

Children

Surge is not intended for children under 13 (or the minimum age in your country), and we don't knowingly collect their information.

Changes

We may update this policy. We'll change the date above and, for significant changes, let business owners know.

Contact

[company name — set LEGAL_NAME] · [address — set LEGAL_ADDRESS] · [contact email — set CONTACT_EMAIL]