SeaYouSurfPrivacy Policy
Last updated: 9 June 2026
SeaYouSurf ("SeaYouSurf", "we", "us") is operated by Not a Startup AB, a company registered in Sweden (org. nr SE559566425001). This policy explains how we collect, use, and protect your personal data when you use our website and apps (the "Service"), in line with the EU General Data Protection Regulation (GDPR).
1. Who is responsible (data controller)
Not a Startup AB (SE559566425001) is the data controller. For any privacy question or to exercise your rights, contact us at hello@seayousurf.app.
2. What we collect
- Account data — when you sign in with Google: your name, email address, and profile picture.
- Profile & preferences — your surfing skill level, boards, preferred wave sizes, and chosen home location.
- Community contributions — surf condition reports you submit (size, conditions, crowd), and an associated approximate identifier (account or IP) used to prevent abuse.
- Usage & device data — pages viewed, interactions, approximate location, device/browser info, collected via Google Analytics, loaded only with your consent.
- Payment data — if you subscribe, payments are processed by Stripe; we receive subscription status and limited billing metadata, but not your full card number.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Provide the Service, personalised forecasts and your account | Performance of a contract |
| Community reports, trust/anti-abuse, security | Legitimate interests |
| Analytics and product improvement | Consent (where required) / legitimate interests |
| Payments and subscription management | Performance of a contract |
| Marketing emails (if any) | Consent |
4. Who we share it with (processors)
We share data only with service providers acting on our instructions: our self-hosted Supabase backend (auth, database), Google (sign-in and Google Analytics), Stripe (payments), and Cloudflare (security, bot protection, content delivery). We do not sell your personal data.
5. International transfers
Some providers may process data outside the EU/EEA. Where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
6. Retention
We keep personal data only as long as needed for the purposes above, then delete or anonymise it. You can ask us to delete your account at any time.
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. To exercise these rights, email hello@seayousurf.app. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se).
8. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
9. Children
The Service is not directed to children under 16. We do not knowingly collect their data.
10. Changes
We may update this policy; we will post the new version here with an updated date.
11. Contact
Not a Startup AB (SE559566425001) — hello@seayousurf.app