Privacy policy
Last updated 30 October 2026
This policy explains what personal data Surfacepath (surfacepath.com) collects, why, and what you can do about it. We collect as little as we can: there are no accounts, no ads and nothing is sold.
Who is responsible
Surfacepath is run by Schwarzmatter, a company registered in Estonia, which is the data controller for this website.
For anything about your data, use the contact form and choose “A question or idea”.
What we collect and why
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Addresses you check with the AI readiness checker, and the public pages we fetch for them | To run the check you asked for | Legitimate interest (providing the service you request) | Held in memory for about 10 minutes, then discarded. Not stored. |
| Your IP address while you use the checker | To limit how many checks one visitor can run per hour | Legitimate interest (preventing abuse) | In memory for up to an hour. Not stored. |
| Contact form messages: your email, what you write, and the topic | To read and answer your message, or to tell you when Pro opens if you joined the waitlist | Consent (you send it) and steps you ask us to take | Until dealt with; waitlist addresses until Pro opens or you ask us to remove them |
| Analytics: pages viewed, how you arrived, approximate location (country/city), device and browser, through Google Analytics | To learn which guides people read, so we know what to improve and write next | Consent, given in the cookie panel. Off unless you accept. | 14 months in Google Analytics |
| Server logs kept by our host: IP address, the page requested, time, browser | To run the site securely and fix problems | Legitimate interest (security and reliability) | Kept by Netlify according to its own policy, usually days |
We don't make automated decisions about you, and we don't collect special categories of data. Please don't put sensitive information in the contact form.
Who processes your data for us
- Netlify hosts the site, runs the checker and stores contact form messages (Netlify privacy policy).
- Google provides Google Analytics, only if you accept analytics cookies. We have turned off Google signals and ad personalisation, so the data isn't used for advertising (Google privacy policy).
These providers may process data in the United States. Transfers rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
Cookies
We only set cookies if you accept analytics. The cookie policy lists each one. You can change your choice at any time: .
Your rights
If you are in the UK or the EU you have the right to access your data, have it corrected or deleted, restrict or object to its use, receive it in a portable form, and withdraw consent at any time (withdrawing doesn't affect what happened before). To use any of these, contact us; we answer within one month. You can also complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); you can also go to the authority where you live, such as the ICO in the UK.
Children
The site is meant for people who run websites and isn't aimed at children under 16.
Changes
If this policy changes, we update the date at the top. Significant changes are also noted on the updates page.