Unsurface

Privacy Policy

Effective date: 2026-04-17
Last updated: 2026-04-17

1. Who we are

Unsurface Inc. (“Unsurface,” “we,” “our”) is a Delaware C Corporation that provides forensic media authentication technology. Our registered office is 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Our operating address is 4907 Walton Avenue, Philadelphia, PA 19143, USA.

For privacy-related questions or to exercise your rights under applicable law, contact us at privacy@unsurface.ai.

2. What this policy covers

This Privacy Policy explains how we collect, use, and protect personal data through the unsurface.ai marketing website, including the access request form and any other public-facing tools hosted at unsurface.ai or its subdomains.

If you are an authorized user of our forensic analysis service under a signed agreement with Unsurface, your use of the service is governed by that agreement and its accompanying Terms of Service and User Agreement, which address data handling for service content specifically. This Privacy Policy applies in addition to those agreements for any general website interactions.

3. What data we collect

3.1. When you submit the access request form

We collect the information you choose to submit, which typically includes:

  • Your name
  • Your work email address
  • Your organization
  • Your role (optional)
  • A short description of your use case

We use this information solely to evaluate your request for access to Unsurface's service and to respond to you.

3.2. When you browse the site

Our website infrastructure (hosted on Cloudflare) automatically collects technical information required to deliver and secure the site, including:

  • Your IP address
  • Your browser type and operating system
  • Pages you visit and the time of your visits
  • The referring page, if any

This information is used for security, abuse prevention, site performance monitoring, and aggregate analytics.

3.3. Cookies and similar technologies

We use only strictly necessary cookies — those required for the site to function (e.g., basic session management, security). We do not use advertising cookies, behavioral tracking cookies, or third-party analytics cookies at this time. If this changes, we will update this policy and, where required, request your consent.

4. Why we collect it (legal bases under UK and EU GDPR)

We process personal data on the following legal bases:

  • Legitimate interests: responding to access requests, operating and securing our website, preventing fraud and abuse.
  • Consent: where you voluntarily submit information through our forms. You may withdraw consent at any time by contacting privacy@unsurface.ai.
  • Legal obligation: where we are required by applicable law to retain or disclose information.

5. How we use your data

We use personal data to:

  • Respond to your access request or inquiry
  • Evaluate whether Unsurface's service is appropriate for your use case
  • Communicate with you about related matters you've asked about
  • Secure and operate the website
  • Comply with legal obligations

We do not sell personal data. We do not share personal data with third parties for advertising or marketing purposes.

6. Who we share it with

We use the following service providers to operate the website. Each has its own privacy and security practices. We limit what is shared to what is necessary and covered by appropriate contractual protections.

  • Cloudflare, Inc. — website hosting, content delivery, and security.
  • Supabase, Inc. — database storage for access request submissions. Storage region: United States (US East).
  • Google LLC (Google Workspace) — email communication infrastructure for unsurface.ai addresses.
  • Resend, Inc. (if and when used) — transactional email delivery for responses and notifications.

We may add, remove, or change service providers over time and will update this policy to reflect material changes.

We may also disclose personal data where required by law, court order, subpoena, or to protect the safety, rights, or property of Unsurface or others.

7. International data transfers

Unsurface is based in the United States. Our service providers are also primarily based in the United States, though some (notably Supabase) offer European data storage, which we use where feasible.

If you are located in the United Kingdom, the European Economic Area, or another jurisdiction with data protection laws that restrict international transfers, please note that your data may be transferred to and processed in the United States or other countries. Where such transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses and the equivalent UK framework.

8. How long we keep your data

We retain personal data only as long as necessary for the purposes for which it was collected:

  • Access request submissions: retained until the request has been responded to, plus up to 24 months thereafter for record-keeping and follow-up purposes.
  • Technical server logs: retained for up to 90 days for security and operations.
  • Email correspondence: retained in line with Google Workspace retention defaults unless we have a specific reason to retain longer.

When we no longer need personal data for the purposes for which it was collected, we delete it or anonymize it.

9. Your rights

Depending on your location, you may have the following rights under applicable data protection law (including UK GDPR and EU GDPR):

  • Access: request a copy of the personal data we hold about you
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of your data, subject to certain legal exceptions
  • Restriction: limit how we process your data in certain circumstances
  • Portability: receive your data in a structured, machine-readable format
  • Objection: object to processing based on legitimate interests
  • Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at privacy@unsurface.ai. We will respond within one month, or explain any extension and reasons.

If you believe we have not handled your data appropriately, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, to an equivalent data protection authority in your EEA country of residence, or to the Pennsylvania Attorney General's Office for US residents. We would appreciate the opportunity to address your concerns before you contact a regulator.

10. Children

This website is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has submitted personal data to us, please contact privacy@unsurface.ai and we will delete it promptly.

11. Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These include encryption in transit and at rest where applicable, access controls, and secure hosting infrastructure. No system is perfectly secure, however, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. For material changes, we will provide additional notice where required by law. Continued use of the website after changes become effective means you accept the updated policy.

13. Contact

Questions about this Privacy Policy, or to exercise your rights:

Email: privacy@unsurface.ai
Postal: Unsurface Inc., 4907 Walton Avenue, Philadelphia, PA 19143, USA