Surfkit Privacy Policy

01 Data Controller & Contact Information

The primary data controller responsible for personal information processed under this Privacy Policy is the Surfkit Operations Team, operating the platform services at surfkit.cloud and related browser extensions.

For any questions regarding our data practices, exercising your legal privacy rights, or submitting a formal deletion request, you may contact our dedicated Data Protection Officer at:

02 Categories of Data We Collect

We collect only the minimum information necessary to maintain your account, authenticate your session, credit verified rewards, and prevent bot abuse:

03 Third-Party Networks & Offerwalls

When you choose to engage with surveys, offerwalls, or sponsor mini-games, our platform interfaces with trusted monetization partners through secure iframe tunnels:

• Integrated Survey & Offer Partners: CPX Research (currently live); BitLabs, Lootably, and AdGate Media (slated to connect soon).
• Data Transferred to Partners: To properly route available surveys and credit rewards, we transmit only pseudonymous identifiers: a randomized user session ID, country code, and IP address for geo-filtering.
• Independent Demographic Profiling: When answering surveys within partner tunnels, you may be invited to voluntarily answer demographic questions (e.g., age bracket, employment sector, generalized zip code). This data is processed directly by the research partner under their respective privacy policy.
• Cloud Infrastructure: Core web assets are delivered securely via enterprise cloud networks and edge infrastructure with AES-256 data-at-rest encryption.

04 Purposes & Legal Bases for Processing

Under GDPR Article 6, we process your information under the following legitimate legal bases:

05 Local Storage, Cookies & Extension Runtime

The Surfkit Browser Extension operates using Chromium's isolated extension storage APIs (chrome.storage.local):

• Active Token Auth: Storing the temporary JWT session token to maintain your dashboard login.
• Local Ad Count & Balance Cache: Storing current session counters (`adsSeenToday`, `activeStreak`, `balanceCache`) so the popup renders instantly without redundant network latency.
• Essential Session Cookies: Web dashboard session cookies strictly required for security validation and CSRF mitigation. We do not employ third-party ad tracking cookies across the open web.

06 Your Privacy Rights (GDPR, UK & CCPA)

Depending on your location, you hold statutory rights over your personal data:

To exercise any of these rights, email us at support@surfkit.cloud. We will respond within 30 days of receiving your verified request.

07 Data Retention & Deletion

We retain active account data only as long as your account remains open. If an account is inactive for more than 24 consecutive months or you request deletion, we permanently purge your user profile and active session identifiers.

Statutory Retention: Records of financial disbursements (PayPal transaction IDs, bank wire confirmations, tax amounts) are preserved for a period of up to 7 years to fulfill legal, taxation, and anti-money laundering compliance obligations.

08 Security Architecture

Surfkit utilizes end-to-end transport layer security (TLS 1.3), strict access control policies, and enterprise-grade DDoS filtering to safeguard API traffic. All records containing user credentials and balances are encrypted at rest using industry-standard AES-256 protocols.

09 International Transfers & Children's Privacy

Our servers and partner offerwalls operate globally. Whenever personal data is transferred across borders, we ensure adequate protections are maintained, including Standard Contractual Clauses (SCCs). Our service is strictly prohibited for children under 13 years of age. We do not knowingly solicit or collect data from minors.