Privacy Policy

Effective date: August 4, 2025

SURF NEUTRAL PTY. ("us", "we", or "our") operates the website and the SURF NEUTRAL mobile application (hereinafter referred to as the "Service").

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service, including when you connect your Instagram account to post Reels or other content via our integration with the Instagram Graph API. By using the Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, the terms used have the same meanings as in our Terms and Conditions.

Definitions

• Service: The website and SURF NEUTRAL mobile application operated by SURF NEUTRAL PTY.
• Personal Data: Data about a living individual who can be identified from that data (or from those and other information either in our possession or likely to come into our possession).
• Usage Data: Data collected automatically, generated by the use of the Service or from the Service infrastructure itself (e.g., duration of a page visit).
• Cookies: Small files stored on your device (computer or mobile device) to improve user experience.
• Data Controller: The natural or legal person who determines the purposes and manner of processing personal information. For this Privacy Policy, we are a Data Controller of your Personal Data.
• Data Processors (or Service Providers): Any natural or legal person who processes data on behalf of the Data Controller. We may use Service Providers to process your data effectively.
• Data Subject (or User): Any living individual using our Service and subject to Personal Data.

Information Collection and Use

We collect several types of information to provide and improve our Service, including data shared with Instagram when you use our integration to post Reels or other content.

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide certain personally identifiable information ("Personal Data") to contact or identify you. This includes, but is not limited to:

On Subscription through Email:

• Email address
• First name and last name
• Password (encrypted, unreadable by Surf Neutral)
• Cookies and Usage Data

Subscription through Facebook or Google:

• Email address
• First name and last name
• Profile picture

Subscription through Facebook:

• Email address
• First name and last name
• Country

Instagram Integration for Posting Reels: When you connect your Instagram account to Surf Neutral to post Reels or other content, you grant us permission to access and use certain Instagram data via the Instagram Graph API. The data we collect and share with Instagram includes:

• Instagram Business or Creator account ID
• Access token (to authenticate API requests for posting content)
• Content you choose to post (e.g., videos, captions, or other media for Reels)
• Metadata related to posted content (e.g., post ID, timestamps) This data is used solely to facilitate posting Reels to your Instagram account and to provide related functionality within Surf Neutral. We do not store or share your Instagram login credentials. By connecting your Instagram account, you authorize Surf Neutral to access and publish content on your behalf, as permitted by the Instagram Graph API permissions (instagram_basic and instagram_content_publish).

Shaper Profile Data: When a board is registered, shapers get a public page at https://www.surfneutral.com/brand/shapersbrandname. The following configurable information is presented:

• Public Shaper Profile:
  • Brand name
  • Brand story
  • Instagram account (optional, displayed as a link)
  • Facebook account (optional, displayed as a link)
• Shaper Bio:
  • Country of birth
  • Country of residence
  • Local surf break (optional)
  • Geolocation of shaping (optional)
  • Date of birth
  • When the shaper started surfing
  • When the shaper started shaping
  • Shaping full-time occupation
  • Shaping inspiration
  • Number of boards shaped
• Private Shaper Content (not publicly visible):
  • Instagram account (for internal use, e.g., API integration)
  • Facebook account
  • Surfboard model configurations
  • Board orders added to the factory
  • Internal reference numbers (e.g., CAD file reference)
  • CAD or design files uploaded by the shaper
  • Manufacturing remarks for an order
  • QR code view and PDF
  • Board transfer information to surfers

Board Transfer: When a shaper transfers a board to a surfer, the surfer's email address remains private until the surfer subscribes, logs in, and accepts the board on their profile. Surf Neutral sends an email to the surfer with the shaper's request. Once accepted, the surfer's username or name is exposed to the surf community and on the transferred board.

Surfer Profile Data:

• Public Content: During board registration, shapers may post, link, store, share, or make available information, text, graphics, videos, or other material ("Content"). This Content is attached to a QR code on equipment, scannable by devices.
  • You are responsible for the legality, reliability, and appropriateness of Content you post.
  • By posting Content, you grant us a license to use, modify, publicly perform, display, reproduce, and distribute it on the Service. You retain all rights to your Content and are responsible for protecting those rights.
  • You warrant that the Content is yours or you have the right to use it, and that posting it does not violate any rights.
• Visible to Surfers After Registering a Board:
  • Shaping location (if added)
  • Board location
  • Shaper first name and last name
  • Surfboard pictures uploaded by the shaper
  • Brand name
  • Model name (if applicable)
  • Surfboard dimensions
  • Model story
  • Board story
  • Glassing
  • QR code (digital format)
  • Board type
  • Board technology
  • Tail design
  • Fin setup
  • Fin system
  • Design type
  • Shaper username

We may use your Personal Data to contact you with newsletters, marketing, or promotional materials. You can opt out by following the unsubscribe link in our emails.

Usage Data

We collect information your browser sends when you visit our Service or access it via a mobile device ("Usage Data"), including:

• IP address
• Browser type and version
• Pages visited, time, and date of visit
• Time spent on pages
• Unique device identifiers
• Diagnostic data
• Mobile device type, ID, operating system, and browser

Location Data

With your permission, we may use and store location data to provide features, improve, and customize our Service. You can enable or disable location services via device settings. Visible location data includes:

• Shaping location (optional, controlled by the shaper)
• Surfboard geolocation on registration
• Board location (if updated)

Tracking & Cookies Data

We use cookies and tracking technologies (e.g., beacons, tags, scripts) to track activity and improve our Service. You can refuse cookies via browser settings, but this may limit Service functionality. Cookies include:

• Session Cookies: To operate our Service.
• Preference Cookies: To remember your preferences.
• Security Cookies: For security purposes.

Use of Data

SURF NEUTRAL PTY uses collected data to:

• Provide and maintain the Service
• Notify you about Service changes
• Enable interactive features
• Provide customer support
• Analyze and improve the Service
• Monitor usage
• Detect, prevent, and address technical issues
• Share content with Instagram when you use the Instagram API integration to post Reels
• Send news, offers, or information (unless you opt out)

Instagram API Integration

When you connect your Instagram Business or Creator account to Surf Neutral to post Reels, we use the Instagram Graph API to facilitate this functionality. We request the following permissions:

• instagram_basic: To access your Instagram profile and media.
• instagram_content_publish: To publish Reels and other content to your Instagram account. We share the following data with Instagram:
• Content you choose to post (e.g., videos, captions)
• Metadata related to the posted content (e.g., post ID) Instagram may use this data according to its own Privacy Policy. We do not store your Instagram login credentials or access data beyond what is necessary for posting. You can revoke Surf Neutral's access to your Instagram account at any time via Instagram's settings or by contacting us at privacy@surfneutral.com.

Legal Basis for Processing Personal Data (GDPR)

If you are from the European Economic Area (EEA), our legal basis for processing Personal Data depends on the context:

• To perform a contract with you
• With your consent (e.g., for Instagram integration or location data)
• For our legitimate interests (not overridden by your rights)
• For payment processing
• To comply with legal obligations

Retention of Data

We retain Personal Data only as long as necessary for the purposes in this Privacy Policy, including compliance with legal obligations, dispute resolution, and policy enforcement. Usage Data is retained for shorter periods unless needed for security or functionality.

Transfer of Data

Your data, including Personal Data, may be transferred to computers outside your jurisdiction (e.g., to Hetzner in Germany). Your consent to this Privacy Policy signifies agreement to such transfers. We ensure data security during transfers.

Disclosure of Data

• Business Transaction: If SURF NEUTRAL PTY is involved in a merger or acquisition, your Personal Data may be transferred with prior notice.
• Law Enforcement: We may disclose Personal Data if required by law or to protect our rights, users' safety, or against liability.

Security of Data

We use commercially acceptable means to protect your Personal Data, but no method is 100% secure. We take reasonable steps to ensure security, including for data shared with Instagram.

Do Not Track (CalOPPA)

We do not support Do Not Track (DNT). You can enable/disable DNT in your browser settings.

GDPR Data Protection Rights (EEA Residents)

You have the right to:

• Access, update, or delete your Personal Data
• Rectify inaccurate information
• Object to or restrict processing
• Data portability
• Withdraw consent Contact us at privacy@surfneutral.com to exercise these rights. You may also complain to an EEA Data Protection Authority.

How to Delete Your Personal Data

To delete your account and associated data:

1. Log in to your Surf Neutral account (via Facebook, Google, or email).
2. Go to https://www.surfneutral.com/account/settings/.
3. Click "Delete Account" and your account will be deleted within 2 days. This process is irreversible. Contact support@surfneutral.com for assistance.

Service Providers

We use third-party Service Providers to facilitate our Service, including:

• Instagram Graph API: To post Reels and manage content on your Instagram account.
• Google Analytics: To monitor and analyze Service usage. See the Google's Privacy Policy: https://policies.google.com/privacy?hl=en.

Links to Other Sites

Our Service may link to third-party sites (e.g., Instagram, Facebook). We are not responsible for their privacy practices.

Children's Privacy

Our Service is not for users under 16. We do not knowingly collect data from children. Contact us if you believe we have such data.

Changes to This Privacy Policy

We may update this Privacy Policy, notifying you via email or a notice on our Service. Changes are effective when posted.

Contact Us

For questions, contact us at privacy@surfneutral.com.