1. Introduction

Surrounders ("we", "us", "our") operates the surrounders.com website and mobile application (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Platform.

Surrounders is a services marketplace connecting customers with service professionals. We act as a data controller for the personal data processed through the Platform, with one exception: the client records a professional keeps for themselves, described in Section 8, where the professional decides what is recorded and we hold it on their behalf. If you have questions about this policy, please contact us at privacy@surrounders.com.

2. Information We Collect

2.1 Information You Provide

Account information: name, email address, phone number, and password
Profile information: photo, bio, and headline
Addresses you add for service delivery or bookings
Professional profile details: skills, portfolio, pricing, and service areas
Booking details: service requested, date/time, location, and notes
Messages and file attachments shared with other users
Reviews and ratings
Searches you choose to save
Any communications you send to our support team

2.2 Information Collected Automatically

Device and browser information
IP address
Your time zone, read from your browser or phone, so times are shown correctly
A notification registration for each phone or browser on which you allow notifications
Usage data such as pages visited and features used
Cookies and similar technologies (see Section 5)

2.3 Information from Third Parties

If you sign in using a third-party account (such as Google or Apple), we receive your name, email address, and profile picture from that provider. We do not receive or store your third-party password.

3. How We Use Your Information

We use your information to:

Provide and operate the Platform, including account management, bookings, and messaging
Send transactional communications such as booking confirmations and reminders
Display professional profiles and listings to help customers find services
Publish reviews and ratings
Enable social features such as connections and invitations
Protect the safety and security of our users and the Platform
Improve and develop new features
Comply with legal obligations

4. Legal Basis for Processing

Where applicable under data protection law (including the GDPR), we process your data based on:

Contract performance: processing necessary to provide the services you have requested, including booking and message notifications on the phones and browsers where you allow them. Your phone or browser asks before any are sent, and you can turn them off at any time in its settings
Consent: for optional features such as analytics cookies and marketing communications. You may withdraw consent at any time
Legitimate interests: for fraud prevention, security, and service improvement, balanced against your rights
Legal obligation: where required by law

5. Cookies

We use strictly necessary cookies to keep you logged in and to ensure the Platform functions properly. These cookies are essential and cannot be disabled.

With your consent, we may also use analytics cookies to understand how users interact with the Platform. You can manage your cookie preferences at any time via our cookie consent banner. We do not use advertising or tracking cookies.

We count which link brought you to a professional's page, once a day, so professionals can see what works. You are not identified to them. To count a visit once, your browser keeps a random identifier that we store only in scrambled form, never with your IP address; if you are signed in, the visit is recorded against your account instead.

6. Location Data

Addresses you add to your profile or bookings are stored to facilitate service delivery. When you use proximity-based search, your browser may request your current location - this is used only for the search and is not stored on our servers. You can deny or revoke location access through your browser settings at any time.

Professional profiles display an approximate service area to help customers find nearby services. Exact addresses are only shared with confirmed booking participants.

7. Calendar Data

If you are a professional, you can connect your phone's calendar so the Platform knows when you are unavailable. This is optional, off by default, and you can turn it off at any time.

When you enable availability blocking, the app reads the calendars you select and sends us only the start and end times of your busy periods. It does not send event titles, descriptions, locations, attendees, or any other detail - we receive time ranges and nothing else. Those times are limited to a window from 24 hours in the past to 60 days ahead.

Your busy times are used for one purpose: hiding slots you cannot take. Customers viewing your public availability see only that a period is unavailable, in exactly the same form as an ordinary booking - they cannot tell a booking from a personal appointment, and they never see anything about the event itself.

Adding your bookings to your phone calendar works the other way around and sends nothing to us: your own app writes those events to your own device.

We identify each connected phone by a random identifier generated on that device. It is not a hardware identifier and cannot be used to recognise your device anywhere else. Busy times from a phone that stops syncing are deleted after 60 days. Disconnecting a device deletes its busy times immediately, and deleting your account deletes all of it.

8. Client Records Kept by Professionals

A professional using the Platform can keep a private record of their own clients: a name, and if they choose, a phone number or an email address, together with appointments they write down themselves. If you book a professional, or if one you already deal with adds you, some of your details may appear in that record.

Only that professional can see it. It is never shown to other professionals, to other customers, or to the public, and it is never used for advertising. The professional chooses what to write down and is responsible for it; we store it on their behalf and use it only to show it back to them and to send the reminders they set.

Contact details in a record a professional has not touched for 24 months are deleted automatically. The name and the dates of past appointments remain, because those are that professional's own business record of work they did.

If a record is connected to your account, you can hide those appointments from your calendar or disconnect them at any time, from the appointment itself. Deleting your account removes your contact details from every such record and disconnects them all. You can also write to privacy@surrounders.com and we will tell you what is held about you.

9. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share information only in the following circumstances:

Between booking participants, so the service can be provided
With service providers who help us operate the Platform, under contractual data processing agreements
When required by law, court order, or government request
In connection with a merger, acquisition, or sale of assets, with prior notice to you
With your explicit consent

People you are connected to on the Platform can see which professionals you have booked. Counts of this are always anonymous. Your name is shown alongside a professional to those connections by default, and only to them - never publicly, and never to anyone you are not connected to. You can stop this at any time by turning off "Show my name" in Settings, which takes effect immediately and leaves only the anonymous counts.

10. Third-Party Services

We work with trusted third-party service providers to help operate the Platform. These providers process personal data on our behalf, and each receives only what it needs for its function:

Hosting: our servers are in a data centre in Frankfurt, Germany. A network provider routes and protects traffic to the Platform, and encrypted backups are kept with a storage provider for 30 days
Email delivery: a service that sends account and booking emails receives your email address and the message
Notifications: a push delivery service, and Google's or Apple's notification service for your phone (or your browser's own push service), receive a device registration and the text of each notification
Error reporting: when something breaks, a service receives technical details such as the page, the request and the device or browser type, so we can fix it. On the website this runs only with your analytics consent and may include a recording of the page at the moment of the error
Analytics, on the website and only with your consent: services that count which pages and features are used, and record a sample of visits. If you are signed in, this is linked to your account
Maps and address search: when you look up an address, a mapping service receives the text you type and, if you tap to use your location, your coordinates

If you choose to sign in with Google or Apple, or to connect your Telegram account for reminders, that company handles the sign-in or the delivery under its own terms.

Our team receives internal notifications about activity on the Platform through a third-party messaging service, so that we can respond quickly. A notification identifies people by first name and an internal reference, and we never add your email address, phone number or postal address to one. Where the activity is a message you sent us or a listing somebody published, the notification quotes that text as written, so whatever you put in it travels with it. That service acts as an independent recipient of this limited information rather than processing it on our behalf, and it may store it outside your country.

When you play a video on a professional's page, the video site receives your request and its own terms apply.

11. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption of data in transit, secure password storage, and access controls. While we take reasonable precautions, no system is completely secure. If you believe your account has been compromised, please contact us immediately at security@surrounders.com.

12. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. When you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain it for legal or regulatory purposes. Anonymized and aggregated data that can no longer be associated with you may be retained indefinitely.

13. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you
Rectification: correct inaccurate or incomplete data
Erasure: request deletion of your personal data
Portability: receive your data in a structured, machine-readable format
Restriction: request that we limit how we use your data
Objection: object to processing based on legitimate interests
Withdraw consent: where processing is based on consent, withdraw it at any time
Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@surrounders.com. We will respond within 30 days and may ask you to verify your identity.

14. International Data Transfers

Some of our service providers may process data in countries other than the one in which you reside. Where a provider processes data on our behalf, we ensure appropriate safeguards are in place to protect your data in accordance with applicable law. The internal-notification service described in section 10 is not such a provider: it receives a limited amount of data as an independent recipient, we rely on our legitimate interest in operating and supporting the Platform, and no processing agreement governs that transfer.

15. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child under 18 has provided us with personal data, please contact us and we will promptly delete the information.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Platform before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

17. Contact Us

If you have questions or requests regarding this Privacy Policy, contact us at privacy@surrounders.com.