Privacy Policy

• Account: your email address, your name, and your profile picture if you sign in with Google or Microsoft. If you use a password, we store only a salted hash of it.
• Your work: schematics you save to the cloud, assistant conversations you keep, comments, and the sharing settings and collaborators for each design.
• Assistant usage: for each assistant request, the model used, token counts and cost, so we can measure your monthly allowance.
• Billing: your plan and subscription status. Card details go straight to Stripe and never reach our servers.
• Technical: basic, aggregated page analytics and performance measurements (Vercel Analytics, which does not use cookies), and server logs kept for security and debugging.

Simulations run in your browser. Designs you don’t save to the cloud, and the waveforms of every run, stay on your device. They are never uploaded.

To provide and secure the service, to sync and share your designs, to run the assistant, to bill paid plans and enforce allowances, to send account emails (verification codes and password resets), and to understand which features are used so we can improve them. We don’t use your designs or conversations to train AI models.

When you use the assistant, your messages and the circuit it is working on are sent to Microsoft Azure OpenAI to generate a reply. Azure processes this data under Microsoft’s enterprise terms and does not use it to train models. We ask Azure not to store responses, and keep a short-lived prompt cache only to lower cost and latency.

• Supabase: accounts and database (United States).
• Vercel: hosting and analytics.
• Microsoft Azure: AI models, and Microsoft sign-in if you choose it.
• Google: Google sign-in if you choose it.
• Stripe: payments and tax.
• Resend: account emails.

People you share a design with can see it, and its comments, at the role you choose. A share link gives access to anyone who has it until you turn it off. We don’t sell or rent personal information, and we disclose it to others only to comply with law or to protect people and the service.

We keep your account and saved work while your account is open. You can delete designs and conversations at any time. To delete your account and everything in it, email contact@surfplatforms.com from the address on the account; we complete deletions within 30 days, except for billing records we must keep by law.

Depending on where you live, including California and the EU/UK, you may have the right to access, correct, export or delete your personal information, and to object to some processing. Email contact@surfplatforms.com and we’ll respond within 30 days. We don’t sell or share personal information for cross-context behavioural advertising.

Data is encrypted in transit and at rest, access is controlled by row-level security in the database, and keys never reach the browser. No system is perfectly secure; if we learn of a breach affecting your data, we’ll tell you.

Spice++ is not directed to children under 13, and we don’t knowingly collect their information. Students 13 and over may use it.

We’ll post changes here and, for material ones, email account holders. Questions: contact@surfplatforms.com, or Surf Platforms Inc., San Jose, California.