1. What we collect
| Data | When | Why |
|---|---|---|
| Phone number & name | Sign-up | Your account identity and sign-in (we verify by text code); the name your orders are placed under |
| Email (optional) | If you add it | Receipts and order confirmations that reach you |
| Chat messages | When you chat | Understanding your order; keeping your conversation history so "my usual" works |
| Orders | When you order | Placing the order, showing your history, powering reorders |
| Food preferences, diets & allergies | If you set them, or when you mention them in chat | Better recommendations and safer suggestions (see the allergen note in our Terms) |
| Home address / ZIP (optional) | If you provide it | Finding restaurants near you and filling pickup/delivery details you approve |
| Payment card | When you add one | We never see or store your card number. Stripe (our payment processor) tokenizes it; we keep only the card brand, last four digits, and expiration for display |
| Push notification token | If you allow notifications | Order updates on your device |
What we don't collect: no advertising identifiers, no third-party analytics SDKs, no background location tracking, no contact-list harvesting, no data purchased from brokers.
2. How your data is used to place orders
When you confirm an order, our systems act as your agent on the restaurant's own ordering site. The restaurant receives what any restaurant receives from a customer: your name, contact details for the order, the items you chose, and payment. The restaurant's use of that information is governed by the restaurant's own privacy policy.
3. Text messages (SMS) and your mobile data
When you create a Surf account and give us your mobile number, you agree to receive recurring service (transactional) text messages from Surf — order confirmations, order status and pickup-ready updates, cancellation notices, and one-time sign-in and verification codes. Message frequency depends on your orders and account activity. Message and data rates may apply. Reply STOP to any Surf text to opt out of SMS, or HELP for help; you can also manage notifications in the app. Opting out of texts doesn't delete your account or stop your in-app and push order updates. Marketing or promotional texts, if we ever send them, are separate and go only to people who opt in to those specifically.
We do not sell your personal information, and no mobile information — your phone number or your SMS consent — is shared with third parties or affiliates for marketing or promotional purposes. Your text-message opt-in and consent data are excluded from every data-sharing category described in this policy and will not be shared with any third party; we share your number only with our messaging provider (Twilio, listed below) for the sole purpose of delivering the messages you asked for.
4. Who processes data for us
We use a small set of service providers, each only for what's listed. We share what's needed for them to do their job — never for their advertising, and never as a sale of your data.
| Provider | What they do | What they process |
|---|---|---|
| OpenAI | Powers the chat assistant | Your chat messages and saved food preferences |
| Restaurant search & location lookup | Search text and the location/ZIP you provide | |
| Stripe | Payments | Your card (tokenized by Stripe directly), charges, refunds |
| Twilio | Text messages & sign-in codes | Your phone number and message content |
| Resend | Email delivery (order & account email, and the website waitlist) | Order confirmations, account emails, and the email address you submit to the waitlist |
| Expo | Push notifications | Your device push token and notification content |
| Amazon Web Services (AWS) | Hosting (United States) | Our databases and services run here |
5. What we keep, and for how long
- Your account data, chats, preferences, and order history: kept while your account is active, so the product can remember you. Deleted when you delete your account.
- Order evidence (like confirmation numbers and records of the checkout): kept to resolve disputes and prove what was ordered, then reduced to de-identified transaction records we need for accounting.
- Sign-in codes and stale device tokens: short-lived and purged.
6. Deleting your data
Deleting your account removes your profile, chat threads and messages, preferences, sign-in tokens, notifications, and orders from our systems, keeping only de-identified records we're legally required to retain (accounting, dispute defense). You can also email privacy@orderwithsurf.com and we'll do it for you. To request a copy of your data, email the same address.
7. Your rights
Depending on where you live (including under the Texas Data Privacy and Security Act and the California Consumer Privacy Act), you may have rights to access, correct, delete, and obtain a copy of your personal data, and to know how it's shared. We honor these rights for everyone, not just where the law requires: email privacy@orderwithsurf.com and we'll respond within 30 days. We do not sell personal data and we do not share it for cross-context behavioral advertising — so there's nothing to opt out of.
8. Security
All traffic is encrypted in transit (HTTPS with HSTS). Cards are tokenized by Stripe — full card numbers never touch our servers. Access to production systems is restricted, database queries are parameterized against injection, sensitive endpoints are rate-limited, and account actions like deletion are verified and logged. Our order-automation systems scrub payment data from their logs. No system is perfectly secure; if a breach affects your data, we'll notify you as the law requires — and faster if we can.
9. Children
Surf is not for children under 16, and we don't knowingly collect their data. If you believe a child has created an account, email privacy@orderwithsurf.com and we'll delete it.
10. Changes
When we change how we handle data, we update this policy in the same release — that's an internal engineering rule, not just a promise. Material changes will be announced in the app before they take effect.
11. Contact
Weird Hunt, Inc. · Dallas–Fort Worth, Texas
privacy@orderwithsurf.com