Surple Privacy Policy

Effective Date: 29 October 2026 Last Updated: 29 October 2026

This Privacy Policy explains how Surple ("Surple," "we," "us," or "our"), the operator of surple.ai (the "Service"), collects, uses, discloses, and protects personal data when you visit our website, create an account, order manufacturing from factories through our platform, use our factory software, or buy printed products designed with our AI tools.

If you do not agree with this Policy, please do not use the Service.

1. Who We Are

Surple is operated by Surple, Inc., a Delaware corporation with its registered office at 131 Continental Dr Suite 305, Newark, DE 19713, United States ("Surple," "we," "us"); full company details are in section 14. For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, Surple acts as the data controller for personal data collected directly from you.

Contact: [email protected]

2. Information We Collect

2.1 Information you provide

• Account data: name, email address, password (hashed), authentication data (including anonymous session identifiers created before you register, per our anonymous-to-registered account flow).
• Order & shipping data: shipping address, billing name, order history.
• Business data (brands and factories): company name, registration and tax details, business address, the people who act for the company, product specifications, quotes and order documents.
• Verification data (factories and, where required, brands): business registration and identity documents, bank account details, and, where a factory takes part in them, video walk-through recordings, references and sample test results. Surple's team checks them when a factory joins the network and at least every 12 months after that; once Surple Pay is available, our payment service provider may also check them before payouts are made.
• Payment data: processed by our payment service providers (Stripe for subscriptions, credits, printed products and creator payouts). Surple Pay, for manufacturing orders, is not yet available; when it is, its payments will be processed by our payment service provider. Surple does not store full payment card numbers.
• Prompts and content: the natural-language descriptions, preferences, images, or other input you provide to generate products ("Generation Input"), and the resulting AI-generated designs and mockups ("Generation Output").
• Communications: messages you send to support, surveys, and feedback.

2.2 Information collected automatically

• Usage data: pages viewed, features used, clicks, session duration, referring URLs.
• Device & log data: IP address, browser type, operating system, device identifiers.
• Behavioral/interaction signals: interactions with generated product slots (e.g., viewed, selected, rejected, shared), used to personalize recommendations (our "taste graph").
• Cookies and similar technologies: see our Cookie Policy for details and consent controls.

2.3 Information from third parties

• Authentication providers, if you sign in with a third-party login such as Google (your name, email address and profile picture).
• Factories and brands you deal with through Surple, our production partners, carriers and payment providers, for order status, verification and fraud-prevention purposes.

3. How We Use Your Information

We use personal data to:

1. Create and manage your account, including converting anonymous sessions into registered accounts.
2. Generate AI-powered product designs and mockups based on your Generation Input.
3. Process, fulfill, and ship your orders through our print-on-demand partner.
4. Process payments and prevent fraud.
5. Personalize product recommendations and improve the relevance of generated designs (the "taste graph").
6. Communicate with you about orders, account activity, and support requests.
7. Send marketing communications, where you have consented or as otherwise permitted by law (you may opt out at any time).
8. Improve and train our internal product-quality systems (e.g., our offline "vision flywheel" quality review), generally using de-identified or aggregated data where feasible.
9. Detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service and Acceptable Use Policy.
10. Comply with legal obligations and enforce our agreements.

4. AI Processing — Special Disclosure

Because Surple's core function is AI-generated commerce, please note:

• Your Generation Input (prompts, and any images you upload) is sent to third-party AI model providers to produce Generation Output. These providers process this data as our sub-processors under their own data protection and security commitments to us.
• Generation Output is reviewed through an AI-first moderation process, with human review applied where flagged content or edge cases make it necessary. Outputs may occasionally be inaccurate, unexpected, or unsuitable — see our Terms of Service for the related disclaimer.
• We may retain Generation Input/Output and associated interaction signals to improve model quality and personalization, including via internal review processes. Where we use this data for model or system improvement, we take reasonable steps to minimize identifiability.
• If you share a design publicly (e.g., via "The Drop"), that content and associated non-sensitive metadata may be visible to other users and the public.

5. Legal Bases for Processing (EEA/UK Users)

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to create your account, generate designs, and fulfill orders.
• Legitimate interests — to improve our Service, prevent fraud, and personalize recommendations, balanced against your rights.
• Consent — for optional marketing communications and non-essential cookies (withdrawable at any time).
• Legal obligation — for tax, accounting, and regulatory compliance.

6. How We Share Information

We share personal data with:

We do not sell personal data for money. Depending on your jurisdiction, sharing data with advertising partners via cookies may be considered a "sale" or "share" under laws like the CCPA — see Section 9.

Apart from the payment service provider named in section 2.1, the specific identities of our service providers/sub-processors are treated as confidential business information and are not published here. Business (B2B) customers may obtain a named list under the confidentiality terms of our Data Processing Agreement — see Annex 3 for how to request it. Consumers may request general information about the categories of recipients described above by contacting us at [email protected].

7. International Data Transfers

Surple, Inc. is a United States company. Our team, infrastructure and service providers are located in several countries, including the United States, the European Union, Singapore and Indonesia, and the factories you deal with are located in Vietnam, India, Mexico, Thailand, South Korea and the United States. Where we transfer personal data protected by GDPR or UK GDPR outside the EEA/UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or another lawful transfer mechanism.

8. Data Retention

We retain personal data for as long as necessary to provide the Service, comply with legal obligations (e.g., tax and accounting records), resolve disputes, and enforce our agreements. Account data is generally retained until you delete your account; order records are retained for the period required by applicable tax and consumer-protection law. You may request deletion as described in Section 9.

9. Your Rights

9.1 EEA/UK residents (GDPR / UK GDPR)

Subject to certain exceptions, you have the right to: access your data; correct inaccurate data; request erasure; restrict or object to processing; request data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

9.2 California residents (CCPA/CPRA)

You have the right to: know what personal information we collect and how it's used; request deletion; correct inaccurate information; opt out of the "sale" or "sharing" of personal information (including for cross-context behavioral advertising); and limit use of sensitive personal information. We will not discriminate against you for exercising these rights. To opt out of sharing via advertising cookies, use the cookie preference controls described in our Cookie Policy.

9.3 Indonesia residents

Under Indonesia's Personal Data Protection Law (UU PDP), you have rights to obtain information about, access, correct, and request deletion of your personal data, and to object to certain processing, subject to applicable exceptions.

9.4 Exercising your rights

Contact us at [email protected] to exercise any of these rights. We may need to verify your identity before fulfilling a request.

10. Children's Privacy

The Service is not directed to children under 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, access controls, and Row-Level Security on our database. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Third-Party Links

The Service may link to third-party websites (e.g., social sharing destinations). We are not responsible for the privacy practices of third parties.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via the Service or by email. Continued use of the Service after changes take effect constitutes acceptance.

14. Contact Us

Surple, Inc., a Delaware corporation, USA
Registered office: 131 Continental Dr Suite 305, Newark, DE 19713, United States
EIN: 37-2248237
Email: [email protected]
Phone: +1 (628) 800-7088
Support hours: Monday–Friday, 9 am–5 pm US Eastern Time

Privacy questions and requests: [email protected]