Legal
Privacy Policy
Last updated: 8 September 2026
Who we are
EngSurface (www.engsurface.com) sells engineering automation tools. For all data protection questions, access/deletion requests or concerns: support@engsurface.com. We are happy to verify identity and respond within 30 days.
What we collect, why, and on what legal basis (GDPR art. 6)
| Data | Purpose | Legal basis |
|---|---|---|
| Account data — email, display name, password (never stored in plain text; Supabase Auth holds a cryptographic hash) | Create your account, sign you in, secure your access, show ownership on reviews | Contract |
| Orders — name, contact email, purchased product, license type, amount, status | Deliver your license, provide support, meet accounting duties, prevent fraud | Contract + legal duties |
| Reviews — rating, text, public display name, product rated | Help other engineers (publicly visible once approved) | Consent |
| Newsletter — email address | Send you the release/news you subscribed to (unsubscribe anytime) | Consent |
| Contact form — name, email, message | Answer your question; optionally follow up | Legitimate interest |
What we do not do
- We never sell your personal data to advertisers or brokers.
- We never see or store your payment card details — payments run entirely on PayPal.
- No tracking/advertising cookies. Only strictly necessary technical functions.
- No profiling for marketing purposes.
Providers we use (processors)
- Supabase — authentication and database hosting (encrypted in transit and at rest).
- Vercel — site hosting and delivery.
- PayPal — payment processing; see PayPal's own privacy policy.
- Resend — transactional emails (order confirmations, password resets).
- YouTube embeds — product videos load from youtube-nocookie.com/YouTube (Google) only when you visit the page.
Retention
- Accounts: kept while active; deleted on request.
- Orders: kept for legal accounting requirements (typically 5–10 years by applicable law).
- Reviews: publicly visible until you delete them (they detach your name automatically).
- Contact messages: up to 24 months, unless a support case needs longer.
Your rights
Every user (and especially EU residents under GDPR) can request: access to their data, correction, deletion ("right to be forgotten"), restriction, portability, and withdrawal of consent. Email support@engsurface.com — support is handled by a human, not a bot.
You can also delete your own reviews from your account page at any time.
Security measures
- End-to-end HTTPS/TLS transport.
- Row-level security on the database: every table enforces who may read/write each record.
- Two-factor authentication available for all accounts (TOTP).
- Principle of least privilege for admin operations, with guardrails against accidental destructive actions.
Changes to this policy
We will post changes here with a new "last updated" date; material changes affecting purchased licenses are never applied retroactively.