Privacy Policy

Who we are

EngSurface (www.engsurface.com) sells engineering automation tools. For all data protection questions, access/deletion requests or concerns: support@engsurface.com. We are happy to verify identity and respond within 30 days.

What we collect, why, and on what legal basis (GDPR art. 6)

• Account data — email, display name, password (never stored in plain text; Supabase Auth holds a cryptographic hash). Purpose: create your account, sign you in, secure your access, show ownership on reviews. Basis: Contract.
• Orders — name, contact email, purchased product, license type, amount, status. Purpose: deliver your license, provide support, meet accounting duties, prevent fraud. Basis: Contract + legal duties.
• Reviews — rating, text, public display name, product rated. Purpose: help other engineers (publicly visible once approved). Basis: Consent.
• Newsletter — email address. Purpose: send you the release/news you subscribed to (unsubscribe anytime). Basis: Consent.
• Contact & custom-tool forms — name, email, message or project description. Purpose: answer your question or scope your custom request; optionally follow up. Basis: Legitimate interest.

What we do not do

• We never sell your personal data to advertisers or brokers.
• We never see or store your payment card details — payments run entirely on PayPal.
• No tracking/advertising cookies. Only strictly necessary technical functions.
• No profiling for marketing purposes.

Providers we use (processors)

• Supabase — authentication and database hosting (encrypted in transit and at rest).
• Vercel — site hosting and delivery.
• PayPal — payment processing; see PayPal's own privacy policy.
• Resend — transactional emails (order confirmations, password resets, welcome emails).
• YouTube embeds — product videos load from youtube-nocookie.com/YouTube (Google) only when you visit the page.

Retention

• Accounts: kept while active; deleted on request.
• Orders: kept for legal accounting requirements (typically 5–10 years by applicable law).
• Reviews: publicly visible until you delete them (they detach your name automatically).
• Contact messages and custom-tool requests: up to 24 months, unless a support case needs longer.

Your rights

Every user (and especially EU residents under GDPR) can request: access to their data, correction, deletion ("right to be forgotten"), restriction, portability, and withdrawal of consent. Email support@engsurface.com — support is handled by a human, not a bot. You can also delete your own reviews from your account page at any time.

Security measures

• End-to-end HTTPS/TLS transport.
• Row-level security on the database: every table enforces who may read/write each record.
• Two-factor authentication available for all accounts (TOTP).
• Principle of least privilege for admin operations, with guardrails against accidental destructive actions.

Changes to this policy

We will post changes here with a new "last updated" date; material changes affecting purchased licenses are never applied retroactively.