Activate the bell

Privacy Policy

Last updated: September 16, 2026

This Privacy Policy describes the processing of personal data carried out in connection with the website surgebell.com and the member area app.surgebell.com, in accordance with Regulation (EU) 2016/679 (the "GDPR") and French Law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties.

1. Controller

Surgebell acts as controller of the personal data described below. Any question or request relating to the processing of personal data may be addressed to contact@surgebell.com.

2. Data processed, purposes and legal bases

Account data - email address, password (stored solely in the form of a cryptographic hash) or, where Google sign-in is used, the account identifier, name and profile picture communicated by Google; X handle; Telegram handle where that channel is selected. Purposes: creation and security of the Account, delivery of the Alerts, transmission of service messages. Legal basis: performance of the contract.

Subscription and billing data - Stripe customer and subscription identifiers, subscription status, billing address and country, business registration or VAT number where communicated, invoices, and the last four digits and the brand of the payment card. Full payment card numbers are neither received nor stored. Purposes: collection of payment, management of the Subscription, compliance with accounting and tax obligations. Legal bases: performance of the contract and compliance with a legal obligation.

Alert data - the posts transmitted, the date of transmission, the score and signals attached to them and, where communicated by you, whether a reply was published and how it performed. Purposes: operation of the Service, avoidance of duplicate transmissions, improvement of the scoring. Legal bases: performance of the contract and our legitimate interest in improving the Service.

Public data relating to your X account - on the basis of the handle you provide, the information published publicly on that account: profile, description, numbers of followers and of accounts followed, public posts and their public metrics. Purposes: matching the Alerts to your account, calibrating the scoring and the time windows, and measuring the effect of the replies published. Legal bases: performance of the contract and our legitimate interest in improving the Service.

Correspondence - messages addressed to us and our replies. Purposes: handling of requests and retention of evidence of the exchange. Legal bases: performance of the contract and our legitimate interest in establishing and defending legal claims.

Technical data - IP address, browser and device characteristics, timestamps, pages consulted, errors and security events. Purposes: security of the Service, prevention of fraud and abuse, diagnosis of incidents. Legal basis: legitimate interest.

Audience measurement - Google Analytics is used to measure use of the website: pages viewed, referring website, approximate location derived from the IP address, device and browser characteristics, and an identifier stored in the browser. Purposes: analysis of traffic and improvement of the website. Legal basis: consent, obtained through the cookie banner and capable of being withdrawn at any time.

3. Origin of the data

Personal data is collected directly from you, with the following exceptions: billing data is communicated by Stripe; identification data is communicated by Google where Google sign-in is used; data relating to public posts, including the public data of your own X account, is obtained from X and from third-party data providers.

4. Public posts published on X

For the purposes of operating the Service, public posts and public account metrics published on X (post text, numbers of likes, replies and reposts, author handle) are processed through third-party data providers. That data concerns third parties and is processed on the basis of our legitimate interest in supplying the Service, balanced against the rights of the persons concerned: only data made public by them is processed, no profile of private individuals is constructed, and no access is obtained to private accounts, to direct messages or to any resource requiring authorisation on an X account. Authors of public posts may exercise the rights set out in Article 8 by writing to the address indicated below.

5. Recipients and transfers

The following processors and partners are involved in the processing, each bound by a contract governing their use of the data:

  • Stripe (payment processing), Ireland and United States
  • Vercel (hosting), United States
  • Supabase (database and authentication), European region
  • Google (authentication, audience measurement through Google Analytics, and email delivery where Gmail is selected), United States
  • Telegram (delivery of Alerts where that channel is selected), United Arab Emirates
  • Third-party X data providers (access to public posts), United States
  • Our email delivery provider, for service messages

Data may also be disclosed where required by law, for the establishment or the defence of legal claims, or to an acquirer in connection with a transfer of our business, subject to equivalent safeguards.

Transfers outside the European Economic Area are carried out on the basis of the European Commission's Standard Contractual Clauses or of an adequacy decision. A copy of the safeguards in place may be obtained on request.

6. Retention periods

  • Account data and Alert data: for the duration of the Account, then erasure or anonymisation.
  • Invoices and accounting records: ten years, in accordance with Article L.123-22 of the French Commercial Code.
  • Correspondence: three years from the last exchange.
  • Technical data: for the period necessary for the security of the Service and the diagnosis of incidents.

7. Cookies and similar technologies

The website uses cookies which are strictly necessary for the provision of the service expressly requested, in particular for maintaining the session and for security. Such cookies are exempt from the requirement of consent.

Google Analytics cookies are placed only after consent has been obtained through the cookie banner, which consent may be withdrawn at any time. The data collected may be processed by Google in the United States, on the basis of the European Commission's Standard Contractual Clauses and of its adequacy decision in respect of certified organisations. The X post embedded on the home page is loaded from X and may result in cookies being placed by X, governed by X's own privacy policy.

8. Rights of data subjects

Under the GDPR, you have the right to obtain access to your personal data, its rectification or its erasure, the restriction of processing, and the portability of the data; the right to object at any time to processing based on legitimate interest; and the right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal. You may also issue directions concerning the fate of your data after death.

Requests are to be addressed to contact@surgebell.com and are answered within one month, a period which may be extended by two months in the case of complex requests. Proof of identity may be requested where reasonable doubt exists as to the identity of the applicant. Any data subject may lodge a complaint with the French supervisory authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris (cnil.fr).

9. Security

Data is stored on encrypted infrastructure, access being restricted to what is necessary for the operation of the Service. Passwords are stored solely in hashed form, access to production systems is restricted and logged, and secrets are not stored in the source code. No system offers absolute security. Where a personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, they are notified in accordance with Article 34 of the GDPR, the CNIL being notified where required under Article 33.

10. Minors

The Service is not intended for persons under eighteen years of age, and no data relating to minors is knowingly collected. Any such collection notified to us results in the erasure of the data concerned.

11. Amendment of this Policy

This Policy may be amended. Material amendments are notified by email before they take effect. The date indicated at the top of this document identifies the version in force.

12. Contact

contact@surgebell.com