Privacy Policy

Effective Date: September 29, 2026

SurgePay Inc. ("SurgePay," "we," or "our") provides the SurgePay mobile application, website, and related financial services (the "Services"). This policy explains how we collect, use, disclose, store, and protect personal information when you use the Services.

It applies to account holders, people who use or receive transfers, website visitors, and anyone who contacts us. "Personal information" means information that identifies you or can reasonably be linked to you.

1. Who We Are

SurgePay Inc. is based at 800 N King St, Suite 304, Wilmington, Delaware 19801, United States. Contact us about privacy at privacy@surgepay.tech.

2. Information We Collect

The information we collect depends on the features you use.

2.1 Information you provide

  • Account and contact details, including name, email, phone number, address, date of birth, and account credentials.
  • Identity verification details, including identification numbers, government-issued documents, document images, and selfies.
  • Financial details and activity, including wallet, card, bank, payment, transfer, exchange, savings, and investment information.
  • Information you provide when contacting support, joining a savings group, inviting another person, or using other social features.

2.2 Information collected automatically

We may receive your IP address, device and browser type, operating system, app version, device identifiers, pages or features viewed, usage times, transaction and security events, and diagnostic or crash information.

2.3 Device permissions and other sources

With your permission, features may access your camera, photos, location, or contacts. You can change permissions in your device settings, but a feature that depends on a permission may become unavailable. We may also receive verification or transaction information from identity, banking, payment, and other service partners.

3. How We Use Information

  • Provide accounts, transfers, wallets, cards, exchange, savings, investment, and other requested features.
  • Verify identity, detect fraud, protect accounts, and meet KYC, anti-money laundering, and other legal obligations.
  • Send transaction notices, security messages, support replies, and service updates.
  • Understand app and website performance and improve our services.
  • Send product news or offers where permitted. You can opt out of marketing emails using the link in a message or by contacting us.
  • Handle requests, resolve disputes, enforce our agreements, and protect our users and Services.

Where applicable, we process information to perform our contract with you, comply with law, protect legitimate interests, or act on your consent.

4. Face Data and TrueDepth

For identity verification, we or our KYC provider may collect a selfie, liveness images, and facial or depth-derived signals from the camera or TrueDepth API on supported devices. We use them to confirm identity, check liveness, prevent fraud, and meet KYC requirements. Our KYC provider receives data captured by its verification software; selfies uploaded through other KYC paths go to SurgePay's backend. We do not use face data for advertising, marketing, tracking, or profiling, or share it with advertisers, analytics providers, or data brokers.

Face ID login and transaction confirmation are handled by iOS. SurgePay receives only a success or failure result, not your Face ID template. Face-data storage, retention, and deletion are described in Sections 6–8.

5. How We Share Information

We share information only as needed for the purposes described here:

  • Identity and financial partners: our KYC provider for verification, and banking, card, payment, exchange, and investment providers for features you use.
  • Operational providers: companies that support hosting, email, notifications, customer support, analytics, and error monitoring for the app and website.
  • Other users: information you choose to show through transfers, invites, savings groups, or other shared features.
  • Affiliates and business partners: where needed to offer a service or promotion, subject to applicable privacy requirements.
  • Authorities and business transfers: where law requires disclosure or as described in Section 13.

We do not sell personal information. Face data collected for KYC is not provided to our marketing, analytics, or advertising providers. We may share other information with your consent.

6. Storage

We store account and transaction information in protected systems used to provide the Services. Directly uploaded KYC selfies and documents are sent to SurgePay's backend. Captures made through our KYC provider are processed on its systems, including in the United States. SurgePay may store verification results for compliance and fraud prevention.

7. Retention

We keep personal information only as long as needed to provide the Services, comply with financial recordkeeping and other legal duties, prevent fraud, and resolve disputes. Usage logs are generally kept for a shorter period unless needed for security or legal purposes.

Our KYC provider's published policy generally limits biometric images and ID photos to five years, unless a lawful exception applies. For certain South African processing where it acts as an operator, the default is 90 days after verification; longer retention requires a specific lawful basis. Direct KYC uploads held by SurgePay are retained for the period required by applicable KYC, anti-money laundering, and other recordkeeping obligations.

8. Deletion

After the applicable retention period, we delete or anonymize personal information. You may request deletion, including KYC face data, at privacy@surgepay.tech. We coordinate with our KYC provider when relevant. Legal or regulatory duties may require us to keep some records; we will explain if that applies to your request. We do not hold Face ID templates.

9. Cookies and Analytics

Our website uses cookies and similar technologies to operate the site, understand usage, and provide support. Our app uses analytics and diagnostic services to measure feature use and fix errors. You can control browser cookies through your browser settings and opt out of marketing messages using the instructions in those messages. Disabling some cookies may affect website features.

10. Data Security

We use technical and organizational measures, including secure transmission and access controls, to protect personal information. No internet transmission or storage system can be guaranteed completely secure.

11. International Transfers

SurgePay and its providers may process information outside your country, including in the United States. Privacy protections can differ by location. Where required, we use appropriate safeguards when transferring personal information internationally.

12. Your Rights and Choices

Depending on where you live, you may ask to access, correct, or delete information we hold about you; object to certain uses; or withdraw consent where processing depends on it. You can update some account information in the app, change device permissions in settings, and request account deletion through Settings → Delete Account.

Email privacy@surgepay.tech to exercise a privacy right. We may need to verify your identity and may retain information that the law requires us to keep.

14. Children's Privacy

SurgePay is not intended for people under 16. We do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can review and delete it where appropriate.

16. Changes to This Policy

We may update this policy as our Services or legal obligations change. We will post the updated version here, change the date above, and give notice by email or a prominent notice in the Services before material changes take effect.

17. Contact Us

SurgePay Inc.
800 N King St, Suite 304
Wilmington, Delaware 19801, United States

Privacy: privacy@surgepay.tech
General support: support@surgepay.tech

SurgePay