Sursus Privacy Policy
Effective Date: June 1, 2026. Controller: Framework Holdings, LLC, a Utah limited liability company, d/b/a Sursus. Website: sursus.io. Privacy Contact: privacy@sursus.io. Mailing Address: Commercial Business Mailing Address.
This Privacy Policy explains how Framework Holdings, LLC d/b/a Sursus collects, uses, discloses, retains, and protects personal information in connection with Sursus.
Framework Holdings, LLC d/b/a Sursus. Support: support@sursus.io. Privacy: privacy@sursus.io. Legal: legal@sursus.io. Copyright: dmca@sursus.io.
Information We Collect
We collect account and authentication information, including name, email address, optional Google OAuth identifiers, account settings, session data, login metadata, and security events.
We collect product content and workspace data, including selected investment lens inputs, research volatility preference, analysis horizon assumption, assumptions, prompts, companies you track, watchlist settings, notes, journal entries, generated analyses, saved memos, PDFs, share links, follow-up questions, compact research memory, alert settings, and support messages.
We collect usage, analytics, device, and log information, including pages viewed, actions taken, subscription events, IP address, browser and device data, diagnostics, performance data, attribution data, and fraud-prevention data. Stripe processes payment and subscription information and may provide Sursus with billing status, customer identifiers, subscription tier, tax information, invoice data, and payment event metadata.
How We Use Information
We use information to provide Sursus, authenticate users, run AI-assisted research, generate valuation analyses, save workspaces, create memos and PDFs, operate public share links, monitor research conditions, send alerts and emails, process subscriptions, manage usage limits, provide support, debug and secure the product, prevent fraud and abuse, comply with law, enforce agreements, and improve the service.
AI Processing
AI is central to Sursus. We process your investment lens, quality gates, valuation assumptions, prompts, workspace data, company evidence, compact research memory, follow-up questions, generated outputs, and related metadata through Sursus systems and service providers to provide research analyses, screening outputs, memos, PDFs, alerts, summaries, and chat responses.
AI outputs may be inaccurate, incomplete, stale, biased, or unsupported. Sursus does not use AI to execute trades, allocate portfolios, manage assets, determine eligibility for financial products, or make legally binding decisions about you.
Because AI processing is part of the core Service, Sursus may not be able to provide AI-assisted features if you object to or opt out of AI processing.
Legal basis
| Purpose | Legal basis |
|---|---|
| Account creation, authentication, sessions, onboarding, and account administration | Contract necessity |
| Providing AI-assisted research, analyses, workspaces, memos, PDFs, alerts, public share links, and follow-up chat | Contract necessity |
| Processing your investment lens, quality gates, valuation assumptions, prompts, and workspace data | Contract necessity; legitimate interests where applicable |
| Billing, subscriptions, invoices, taxes, refunds, failed payments, and chargebacks | Contract necessity; legal obligation; legitimate interests |
| Security, fraud prevention, abuse prevention, access controls, audit logs, and enforcement | Legitimate interests; legal obligation |
| Product analytics, attribution, debugging, performance, and service improvement | Legitimate interests; consent where required |
| Marketing emails | Consent where required; legitimate interests where permitted |
| Optional cookies, tracking, or targeted advertising | Consent where required |
| Legal compliance, disputes, regulatory matters, and records retention | Legal obligation; legitimate interests |
| Public memos and share links | Contract necessity; user instruction; legitimate interests in operating public-sharing features |
Service Providers and Subprocessors
Sursus uses service providers and subprocessors to provide hosting, database, storage, authentication, payments, AI processing, market data, email, analytics, logging, security, background jobs, and support. We publish a list of material production subprocessors in this Privacy Policy or on a linked subprocessor page. We will update the list when material subprocessors change and will provide additional notice where required by law.
We use commercially reasonable efforts to maintain data-processing agreements or equivalent terms with service providers that process personal information on our behalf. Service providers may process personal information only as instructed by Sursus or as otherwise permitted by their agreements and applicable law.
| Vendor | Function | Personal data posture |
|---|---|---|
| Stripe | Checkout, subscriptions, billing, invoices, taxes, fraud/payment disputes | Account, billing, and payment metadata |
| Google OAuth | Optional sign-in | Authentication identifiers, profile email, name, and image if used |
| OpenRouter and underlying model providers | AI gateway and AI inference | Prompts, outputs, investment lens data, company evidence, and metadata |
| Resend | Transactional and product emails | Email address, email content, alert metadata, and digest metadata |
| Managed Postgres provider | Database | Core account, product, billing-status, research, memo, and workspace data |
| Cloudflare Workers and hosting/API providers | Hosting and compute | Request logs, app data, IP address, user agent, and service metadata |
Public Share Links
When you create a public memo share link, the memo content available at that link can be viewed by anyone who has the URL. Public share pages are unlisted and marked noindex,nofollow by default, but that does not prevent copying, downloading, screenshots, caching, or disclosure by people who receive the link.
Public memos will not display your name, profile image, or other creator identity by default. Public memos will not include follow-up chat messages by default. You may revoke a public share link, but revocation does not remove copies already viewed, downloaded, screenshotted, cached, or shared by others.
Model Training
Sursus will not intentionally use your non-public User Content or non-public account-specific outputs to train general-purpose AI models except with your affirmative opt-in or after the content has been deidentified or aggregated so that it is no longer reasonably associated with you. Third-party AI providers may process data as service providers or subprocessors as described in this Privacy Policy and subprocessor list.
International Transfers
Framework Holdings, LLC is based in the United States. If you access Sursus from outside the United States, your personal information may be processed in the United States and other countries that may not provide the same level of data protection as your jurisdiction.
Where required, we use appropriate safeguards for international transfers, which may include standard contractual clauses, the UK International Data Transfer Addendum, data-processing agreements, transfer risk assessments, Data Privacy Framework participation where applicable, or other lawful transfer mechanisms.
Privacy Requests
You may request access, correction, deletion, portability, or other rights available under applicable law by contacting privacy@sursus.io.
For EEA and UK users, we will respond without undue delay and within one month after receiving a verified request, unless an extension of up to two additional months is permitted due to complexity or number of requests. We will notify you within the initial one-month period if we extend the deadline.
For U.S. state privacy requests, we will respond within 45 days after receiving a verified request unless applicable law permits an extension. If we extend, we will notify you within the initial response period.
We may request information reasonably necessary to verify your identity and protect your account. We may deny requests where permitted by law, including where retention is necessary for security, fraud prevention, legal compliance, billing, tax, accounting, dispute resolution, public-sharing records, backups, or other permitted purposes.
U.S. State Privacy Rights
Depending on your location, you may have rights to know, access, correct, delete, obtain a copy of, or opt out of certain processing of personal information, including certain sales, sharing, targeted advertising, or profiling. Sursus does not currently sell personal information for money. If Sursus engages in targeted advertising, cross-context behavioral advertising, or other data sharing that triggers opt-out rights, we will provide required notices and controls.
We will not discriminate against you for exercising privacy rights.
Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide Sursus, maintain accounts, enforce subscriptions and usage limits, generate research outputs, operate public share links, provide support, maintain security, prevent fraud and abuse, comply with legal, tax, accounting, and payment obligations, resolve disputes, and enforce agreements.
We generally delete or anonymize account data, investment lens data, analyses, workspaces, follow-up chats, memos, PDFs, and related account content within 30 days after verified account deletion, except where retention is required or permitted for billing, tax, accounting, payment disputes, legal compliance, security, fraud prevention, abuse prevention, backups, public-sharing records, or legal holds.
Backups may retain deleted information for up to 45 days before overwrite or deletion. Public share links are revoked by default upon account deletion, but deletion does not remove copies already viewed, downloaded, screenshotted, cached, or shared by others.
| Data category | Retention |
|---|---|
| Account profile, email, authentication metadata | Active account term; delete or anonymize within 30 days after verified account deletion, except retained records below |
| Research lens, assumptions, preferences | Active account term; delete or anonymize within 30 days after account deletion |
| Workspaces, analyses, evidence snapshots, valuations, classifications | Active account term; delete or anonymize within 30 days after account deletion unless needed for legal, security, billing, or abuse records |
| Follow-up chat messages | Active account term; delete or anonymize within 30 days after account deletion |
| Memos and PDFs | Active account term; delete or anonymize within 30 days after account deletion; public links revoked by default |
| Public share links | Until user revokes, account is deleted, or Sursus removes; token hashes and minimal abuse-prevention records may be retained for 90 days after revocation |
| Billing, invoices, subscription, tax, chargeback records | 7 years after the last transaction or longer if required for tax, accounting, payment, legal, or dispute purposes |
| Payment card data | Not intentionally stored by Sursus; processed by Stripe |
| AI prompt/content traces | No production local debug files. If AI traces are enabled, retain prompt/output content for no more than 30 days unless needed for security incident, abuse investigation, support, or legal hold |
| AI usage metadata, model, token counts, cost records | 24 months |
| Product analytics and attribution linked to user/account | 24 months; aggregated or deidentified analytics may be retained indefinitely |
| Security logs, audit logs, admin action logs, impersonation logs | 24 months |
| Support/legal communications | 3 years after closure; longer if needed for legal hold or dispute |
| Backups | 45 days, then overwritten or deleted on normal backup rotation |
| Legal holds, fraud, abuse, regulatory, or security records | As long as reasonably necessary for the applicable purpose |
Children and Minors
Sursus is not intended for children or minors. You must be at least 18 years old to use Sursus. We do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13, we will delete it as required by law.
Changes And Contact
We may update this Privacy Policy from time to time. If changes are material, we will provide notice where required by law. For support, contact support@sursus.io. For privacy requests, contact privacy@sursus.io. For legal notices, contact legal@sursus.io. For copyright notices, contact dmca@sursus.io.