Legal

Surge POS Privacy Policy

Last Updated: October 21, 2026

This Privacy Policy describes the ways Discover Data Direct LLC dba “Surge POS” and its affiliates (“Surge,” “we,” “our” or “us”) may collect, use, and disclose your Personal Information in connection with the Surge website (surgeups.com), the Surge POS mobile applications, the Surge back office, and the point-of-sale products and services we offer or provide (collectively, the “Platform”). You accept this policy by accessing the Platform by any means, whether or not you enter into a legal agreement with us to use the Services.

Card payment processing for merchants that use Surge POS is provided under a separate merchant processing agreement with a payment processor and its sponsor bank, and is governed by those parties' own terms and privacy policies.

If you have any questions about our Privacy Policy or how it applies to specific data we collect, please contact us at info@surgeups.com. We will make every effort to resolve your concerns.

1. What does this Privacy Policy cover?

This Privacy Policy applies to Personal Information that you provide to us or that we otherwise collect when you use or access the Platform. By accessing or using the Platform, you agree to the collection, use, disclosure, and processing of your Personal Information as described in this Privacy Policy.

In this Privacy Policy, “Personal Information” means information that can be associated with a specific person and can be used to identify that person. Personal Information does not include information that has been aggregated or anonymized so that it does not identify a specific person.

When we share Personal Information with vendors and other third-party service providers that perform functions on our behalf (“Third-Party Service Providers”), we require them to keep it secure and confidential, and to limit their use of it to what is reasonable and necessary to carry out their work with us and to comply with applicable laws and regulations.

Your customers' information. Merchants use the Platform to keep records about their own customers, such as names, contact details, purchases and rewards points. We process that information on the merchant's behalf, to provide the Services to the merchant. The merchant decides what to record. We don't contact a merchant's customers for our own purposes, and we never sell their information. A customer who wants their information changed or deleted should contact the merchant, who can edit or remove them in the back office. Past sales remain as financial records, with the customer's name removed.

2. What Personal Information do we collect, and how do we collect it?

We collect Personal Information from you directly, and automatically when you use the Services.

Information we collect directly from you. If you create a Surge account or are added to a merchant's team, you or the merchant provide Personal Information that may include:

• Identifiers, such as your name, email address, phone number, and password (stored only as a secure hash)
• Business information, such as your business name, address and locations
• Team information, such as the names and roles of team members, and register passcodes (stored only as a secure hash)

Information we collect from your use of the Services.

• Business records: the sales, items, rewards settings, customer records and points history that a merchant keeps in Surge
• Transaction data: for sales taken at a Surge POS register, the date, time, amount, items and payment method. For card payments this includes the card brand and last four digits. Full card numbers are handled by the payment processor and are never stored by us.
• Communications information: the content of your emails and other communications with us
• Mobile numbers for text messages: a number a merchant's customer gives at the shop to be texted that their order is ready, or to be sent their receipt; the texts sent to it, whether they arrived, and any STOP or START reply. See our Text Message Terms.

Information we collect by automated means.

• When you use our mobile app: your phone's model (for example “iPhone 15”) and operating system, a notification token that lets us deliver the notifications you allow, and when each phone signed in and was last used. We do not collect your location, contacts, photos, camera, microphone, advertising identifier (such as Apple's IDFA or Google's Advertising ID), or in-app usage analytics. Face ID and fingerprint unlock are handled entirely by your phone's operating system. The app only learns whether the check passed.
• When you use the Platform: IP address, failed sign-in attempts and server logs, which we use for security and to investigate problems
• When you visit our website: surgeups.com does not use cookies, analytics, or advertising pixels, and it loads no fonts or scripts from other companies.

Aggregate and de-identified information. We may create statistical information that is not Personal Information and cannot be tied back to you, your account or your device. We may use it for business purposes where permitted by law, such as to operate, analyze and improve the Services. We may share it in a way that does not allow you or any other person to be identified.

3. How we use your Personal Information

• Provide and improve the Services: establishing accounts, recording and reporting sales, running rewards programs, delivering the notifications you turn on (such as your daily sales summary), and improving, modifying or developing the Services
• Fraud prevention, security and privacy protection: verifying identity, limiting sign-in attempts, protecting accounts, and keeping each phone's sign-in separate
• Investigate misconduct: investigating and addressing potential misuse of the Services, preventing illegal activity, protecting the safety and legal rights of ourselves and others, and enforcing our terms and other agreements
• Communicate with you and respond to requests: account emails such as password resets and invitations, responses to your inquiries, and important notices. Some of these, such as notices of changes to our terms or policies, are necessary, so you cannot opt out of them.
• Send the texts customers ask for: a mobile number given at a shop is used only to send the text it was given for (order ready, receipt or table ready) and to honor a STOP reply. We never use it for marketing or promotional texts.
• Legal purposes and compliance with the law: responding to legal claims, and meeting contractual, tax, accounting and other legal obligations
• Consented purposes: other purposes, with your consent

We do not use your Personal Information for targeted advertising, and we do not sell it.

4. How, and with whom, is my information shared?

• Information disclosed for our everyday business purposes: to maintain your account, process and record your transactions, and respond to court orders and legal investigations
• Information disclosed to Third-Party Service Providers: hosting and database providers (Railway and Neon), notification delivery (Expo, Apple Push Notification service and Google Firebase Cloud Messaging), email delivery, and text message delivery (Twilio). Merchants' card transactions are shared with the payment processor, sponsor bank and card networks that process them.
• Information disclosed pursuant to business transfers: if we buy or sell assets, or if we or substantially all of our assets are acquired, user information may be one of the transferred assets. Any acquirer may continue to use your Personal Information as set out in this policy.
• Information disclosed for our protection and the protection of others: we may access, preserve and disclose information as we reasonably believe necessary to (i) satisfy any applicable law, regulation, legal process or governmental request, (ii) enforce this Privacy Policy and our terms, (iii) detect, prevent or address fraud, security or technical issues, (iv) respond to support requests, or (v) protect our rights, property or safety, our users and the public.
• Information we share with your consent: in other ways, if you consent

We do not share Personal Information with third parties for their own marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

5. How long do we keep it?

• A phone's sign-in expires after 90 days without use, or immediately when you sign out.
• Notification tokens are deleted when you sign out, or when Apple or Google reports that they no longer work.
• Account and business records are kept while the account is open. Sales and payment records are kept for as long as tax, accounting and payment-card rules require.

6. What choices do I have regarding my information?

• You can choose not to provide certain information, but some information is required to use the Services.
• You can view and update your account and business information in the app or the back office.
• You can turn off push notifications at any time in your phone's settings.
• You can stop all text messages sent through Surge by replying STOP to any of them, and turn them back on by replying START. Reply HELP for help. See our Text Message Terms.
• You can delete your account (see section 8).
• Do-not-track signals: we do not track you across other companies' websites or apps, so there is no cross-site tracking for a do-not-track signal to turn off.

7. Is information about me secure?

We protect Personal Information from unauthorized access and use with physical, electronic and procedural safeguards that comply with applicable law. Information is encrypted in transit. Passwords, register passcodes and sign-in tokens are stored only as secure hashes. On your phone, your sign-in is kept in the operating system's secure storage (the iOS Keychain or the Android Keystore). We let employees and contractors access information only when they need it for their work, and we require companies that work for us to protect it. However, we cannot guarantee the security of any information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

8. Additional privacy disclosures

• What information of mine can I access? If you are a registered user, you can view the information associated with your account by signing in, or by contacting us at info@surgeups.com.
• How can I delete my account? In the Surge owner app, open Account (the button with your business’s initials) and tap Delete account and enter your password to confirm. This removes your sign-in, name, email address, phone number, sessions and push notification tokens. Business sales and tax records that the merchant is legally required to keep stay with the business, without your name. If you are the only owner of a business, first make someone else an owner, or email info@surgeups.com to close the business. You can also email info@surgeups.com from the address on the account; we will verify that you have the authority to delete it, and handle the request within 30 days. Step-by-step instructions are on our account deletion page.
• Children's privacy: Surge's products are business tools and are not directed to minors under the age of 18. If we learn that we have collected Personal Information from a minor under 18, we will promptly delete it, unless we are legally required to keep it.
• California residents: we do not sell or share Personal Information as those terms are defined under California law. You may ask what Personal Information we hold about you and ask us to correct or delete it by contacting us at the address below. We will not discriminate against you for exercising these rights.
• Nevada residents: we do not sell covered information as defined under Nevada law.
• Vermont residents: we will not disclose your Personal Information to nonaffiliated third parties to market to you, other than as permitted by Vermont law.

9. What happens when there are changes to this Privacy Policy?

We may amend this Privacy Policy from time to time. If we change how we collect or use information, we will try to notify you by posting an announcement in the Services or by sending you an email. Changes to the Privacy Policy are effective as soon as we post them here.

For more information about this Privacy Policy, or if you have any questions or concerns, contact us at: