Privacy Policy

Groundswell (groundswell.surf) is operated by Kevin McCalley, Portugal. For all privacy-related matters, including data subject requests, contact us at support@groundswell.surf.

We are the data controller for personal data collected through this Service. This policy explains what data we collect, why, how it is used, and your rights under the EU General Data Protection Regulation (GDPR) and applicable Portuguese data protection law.

Account data: When you register, we collect your email address and any profile information you provide. Account authentication is handled by Clerk, Inc.

Payment data: Billing information (card details, billing address) is collected and stored exclusively by Stripe, Inc. We do not store your full card number or CVV on our servers.

Usage data: Vercel Analytics records page views anonymously, without cookies. If you accept cookies in our banner, Meta (the Meta pixel) and HeyCatch also record how you use the site, so we can measure our ads and understand how Groundswell is used; if you are signed in, HeyCatch links that usage to your account (ID and email). If you decline, neither is loaded.

Account events: When you create an account, start a trial or change your subscription, our servers report that event to HeyCatch, linked to your account ID.

Emails: Your email address and name are shared with Loops to send account emails and the weekly swell summary, which you can unsubscribe from at any time.

Testimonials: If you send us a testimonial, we store the text, the name and place you give, the language and, if you are signed in, a link to your account. We publish it on the site only with your explicit consent and after we review it, showing just the text, name and place. You can ask us to remove it at any time at support@groundswell.surf.

Location data: When you search for a surf location, that location is used to fetch forecast data. We do not persistently store your search history or link it to your account identity.

Technical data: Standard server logs (IP address, browser type, request timestamps) are retained for up to 30 days for security and debugging purposes.

• Contract performance: Account and payment data are processed to provide and bill for the Service.
• Consent: Meta and HeyCatch cookies and in-browser analytics are used only if you accept them; you can withdraw consent at any time under "Cookie settings" in the footer.
• Legitimate interests: Usage analytics and server logs are processed to maintain security and improve the Service.
• Legal obligation: We retain certain transaction records as required by Portuguese and EU tax law.

We share data with the following processors, each bound by appropriate data processing agreements:

• Clerk, Inc. — authentication and account management (US, EU Standard Contractual Clauses apply)
• Stripe, Inc. — payment processing (US/EU, PCI-DSS compliant)
• Vercel, Inc. — hosting, deployment, and analytics (US, EU SCCs apply)
• Redis Ltd. — short-term caching of non-personal forecast results, and storage of testimonials you send (US)
• Loops (Loops, Inc.) — email delivery (US, EU SCCs apply)
• Meta Platforms Ireland Ltd. — ad measurement through the Meta pixel, only with your consent (EU/US)
• HeyCatch — marketing analytics and account events; in-browser analytics only with your consent

We do not sell or rent your personal data.

• Account data: retained for the duration of your subscription plus 12 months, then deleted on request.
• Payment records: retained for 7 years as required by EU tax law.
• Server logs: deleted after 30 days.
• Cached forecast data: automatically expires within 6 hours, contains no personal identifiers.

As a data subject in the EU/EEA, you have the following rights, which you may exercise at any time by contacting us:

• Access: request a copy of all personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
• Restriction: request that we limit processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email support@groundswell.surf. We will respond within 30 days.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Portuguese data protection supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1º, 1200-651 Lisboa, Portugal. Website: cnpd.pt.

We use strictly necessary cookies to keep you signed in (via Clerk). With your consent, Meta (the Meta pixel) and HeyCatch also set cookies and browser storage to measure ads and usage. We show a cookie banner on your first visit; none of this loads until you accept, and you can change your mind at any time under "Cookie settings" in the footer.

Some of our processors are located in the United States. Where personal data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including the use of EU Standard Contractual Clauses (SCCs) as approved by the European Commission.

We may update this policy from time to time. We will notify you of material changes by email. The current version is always available at groundswell.surf/privacy.