Legal

Privacy Policy

Last updated: 2 October 2026

This policy explains what Subsurface collects when you use subsurface.so, why, who else handles it, how long it is kept, and what you can ask of us. It is written to be read, not skimmed past.

1. Who we are

Subsurface is a product of Marv Naka, a business registered in Belgium.
Based in Brussels, Belgium.
Email: marv@marvnaka.com

Marv Naka is the data controller under the EU General Data Protection Regulation (GDPR). For anything about your data, write to marv@marvnaka.com.

2. What we collect

What you enter to start: your email address, your company name and stage, and, if you were sent by a brand strategist, their email address. Your first name is asked to greet you and stays in your browser; we don't store it.
Your conversation: every question asked and every answer you give during the discovery session.
What is written for you: your brand strategy and your Hiring Compass.
Technical data: your IP address, kept for up to 25 hours to limit abuse (how many requests come from one address), and standard server logs kept by our hosting provider for security.
If you book a review: your booking details through cal.com. Payment is handled by Stripe; we never see your card number.

We do not use analytics, advertising or tracking tools, and we do not buy or receive data about you from anyone else.

3. How the conversation works (AI)

The discovery session is conducted by an AI, and your strategy is written by an AI from your answers. We use Anthropic's Claude models for this. Your answers are sent to Anthropic only to produce the next question and your strategy. Anthropic does not use this content to train its models.

4. Why we use it (and on what basis)

To run your session, write your strategy and deliver it to you: this is the service you ask for (performance of a contract).
To send your strategy and related emails, and to answer you: same basis.
To keep the service safe and working (abuse limits, error alerts, logs): our legitimate interest in running a secure service.
To improve the product: Marv may read strategies and answers to improve the questions and the writing, and to prepare a review you booked. This is our legitimate interest; it never means sharing your content with anyone else.

We do not sell your data, and we do not use it for advertising.

5. Where your strategy lives, and who can see it

Your strategy page is at a link only you receive (a long, unguessable address). It is hidden from search engines. Anyone you share the link with can open it.
Your Notion page holds the same strategy, your Hiring Compass and the full transcript of your session. It opens for anyone who has its link and is hidden from search engines. We never list or publish these links. Share it with that in mind.
By email, you receive your strategy and the transcript. Marv receives a short notification with your company name, email address and the link to your strategy.
If a strategist sent you, the strategy and your answers are sent to the strategist email address you entered, instead of to you.

Want a page taken down or deleted? Write to marv@marvnaka.com and we will do it.

6. Who else handles your data

These providers process data on our behalf, each only for its own task:

Vercel: hosts the website.
Supabase: stores your session, strategy and answers.
Anthropic: the AI that asks the questions and writes your strategy.
Notion: hosts your Notion page.
Resend: sends the emails.
cal.com and Stripe: booking and payment for the review.

Some of these providers are based in, or process data in, the United States. Those transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. How long we keep it

Your strategy, answers and contact details: for as long as the service runs, so your links keep working, or until you ask us to delete them.
IP addresses used for abuse limits: up to 25 hours.
Server logs: as long as our hosting provider keeps them, typically days.
Your in-progress session is saved in your own browser (on this device) for 7 days, so you can pick up where you left off. It is not sent to us until you continue.

8. Your rights

You can ask to access your data, correct it, delete it, receive it in a portable format, or object to or restrict how it is used. Write to marv@marvnaka.com; we answer within one month.

You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be), or to the authority in the EU country where you live.

9. Cookies and browser storage

We set no tracking or advertising cookies. The session is saved in your browser's own storage, on your device only. The booking page embeds cal.com, which may set its own cookies to run the calendar; Stripe does the same during payment.

10. Age

Subsurface is for people aged 18 and over. If you believe someone younger has used it, write to us and we will delete their data.

11. Changes

If this policy changes in a way that matters, we update the date at the top and, where appropriate, tell you by email.