Privacy Policy

Surge is a home services marketing agency headquartered in San Diego, California. We work with roofing, HVAC, plumbing, and outdoor services operators across North America. The data controller for purposes of this policy is The Surge Agency.

Information you provide directly

• Name, business name, role, email, phone number, and website URL submitted through our intake form, strategy-call requests, or any contact form on the Site.
• Business details you share during onboarding — industry, service area, monthly ad spend, current vendors, conversion goals, and similar context required to scope our work.
• Billing and payment information processed by our payment processors. We do not store full card numbers on our servers.
• Communications you send us by email, SMS, voice, or messaging platforms.

Information collected automatically

• Device, browser, and operating system metadata.
• IP address, approximate geolocation, and referrer URL.
• Pages viewed, time on page, clicks, scroll depth, and other engagement signals captured by analytics and advertising pixels.
• Cookies and similar technologies described in Section 5.

Information from third parties

When you engage our Services, we receive lead, conversion, and performance data from advertising, analytics, and CRM platforms operating under your accounts (for example Google Ads, Meta, Microsoft Ads, Google Analytics, Google Business Profile, and your chosen CRM). We process this data on your behalf to operate your campaigns.

• To respond to inquiries, schedule strategy calls, and qualify potential engagements.
• To deliver, operate, and improve our Services — building, launching, and optimizing paid ads, websites, SEO, AI follow-up, and adjacent acquisition systems.
• To send transactional, account, and service communications.
• To send occasional marketing communications you may unsubscribe from at any time.
• To monitor and improve the Site, prevent abuse, and ensure security.
• To comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not share lead data captured for one client with any other client.

We share information only as needed to operate the Services, comply with the law, or with your consent. Categories of recipients include:

• Service providers — hosting, analytics, payment processing, customer support, email delivery, and similar vendors operating under written agreements that restrict their use of your data.
• Advertising and measurement platforms — for example Google, Meta, and Microsoft, where we operate campaigns under accounts owned by you or by us on your behalf.
• Professional advisors — accountants, lawyers, and auditors as necessary.
• Legal and safety reasons — to comply with valid legal process, protect rights, prevent fraud, or address security issues.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

The Site uses first- and third-party cookies and similar technologies (pixels, local storage, server-side tags) for essential functionality, analytics, and advertising measurement. Technologies we may use include Google Analytics, Google Ads, Meta Pixel, and conversion APIs.

You can control cookies through your browser settings and opt out of personalized advertising at aboutads.info/choices and youronlinechoices.eu. Blocking some cookies may affect Site functionality.

We retain information for as long as needed to provide the Services, satisfy our legal, accounting, and reporting obligations, and resolve disputes. When we no longer need information, we delete or anonymize it.

We use reasonable administrative, technical, and physical safeguards designed to protect the information we hold. No method of transmission or storage is perfectly secure, however, and we cannot guarantee absolute security.

This section covers Google user data handled by Surge Command Center, the private dashboard Surge staff use to manage client leads, calls, ad results and offline conversion uploads. Command Center only accesses a client's Google data after that client authorizes it through Google's consent screen.

What we access

• Google Ads. Campaign and lead reporting for the client's ad accounts, and offline conversion uploads (booked, sold, paid and call conversions) that we send back to those accounts.
• Local Services Ads. Leads and lead conversations from the client's Local Services Ads account, accessed through the Google Ads API.
• Google Business Profile. The client's business listing info, which we read and manage using the business.manage scope.

How we use it

We use Google user data only to run that client's campaigns, track their leads and report results back to that client. We don't use one client's Google data for any other client.

How we store it

Google user data is stored in our secured database. Access and refresh tokens are encrypted at rest. We keep the data only as long as we need it to provide the service. When a client disconnects their Google account or asks us to delete their data, we delete it.

How we share it

• We never sell Google user data.
• We never use it for advertising, including ad targeting or retargeting.
• We never use it to train AI models.
• We never share it with third parties, except as needed to provide the service to that client or when required by law.
• No person at Surge reads it unless the client gives us permission, it is needed for security purposes, it is needed to comply with the law, or it is needed for the internal operation of the service.

Limited use

Surge Command Center's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

Clients can revoke Command Center's access at any time at myaccount.google.com/permissions or by emailing privacy@thesurgeagency.com.

California residents (CCPA / CPRA)

California residents have the right to know what personal information we collect, to request access or deletion, to correct inaccurate information, to opt out of any "sale" or "sharing" of personal information, and to be free from retaliation for exercising these rights. We do not sell personal information.

EU/UK residents (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where we rely on consent, you may withdraw it at any time.

How to exercise your rights

Email us at privacy@thesurgeagency.com. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling certain requests.

The Site and Services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

We are based in the United States. If you access the Site from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries with different data protection laws than your jurisdiction.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated through the Site or by email where appropriate.

Questions, requests, or complaints about this Policy:

• The Surge Agency
• San Diego, California
• privacy@thesurgeagency.com