Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
The Surfshark Privacy Policy has a few notable concerns. Firstly, third-party payment partners collect necessary personal and financial details for transactions (risk_flags-1). Secondly, certain online activities could be linked back to a user's account if they use the Dedicated IP service (risk_flags-2). Finally, the service may use automated decision-making and profiling to evaluate eligibility for subscription discounts, even though it will not increase the price (risk_flags-3).
92% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
Critical issues and red flags that could lead to significant harm for the user. These are often difficult to reverse.
high95% confidence
Third-Party Payment Processors Collect Personal Data
The service states that its trusted payment partners collect necessary details for payments and refunds, such as transaction date, payer's IP address, credit card number, and cardholder's full name. Depending on location, these partners may also require additional details like a personal ID, passport, or address.
Why it matters: Your personal and financial information may be collected by third-party payment partners. This could include sensitive details beyond what the service itself retains, potentially increasing your exposure to data breaches or misuse by These third parties.
Please note that to handle your payments and refunds, our trusted payment partners collect necessary details like the transaction date, payer’s IP address, credit card number, and the cardholder's full name. Depending on your location, our payment partners may also need additional details like a personal ID, passport, or your address.
2.1 Personal data needed for us in order to provide Surfshark Services, paragraph 6 · Citation strength: strong
medium95% confidence
Online Activities Linked to Account with Dedicated IP
If a user chooses the Dedicated IP service, certain online activities could be linked back to their account.
Why it matters: Using the Dedicated IP service cancels out some of the privacy benefits of a VPN, as your online actions could be traceable to your account.
If you opt for our Dedicated IP service, certain online activities could be linked back to your account.
2.2.5 Provision of the Data Leak Checker service, paragraph 5 · Citation strength: strong
medium90% confidence
Use of Automated Decision-Making, Including Profiling, for Subscription Discounts
The service may use automated decision-making and profiling to determine eligibility for subscription discounts, using information related to the user's subscription.
Why it matters: Your subscription information may be used in an automated process, including profiling, to decide if you qualify for discounts. While this will not increase the price, the use of automated decision-making for pricing could result in unequal treatment among users.
We may use an automated decision-making, including profiling, process to evaluate whether to apply a discount to the price of the subscription a user purchases. This will not increase the price of the subscription you want to purchase.
2.3.1 To ensure the security of your account, paragraph 24 · Citation strength: strong
Data Use & Sharing
How your data is collected, processed, and shared with others.
low95% confidence
Website and Service Use Requires Agreement to Privacy Policy
By continuing to use the Website and/or Services, users agree to the terms of the current Privacy Policy. Users are requested to refrain from using the Services and Websites if they do not agree.
Why it matters: You must agree to the Privacy Policy to use the Website and Services. Failing to agree means you cannot use them.
By continuing to use our Website and / or Services, you agree to the terms of the current Privacy Policy. We kindly request that you refrain from using our Services and Websites if you do not agree with this Privacy Policy or any of its provisions.
Customer Support Communications Retained for up to 6 Years
Personal data related to customer support communications, including email address, inquiry content, and date/time of inquiry, will be kept for up to 6 years following receipt of the message.
Why it matters: Your support interactions, including the content of your inquiries and your email address, may be stored for up to six years.
We will keep personal data related to customer support communications for up to 6 years following the receipt of your message.
2.3.1 To ensure the security of your account, paragraph 5 · Citation strength: strong
low90% confidence
Chatbot Interactions Retained for up to 6 Years
Personal data from live chatbot interactions, including name, email address, and date/time of inquiry, will be kept for up to 6 years following the receipt of the message.
Why it matters: Your name, email, and the time of your live chatbot inquiry will be retained for up to six years.
We will keep personal data related to customer support communications for up to 6 years following the receipt of your message.
2.3.1 To ensure the security of your account, paragraph 8 · Citation strength: strong
low90% confidence
Marketing Emails Based on Consent or Legitimate Interest
Marketing emails, offers, and surveys are sent based on user consent or the company's legitimate interest, and personal information for this purpose is processed until an opt-out request is received.
Why it matters: You may receive marketing emails based on your consent or the company's business interests until you opt out. You can opt out at any time.
Legal basis for the processing of personal data is your consent or our legitimate interest to conduct marketing activities. | We will process your information until we receive your opt-out request.
2.3.1 To ensure the security of your account, paragraph 12 · Citation strength: strong
low95% confidence
Third-Party Social Network Handling of Shared Information Not Controlled
When information is shared on social network accounts, the company does not control how these platforms use or store that data, as they collect and process information for their own reasons, including marketing.
Why it matters: If you share information on social media via the service, the social networks will control how your data is used and stored, including for their marketing.
Please note that when you share information on social network accounts, e.g., Facebook, X, we don't control how they use or store that data. These companies collect and process your information for their own reasons, including their own marketing efforts.
2.3.1 To ensure the security of your account, paragraph 21 · Citation strength: strong
Cancellation & Renewal
Terms related to subscription cancellation, automatic renewals, and associated billing practices.
✓
Looking good
No billing surprises spotted
Verbaterm only flags concerns it can cite. No cancellation, auto-renewal, or refund terms needed attention here.
Gotchas
Potentially surprising or less-than-obvious terms that could be disadvantageous.
low90% confidence
Amendments to Privacy Policy May Occur
The Privacy Policy may be amended from time to time, and significant updates will be communicated ahead of time through the Website or by email.
Why it matters: The Privacy Policy can change, and you will be notified of significant updates by email or on the website. You will be bound by these changes if you continue to use the service.
We may need to amend the Privacy Policy from time to time. If there are any significant updates, we'll let you know ahead of time through our Website or by email. You'll always find the date of the latest update at the top of the Privacy Policy.
Transactional Emails are Separate from Marketing Opt-Out
If users opt out of marketing emails, the company will still communicate with them for essential service delivery, inquiries, and transactional product or service-related updates.
Why it matters: Stopping marketing emails will not prevent you from receiving essential service-related communications, inquiries, or transactional updates.
However, we will continue to communicate with you for essential service delivery, to address your inquiries, and to provide transactional product or service-related updates.
2.3.1 To ensure the security of your account, paragraph 15 · Citation strength: strong
low95% confidence
Possibility of Marketing Information from Other Parties
Users may still receive information about the Services from other parties who use their own mailing lists, even after opting out directly from the company.
Why it matters: Even if you opt out of marketing emails from the service directly, you might still receive marketing about their services from other entities using their own mailing lists.
Also, please note that you may still receive information about our Services from other parties who use their own mailing lists.
2.3.1 To ensure the security of your account, paragraph 16 · Citation strength: strong
Protections
Commitments and features that benefit users, enhancing their privacy, control, or recourse.
Protection95% confidence
No-Logs Policy for VPN Service
The VPN service has a 'No-logs Policy' and does not store any information that could reveal users' online activities. This includes visited IP addresses, browsing history, session information, connection time stamps, used bandwidth, or network traffic.
Why it helps: This commitment helps protect your privacy by ensuring that your online activities are not recorded or stored, aligning with the core purpose of a VPN service to enhance anonymity.
No-logs Policy is one of the most important features of our VPN service and we keep our VPN service logs-free. We don’t store any information that could lead us to see your online activities.
To ensure VPN functionality, servers temporarily store details about connection to a specific VPN server, such as user ID, IP address, and connection time stamps. However, this information is automatically deleted within 15 minutes after the session ends.
Why it helps: This ensures that even temporary connection data is purged quickly after your session, minimizing the window of opportunity for this data to be accessed or misused.
To ensure the functionality of our VPN service, our servers temporarily keep details about your connection to a specific VPN server, such as your user ID and / or your IP address and connection to VPN server time stamps. However, this information is automatically deleted within 15 minutes after your session ends. Rest assured, we do not store any information about the websites you visit.
In cases where automated processing decisions have legal consequences or significantly affect the user, they retain the right to challenge the decision, express their viewpoint, and request human involvement by contacting support.
Why it helps: This protection ensures that you have recourse if an automated decision-making process negatively impacts you, allowing for human review and the opportunity to present your side.
In instances where a decision based solely on automated processing produces legal consequences for you, or otherwise significantly affects you, you retain the right to challenge the decision, express your viewpoint, and request human involvement. You can achieve this by contacting us at [support@surfshark.com](mailto:support@surfshark.com). We will assess your request and provide a human examination of the decision, ensuring that your rights are fully honored.
2.3.1 To ensure the security of your account, paragraph 26 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.