YOUR INFORMATION

Privacy

Last updated: October 21, 2026

This policy describes the SurroCompass website and account service in the United States. Contact privacy@surrocompass.com about privacy. Interest in surrogacy can be sensitive; our separate Consumer Health Data Privacy policy explains those practices and rights.

Accounts and optional contact profiles

We use your email, verification codes, session cookies, and security information to create and protect your account. We store your saved agencies, comparison choices, search preferences, and the version and time of terms acceptance. Browsing public listings does not require an account. Accounts are intended for adults living in the United States. We do not knowingly offer accounts to children under 18; contact us if a child has supplied personal information.

After verification, an optional form asks for first and last names and an optional US phone number. Older profiles may contain a preferred name, state or territory, research stage, timeline, and separate phone-call permissions. We also record the permission choices, notices, and times needed to enforce your decisions. Submitting a profile requires separate collection permission; skipping does not save unsubmitted answers.

SurroCompass marketing permission and permission to share a contact profile with shortlisted agencies are separate, optional choices. Signup and terms acceptance do not grant them. While profile sharing is on, it includes agencies you save or re-add in the future. Removing an agency stops future sharing with it. The intended shared information is first and last name, verified email, optional phone, and interest in surrogacy, for email contact about the agency’s services. It excludes other favorites, searches, and older research answers. Sharing a phone number does not authorize calls or texts. Older email-only grants remain limited to their original scope.

Parent marketing emails and agency introductions have not started. We currently record choices without delivering parent profiles to agencies. We do not sell parent contact profiles or consumer health data. Advertising purchases do not include that information.

Agency inquiries and sales correspondence

Agency forms collect a business contact’s name, work email, agency name, website, requested placement information, and message. We use these to answer inquiries, evaluate partnerships, maintain listings, and administer agreed campaigns. We also research publicly available business information and contact details and may approach agencies about advertising.

We retain agency sales emails, replies, relevant notes, approval records, and opt-out status. Cloudflare delivers and receives production email. OpenAI processes selected business profile information, contact names, sales notes, and conversation text to prepare drafts for human review. Drafting does not send an email automatically. Parent account profiles, shortlists, and onboarding answers are excluded from this drafting workflow. Avoid including patient information, medical records, or other unnecessary sensitive information in business inquiries and replies.

If agency payment processing is enabled, Stripe processes payment and billing information, and we retain the order and payment status. Advertising delivery and payment conditions are covered by the agreed order and Agency Advertising Terms. Reply “unsubscribe” to stop agency marketing messages; essential correspondence about an existing order may still be needed.

Service providers and security

Authorized SurroCompass staff can access information needed to operate the service and handle requests. Cloudflare provides hosting, storage, backups, email, and Turnstile abuse prevention. Security checks can process IP addresses, browser/device signals, and request information. See the Cloudflare Turnstile Privacy Addendum. Service providers process information for their services; they are not purchasers of parent leads. We do not share parent profiles with affiliates.

We may disclose information when legally required or reasonably necessary to protect the service and people, subject to applicable restrictions on consumer health data. We use access controls, authentication, and protected backups, but no system can guarantee absolute security. Processing takes place in the United States and locations used by our providers.

Cookies and analytics

A session cookie keeps you signed in. Cloudflare security checks help prevent automated abuse. First-party directory counters record card views, agency visits, and website clicks without account identifiers, contact details, saved lists, or search text.

PostHog measures how the site is used. On surrocompass.com it stores a first-party anonymous visitor identifier in a cookie and in localStorage. The cookie is set to last 365 days, which is PostHog’s default. The same identifier can remain in localStorage until you clear this site’s stored data. The identifier is a random value, not your email or account. Events can include page views, a sanitized referring site, utm_ campaign tags, public agency profile views and website clicks, sponsored card views, partnership-inquiry counts, and basic device or browser information. We send this to PostHog’s US servers. A network request can still expose connection information to that host.

PostHog does not receive your email, account identity, form contents, parent contact or health-profile answers, saved lists, search text, other URL query strings, or session recordings. Known automated browsers and email-link scanners are not measured.

Analytics runs by default. We do not start PostHog if your browser sends Do Not Track or Global Privacy Control. You can also clear this site’s cookies and localStorage in your browser, which removes the anonymous identifier until you visit again. We do not authorize third parties to track you across unrelated websites for advertising through this service.

Retention

Optional contact profiles, older onboarding answers, sharing permissions, and their identifiable consent records expire 12 months after your last confirmation, or are removed when you delete them. Profile deletion also withdraws parent marketing permission. Account data and legacy phone settings remain until full account deletion or a separate request; deleting only the optional profile does not remove your account.

Routine encrypted backups expire after 14 days. Backups made before a deletion or withdrawal are invalidated and removed through privacy maintenance. Provider recovery history can persist for up to 30 days. A separate recovery journal prevents historical data from restoring deleted information or withdrawn permissions; it retains keyed fingerprints and action metadata, not readable account emails or profile answers.

We retain business inquiries, correspondence, and order records for the purposes described above and applicable recordkeeping obligations, and review them for deletion when no longer needed. Opt-out records are retained as needed to prevent renewed marketing. Privacy request contact details are kept while needed to complete the request and provider follow-up, then removed from the active request queue. Ask us about a particular record’s retention.

Your privacy rights and requests

You can ask whether we collect, share, or sell information about you; obtain a copy; correct it; withdraw collection or sharing permission; or request deletion. For consumer health data, you may also request a list of the third parties and affiliates that received it and a way to contact them. We do not sell parent contact profiles or consumer health data.

Use the controls in Account, or email privacy@surrocompass.com with the request you want to make. You do not need to create an account. If possible, write from the email address you used with us. We verify requests using information reasonably needed to establish ownership; please do not send medical records or identity documents unless we explain why they are necessary.

Account offers a copy of your account information, separate controls to withdraw permissions or delete only your optional contact profile, and a control to delete your account, shortlist, comparisons, search preferences, profiles, and associated consent records. Full account deletion signs you out on all devices. We retain the minimum request information needed to finish deletion with our service providers and respond to you. Requests involving emails, business inquiries, or other records can also be sent to the privacy address.

We respond without undue delay and generally within 45 days of receiving a request. If applicable law permits an extension and we need one, we explain why and the new deadline within the initial period. We provide health-data access requests free of charge at least twice annually, subject to lawful exceptions for excessive or unfounded requests. We do not discriminate against you for exercising privacy rights.

When deleting consumer health data, we notify relevant processors and other recipients and address retained copies and backups. If we cannot fulfill a request in whole or in part, we explain the reason and any applicable exception. Withdrawal stops future processing based on that permission; it does not undo processing already completed lawfully.

Appeals

If we decline your request, reply to our decision or email privacy@surrocompass.com with “Privacy appeal” and your request reference or the date of our response. We review the decision and provide a written explanation within 45 days. If we deny your appeal, we provide a way to contact the appropriate state attorney general. You can also contact the Washington Attorney General or the Nevada Attorney General.

Policy changes

We post updates here with a revised last-updated date. For material changes, we display a prominent notice in the account area and on this policy before the change takes effect, or use email when appropriate. New collection purposes or expanded sharing requiring permission will be explained separately and require a new affirmative choice. We do not treat earlier choices as permission for expanded uses.