Privacy policy

• Customers and their team members who sign up for and use SurplusNorth.
• Property owners, heirs and other claimants whose names appear in public surplus funds records, or whom our customers contact. For what customers do with that information (calls, texts, notes, agreements), the customer decides and we process it on their behalf.
• Visitors to our website and people who write to us.

• Account information: name, business email, phone number, company name and address, time zone, password (stored only as a secure hash) and 2-step verification settings.
• Payment information: Stripe collects and stores your card. We receive only the card brand, last four digits, expiry date, billing name and address, and your invoices and payment history. We never see or store full card numbers or security codes.
• Public records: surplus funds lists published by counties, courts and state agencies after tax and foreclosure sales, and related property and tax roll records (owner names, property and mailing addresses, case and parcel numbers, amounts and dates).
• Contact lookups: phone numbers and email addresses for property owners found through contact lookup providers, with do not call status where available. We also check numbers against the National Do Not Call Registry and state do-not-call lists we load, so that calls and texts to listed numbers are blocked.
• Customer content: notes, call logs and recordings (only when a customer turns recording on; where state law requires everyone’s consent, the other person hears “This call may be recorded” first), text messages, agreements, signatures, documents and client portal messages our customers and their clients create.
• E-signature records: when someone signs an agreement we keep the signature, their consent, the time, IP address and browser, to prove the signature is valid. We compare the signer’s IP address with recent sign-ins of the sending company’s team, to catch agreements signed by someone other than the claimant.
• Payout records: when a customer marks a claim paid, who the county or court paid, the amounts and the fee, so payouts to anyone other than the claimant can be flagged.
• Texting consent: when and how a person agreed to receive texts, and opt-out (STOP) requests.
• Work records: time clock shifts and breaks, an audit log of important actions in each account, and a record of when each team member opened, copied, added or downloaded claimants’ contact details.
• Fraud prevention data: on sign-up, Cloudflare Turnstile checks that a person (not a bot) is filling in the form, using browser and device signals; Stripe screens payments for fraud. We keep records of payment disputes and fraud warnings.
• Usage and device data: IP address, browser type, pages used and error logs, to keep the service secure and working.

• To provide, maintain, secure and improve SurplusNorth.
• To compile, check and deliver leads from public records to customers.
• To connect the calls and deliver the texts our customers send.
• To process payments, send invoices and receipts, and prevent fraud.
• To detect and stop misuse: copying or reselling the lead list, signatures made by someone other than the claimant, recovered funds paid to the wrong person, calls outside legal hours or to do-not-call numbers, and stolen-card sign-ups. Alerts go to the customer’s admins, and to us when the whole customer account is involved.
• To send service emails (sign-in, security, billing, invitations, signing links and notifications you choose in Settings).
• To answer support requests.
• To comply with law and enforce our terms.

SurplusNorth lets our customers text people who agreed to receive their messages. Consent is recorded with how and when it was given. Anyone can reply STOP to any message to stop receiving texts from that sender; HELP returns contact information. Message frequency varies. Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with or sold to any third party. Information may be shared with subcontractors that help us provide the service (for example, our telecommunications provider) only to deliver messages and support.

We do not sell personal information and do not share it for targeted advertising. We share it only:

• With service providers that run SurplusNorth for us, under contracts that let them use it only for that purpose: Amazon Web Services (hosting, storage and email delivery), Stripe (payments and fraud screening), Telnyx (calls and texts), Cloudflare (sign-up bot check) and contact lookup providers.
• With the customer whose account the information belongs to, and within that customer’s team according to the roles the customer sets.
• With carriers, as needed to register a customer’s texting campaign.
• When required by law, or to protect the rights, property or safety of anyone.
• In a merger, acquisition or sale of assets, subject to this policy’s protections.

We use only cookies needed for SurplusNorth to work: keeping you signed in, “trust this device” for 2-step verification, your chosen company and view, and security. We do not use advertising or cross-site tracking cookies.

Information is encrypted in transit and at rest. Each customer’s data is kept separate from every other customer’s at the database level. Owners and admins must use 2-step verification, important actions are recorded in an audit log, and staff access is limited to people who need it. No system is perfectly secure; if a breach affects your information we will tell you as the law requires.

• Account and customer content: while the account exists. After a plan ends the data stays so the customer can come back, until the customer asks us to delete it. We then delete it within 30 days.
• Payment, tax, signature, texting consent and opt-out records: as long as the law requires (often several years), even after an account is deleted.
• Contact access records, fraud and dispute records: while the account exists, and longer where needed to resolve a dispute or investigate misuse.
• Server logs: up to 90 days.
• Database backups: 14 days, then overwritten.

When you open a ticket or email us we keep your name, email, company, messages and any files you attach, to answer you and improve SurplusNorth. Our support staff may open a customer’s account to solve a problem; each visit is logged and shown to that customer.

• Reply STOP to any text to stop texts from that sender.
• If a recovery company contacted you through SurplusNorth, you can ask that company, or us, to stop contacting you, or to access or delete your information. We will pass your request to the company and help it respond.
• Customers can change their account details in Settings, and choose which notifications they get.
• Depending on where you live (for example California, Colorado, Connecticut, Virginia or Texas), you may have rights to know what we hold, get a copy, correct it, delete it, or opt out of sale or targeted advertising (we do neither). Use the “Privacy or data request” option on our contact page or email hello@surploom.com. We answer within 30 days (45 where state law allows), may need to confirm who you are, and will not treat you differently for asking.

SurplusNorth is for businesses and is not directed to children under 13. We do not knowingly collect their information.

SurplusNorth is offered in the United States and information is stored and processed in the United States.

We will post any changes to this policy on this page with a new effective date and, for important changes, tell account owners by email. Contact Surploom LLC at hello@surploom.com. See also our terms of service and refund policy.