SURFACE ADVISORY GROUP, LLC

Effective Date: September 17, 2026 | surfaceadvisory.com

Surface Advisory Group, LLC, a Maine limited liability company (“Surface Advisory,” “we,” “us,” or “our”), respects the privacy of the people who visit our website and the clients we work with. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices available to you. This Policy applies to surfaceadvisory.com (the “Site”) and to personal information we collect in the course of providing consulting and advisory services (the “Services”) under a Statement of Work. It does not apply to TeamFlowsAI or any other software platform, which is addressed separately in Section 6.

1. Information We Collect

1.1 Information You Provide.

We collect information you provide directly, such as when you:

Submit a contact or inquiry form, or email us at hello@surfaceadvisory.com or alan@surfaceadvisory.com;
Sign a Statement of Work or otherwise engage us for Services, including billing, point-of-contact, and business information;
Communicate with us by email, phone, video call, or in person during an engagement; or
Provide Client Materials, business data, or other information needed to perform the Services under a Statement of Work.

1.2 Information Collected Automatically.

When you visit the Site, we and our service providers may automatically collect certain information through cookies, log files, and similar technologies, including your IP address, browser and device type, pages viewed, referring URL, and the date and time of your visit. See Section 7 (Cookies and Website Analytics).

1.3 Information from Third Parties.

We may receive limited information about you from third parties, such as a colleague who refers you to us or a professional network you and we are both part of.

2. How We Use Information

We use the information we collect to:

Respond to inquiries and communicate with prospective and current clients;
Scope, deliver, and manage consulting engagements under a Statement of Work;
Send invoices and process payments;
Maintain, secure, and improve the Site and our internal operations;
Comply with legal, tax, and regulatory obligations; and
Pursue legitimate business interests, such as protecting against fraud or misuse of the Site or our Services.

We do not sell personal information, and we do not use client business data for purposes outside the scope of the applicable engagement without permission.

3. How We Share Information

We share personal information only as follows:

With affiliated consultants engaged by Surface Advisory to help deliver the Services, who are bound by confidentiality obligations consistent with our client engagement terms;
With service providers who support our operations, such as email, scheduling, accounting, and cloud storage providers, acting on our instructions;
Where an engagement involves AI Tools or third-party platforms, with those platforms to the extent described in the applicable Statement of Work and our client engagement terms;
To comply with applicable law, legal process, or a valid governmental request, or to protect the rights, property, or safety of Surface Advisory, our clients, or others; and
In connection with a merger, acquisition, financing, or sale of assets, subject to reasonable confidentiality protections.

4. AI Tools Used in Delivering Services

As described in our client engagement terms, the Services may involve artificial intelligence systems, agentic workflows, or related third-party platforms (“AI Tools”). Where Client Materials or other personal information is processed by a third-party AI Tool as part of an engagement, that platform's own privacy terms and data-handling practices apply to that processing, and the applicable Statement of Work will identify the AI Tools involved. We select AI Tools with care and use them consistent with a human-orchestrated approach, but we do not control, and are not responsible for, a third-party AI Tool's own data practices.

4.1 Zero Data Retention with Underlying Model Providers. Where Surface Advisory directly accesses large language models from Anthropic (Claude), OpenAI, Google (Gemini), or xAI (Grok) through those providers' commercial APIs in performing the Services, that access is subject to zero data retention (“ZDR”) terms in our agreements with each provider. Under these ZDR terms, data we submit through the API is not retained by the provider beyond what is needed to process the request and is not used to train the provider's models. This ZDR protection applies specifically to Surface Advisory's own direct, API-based use of these four providers. It does not automatically extend to other third-party AI Tools, platforms, or consumer applications that may be part of an engagement, including tools Client already uses; the applicable Statement of Work will identify any such AI Tools and their own data-handling terms.

5. Data Retention

We retain personal information for as long as needed to fulfill the purposes described in this Policy, including for the duration of a client relationship and afterward as necessary to comply with legal, tax, accounting, or recordkeeping obligations, resolve disputes, and enforce our agreements. Client Materials are retained and disposed of consistent with the terms of the applicable Statement of Work.

6. TeamFlowsAI and Other Platforms

TeamFlowsAI is a separate software platform. If you use TeamFlowsAI, or if a Statement of Work references TeamFlowsAI or another Surface Advisory-owned or third-party software platform, that platform is governed by its own, separate privacy policy and terms of service, not by this Policy. The platform-specific privacy policy will describe what data that platform collects, how it is used, and the choices available to you as a user of that platform. Where this Policy and a platform-specific privacy policy overlap for the same individual, the platform-specific policy governs your use of that platform, and this Policy governs the Site and our consulting Services generally.

As a general matter, TeamFlowsAI is architected as a multi-tenant, cloud-based platform in which each customer's data is isolated in its own tenant. Transactions, documents, and other information belonging to one customer's tenant are not accessible to any other customer's tenant, and are not accessible to TeamFlowsAI personnel who are not customer support personnel. TeamFlowsAI customer support personnel request and receive a customer's explicit permission before accessing any data or information within that customer's tenant. Full details on how TeamFlowsAI collects, uses, and safeguards data are set out in the TeamFlowsAI Privacy Policy, not this Policy.

7. Cookies and Website Analytics

The Site may use cookies and similar technologies for basic functionality and to understand how visitors use the Site, such as through a standard web analytics service. You can control cookies through your browser settings, including blocking or deleting them, though some parts of the Site may not function properly without them. The Site does not currently respond to “Do Not Track” browser signals.

8. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, use, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Choices and Rights

Depending on where you live, you may have rights to request access to, correction of, or deletion of your personal information, or to object to certain processing. To make a request, contact us using the information in Section 13, and we will respond consistent with applicable law. We will not discriminate against you for exercising these rights. If we are unable to fulfill a request in full, such as where information is needed to complete an active engagement or satisfy a legal obligation, we will explain why.

10. Children's Privacy

The Site and Services are directed to businesses and professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

11. International Visitors

Surface Advisory is based in the United States, and personal information we collect is generally processed and stored in the United States. If you access the Site or engage our Services from outside the United States, you understand that your information may be transferred to, and processed in, the United States, which may have data protection laws different from those in your jurisdiction.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the updated Policy on the Site with a revised effective date, and material changes will be communicated where appropriate.

13. Contact Us

Questions about this Policy, or requests regarding your personal information, may be directed to Surface Advisory Group, LLC at hello@surfaceadvisory.com or through surfaceadvisory.com. Questions related to an active engagement should be directed to Alan Boucher, Managing Director, at alan@surfaceadvisory.com.