Privacy & Data Policy

Short, plain-English version. No fluff. Here's exactly how SurMe handles your stuff.

What staff CANNOT see

The content of your chats with SurMe (only you and the AI model see them)
Your saved memories, contacts, or location as an individual
Other users' messages, ever
Your Gmail inbox or Google Calendar events

What staff CAN see

How many messages you send (counts only)
When you were last active
Whether a message triggered a scam warning
Sign-in errors and OAuth failures (for fixing bugs)
Aggregated stats (e.g. "5 users picked TikTok")
Messages you report via the flag button

Reporting a bad reply: when you tap the flag on one of surme's messages, that one reply + the message you sent right before it get copied to a staff inbox so we can fix it. Nothing else from the chat is shared.

1. Who we are

SurMe is a professional AI assistant that lives in Telegram and the web app. We're built by Nilaa Labs to help you organize tasks, send email, manage calendar, and get research without leaving your chat.

2. What we store

Account info — Google email + name when you sign in.
Chats & memory — your messages with SurMe and the structured profile (identity, working_on, preferences, recent_tasks) it builds so it can remember context. Encrypted at rest, protected by row-level security.
Google tokens (only if you connect) — OAuth tokens for Gmail send and Calendar event creation. We never read your inbox or browse your calendar.
Telegram link — chat ID once you connect with /connectweb.
Contacts you save — recipient names + email addresses you add via /contact or /setemail, used only to resolve "email Alice" requests.
Location (optional) — the city you provide via /setlocation. We do not read GPS.

3. How we use it

Strictly to run the assistant for you — generate replies, remember preferences, send the emails you ask for, create the calendar events you ask for, and run the research you request. We do not sell your data. We do not read your chats.

4. Who we share with

AI model providers (Google Gemini via the Lovable AI Gateway) — receive your message to generate a reply.
Google APIs — only the Gmail send and Calendar insert calls you trigger.
Telegram — only the messages needed to deliver replies.
Nobody else.

5. How we prove it

The admin dashboard only queries counts and metadata, never message content.
Row-level security on the database blocks even admins from reading your messages rows.
Reports you submit are the only way staff sees a specific reply.

6. Your rights

Delete your account + data anytime from Settings.
Ask for an export — email us.
Disconnect Google / Telegram whenever you want.

7. Kids

SurMe is for users 13+. If you're younger, please don't use it without a parent.

8. Changes

If we update this policy, we'll change the "Last updated" date above. Big changes = we'll ping you in-app.

9. Contact

Questions? DM us on Telegram @SurMe1_bot or email nilaademo@gmail.com.