Last updated: 8 October 2026.
This Privacy Policy explains what personal data SurSolver collects when you use the Service (the website, the dashboard and the API), why we collect it, how long we keep it and what rights you have. It forms part of the Terms of Service and uses the same defined terms.
The data controller is SurSolver ("we", "us", "our"), the operator of the Service.
1.1 Account data. Your email address and a password. The password is stored only as an irreversible hash — the plaintext is never written to disk. Optional profile fields you add in the dashboard.
1.2 Credentials. API keys, login session tokens and email verification / password-reset tokens are stored only as irreversible hashes, plus a short display prefix for keys; the raw values exist only in your browser or your own configuration.
1.3 Billing data. Balance movements, transactions and payment records for your top-ups. We never store card data.
1.4 Task data. The target site of each task you submit and the result we return, in hashed form.
1.5 Technical and security data. IP addresses, user agents and timestamps attached to requests; security events (failed logins, abuse signals) and audit records of administrative actions.
1.6 Communications. Support tickets and messages you send us, and a record of the transactional emails we send you.
2.1 To operate the Service: authenticate you, run your tasks, return results, keep your balance correct, and answer support requests.
2.2 To secure the Service: detect abuse and fraud, enforce rate limits and protect other users.
2.3 To communicate with you about your account: verification and password-reset emails, billing notices, and service messages in the dashboard.
2.4 We do not sell personal data, and we do not use it for advertising or profiling. The site runs no advertising or analytics of our own; the only third-party scripts are the bot-protection widgets described in Section 04.
3.1 Contract. Processing needed to perform the Terms: account, billing, task and support data.
3.2 Legitimate interests. Security, fraud prevention and the integrity of the Service, and aggregate service metrics derived from task records.
3.3 Legal obligation. Retention required by applicable law.
4.1 The site sets no advertising cookies and runs no analytics — first-party or third-party.
4.2 The sign-in, sign-up and password-reset pages embed two bot-protection widgets: Cloudflare Turnstile and Google reCAPTCHA (headless, no visible challenge). They run in your browser to confirm the request comes from a person, and in doing so Cloudflare and Google receive your connection data (IP address, user agent and the page you are on). They are not used for advertising on this site. Their own policies govern their processing: Cloudflare Privacy Policy and Google Privacy Policy.
5.1 We keep the target site of each task and the result in hashed form. The payload you submitted — including any proxy credentials and cookies — is deleted once the retention window passes, for tasks in any status.
5.2 What remains afterwards is a reduced history entry (the target site, the captcha type, the hashed result, the status and the timing) that feeds your dashboard history and the platform's aggregate statistics; it contains no credentials.
5.3 Account, billing and security records are kept for as long as your account is active and afterwards for the periods required by law.
6.1 Payments. Top-ups are processed by our payment provider; we store only the amount, the status and the provider's reference.
6.2 Email. Transactional email is sent by our email provider.
6.3 Solving capacity. A task's parameters are forwarded to the solving backend that serves its captcha type, because that is the Service you asked for; the backend receives the task payload, not your account credentials.
6.4 Infrastructure. Hosting and database providers that process data on our behalf under confidentiality obligations.
6.5 We disclose personal data to authorities only where we are legally required to.
Processors listed in Section 06 may operate outside your country of residence. Where personal data leaves its origin jurisdiction we rely on contractual obligations with the recipient and, where applicable, on adequacy decisions or other lawful transfer mechanisms.
8.1 Passwords, session tokens, API keys and email tokens are stored only as irreversible hashes, so a database disclosure does not expose usable credentials.
8.2 All traffic to the Service is encrypted in transit. API keys can be restricted to your own IP ranges, and administrative access requires a second factor.
9.1 You may request access to, correction of, or deletion of your personal data, a copy of it in a portable form, or object to processing based on legitimate interests. Write to [email protected] and we will answer within the period applicable law allows.
9.2 Closing your account deletes your user row; sessions, API keys and other per-account records are removed with it. A reduced delivery-evidence record — the target site and the hashed result — is retained for legal and abuse purposes.
The Service is not directed at persons under eighteen and we do not knowingly collect their personal data. If we learn that a child has registered, we delete the account.
We may update this Policy as the Service changes. Material changes are announced on the site and, where we hold your email, by email before they take effect. The date below is the version in force.
Questions about this Policy or your data: [email protected]. The same address handles data-subject requests.
