Let's talk
← Back to home

Privacy Policy

Last updated: April 2026

1. Who we are

Surge is a product of Juna Partners Limited (company no. 17188391), registered in England and Wales. References to "we", "us" or "our" in this policy refer to Juna Partners Limited.

For questions about this policy or to exercise your rights, contact us at: privacy@wearejuna.com

2. What data we collect

Website visitors

  • IP address and browser information collected by our hosting infrastructure (Cloudflare)
  • Cookie consent preferences stored in your browser's local storage
  • With your consent: analytics data (pages visited, time spent, device type) via privacy-friendly analytics

Surge application users

  • Account data: name, email address, job title, department, timezone
  • Authentication data: hashed passwords, 2FA secrets (TOTP), session tokens
  • Content data: resourcing requests you raise, candidate records and CVs you upload, feedback and communications you create
  • Candidate data: information candidates submit via email intake forms — contact details, skills, rates, availability, IR35 status, clearances and supporting documents
  • Usage data: AI feature usage (tokens, model, feature type), login timestamps
  • Invitation data: email addresses of people you invite to your organisation

3. Lawful basis for processing

  • Contract performance: processing your account data and content to provide the Surge service you have subscribed to
  • Legitimate interests: security monitoring, fraud prevention, service improvement analytics
  • Consent: optional analytics cookies on this website
  • Legal obligation: retaining records required by applicable law

4. How we use your data

  • To provide and operate the Surge application
  • To authenticate your identity and keep your account secure
  • To process AI requests on your behalf via Azure AI Foundry
  • To send service-related communications, including candidate intake, confirmation and update emails sent on behalf of your organisation
  • To calculate AI usage and generate billing information
  • To improve the product based on aggregated, anonymised usage patterns

5. AI processing and data location

Surge processes AI requests through Azure AI Foundry (Microsoft). Your content is sent to Azure AI services for generation and embedding. We configure Azure to use UK South or UK West regions to keep processing within the UK.

We do not use OpenAI's consumer endpoints. Your content is never used to train external AI models.

6. Who we share data with

  • Microsoft Azure: hosting, database, AI processing (data processor)
  • Cloudflare: CDN, DDoS protection, Tunnel (data processor)
  • We do not sell personal data to third parties
  • We do not share personal data with advertisers

7. Data retention

  • Account data: retained for the duration of your subscription, plus 90 days after cancellation
  • Candidate and request content: retained for the duration of your subscription. You can export or delete content at any time
  • AI usage logs: retained for 24 months for billing and analytics purposes
  • GDPR anonymisation: if you request erasure under GDPR Article 17, your personal identifiers are erased and contributions are de-attributed to [Former User]

8. Your rights under UK GDPR

You have the right to:

  • Access: request a copy of your personal data (available via Settings → Privacy → Export my data)
  • Rectification: correct inaccurate personal data
  • Erasure: request deletion of your personal data
  • Restriction: request we limit processing of your data
  • Portability: receive your data in a machine-readable format
  • Object: object to processing based on legitimate interests
  • Withdraw consent: for processing based on consent, withdraw at any time

To exercise any of these rights, contact privacy@wearejuna.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

9. Security

We implement appropriate technical and organisational measures including: encrypted data in transit (TLS), bcrypt password hashing, two-factor authentication, JWT session tokens, and regular security reviews.

10. Cookies

See our Cookie Policy for details of cookies used on this website.

11. Changes to this policy

We may update this policy periodically. Material changes will be communicated via the application or by email. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact

Juna Partners Limited (company no. 17188391)
5 Approach Road, Raynes Park, London, United Kingdom, SW20 8BA
Email: privacy@wearejuna.com