What this site collects

This page describes surfpay.ai only. The binding privacy policy for Surfboard Payments AB, covering merchants, cardholders, transactions and everything done under its payment institution licence, is published at surfboardpayments.com/privacy-policy. If the two ever appear to conflict, that one governs.

No cookies, no analytics, no account

This site sets no cookies. It runs no analytics, no tag manager, no session recording, and no advertising or tracking pixels of any kind. There is nothing to sign in to, and no form here that collects your details: every contact route on the contact page is an email address or a link to another site.

One thing is stored in your browser. The Human/Agent toggle writes a single value, surfpay-view, to localStorage, so that returning in Agent view does not flash the human page first. It never leaves your browser, and clearing site data removes it.

What the server sees

The site is hosted on Netlify. Like any web server, it records the ordinary details of a request in its logs: the IP address, the time, the path, the response status, and the user agent. These logs exist to keep the site up and to defend it against abuse. They are not joined to anything, not used to build a profile, and not shared for advertising.

Two endpoints receive more than a path. /api/search receives the keywords in the query string, and the MCP endpoint at /.well-known/mcp receives the JSON-RPC message posted to it. Both are read-only and neither is authenticated, so neither is tied to an identity. Do not send credentials, cardholder data or personal data to either one; nothing about them needs it, and the instructions this site publishes tell agents so explicitly.

Requests to other domains

Pages here load two typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), which means your browser makes a request to Google when it renders a page. That is the only third party involved in serving this site. Nothing else here is hosted or measured elsewhere.

This site also links out: to surfboardpayments.com, developers.surfboardpayments.com, GitHub, and npm. Once you follow one of those, that site's own policy applies.

What an agent should know

Everything on this domain is public, unauthenticated and open to cross-origin requests. You do not need to send a key, an identifier, a user agent that says who you are, or anything about the person you are working for. Fetching /llms.txt anonymously gets you the entire product.

The instructions published here go further than not asking: they tell an agent never to have a user paste API keys into a chat, never to read secrets back, never to print one to a log, and never to write code that touches card numbers, CVV, or track data. Those rules are in the payload itself, where the agent will actually read them.

Your rights, and who to ask

Surfboard Payments is established in Sweden, so the GDPR applies to the personal data it processes, including server logs. To ask what is held about you, to have it corrected or erased, or to object to processing, write to support@surfboardpayments.com or use the contact page. The full set of rights, the legal bases relied on, retention periods and the supervisory authority to complain to are set out in the company privacy policy, which is the document of record.

Related: cookie policy, terms and conditions.

This description of surfpay.ai was last checked against the code on 2026-08-24.