Privacy Policy

1. Who we are

GCM Ventures LLC(“we,” “us,” “our”) operates Surgepoint at surgepoint.io as a doing-business-as (DBA) name. Surgepoint is a vetted booking and referral service that connects homeowners with licensed local contractors for inspections and quotes. We are not a contractor and do not perform inspections, repairs, or restoration work ourselves.

This Privacy Policy explains what information we collect when you use our website or submit a request through one of our forms or phone numbers, how we use that information, and the choices you have.

2. Information we collect

Information you give us

When you complete a request form on a Surgepoint landing page or call one of our phone numbers, you may provide:

• Your name
• Phone number
• Email address (optional)
• Property address and ZIP code
• Answers to qualification questions about the service you're requesting (for example, when damage occurred or what kind of work you need)
• A record of your TCPA consent — the exact consent language shown to you, the version of that language, and the time you submitted the form

Information collected automatically

When you visit our website, we automatically collect:

• Device and browser information (user agent, screen size, operating system)
• IP address and approximate location derived from it
• The page URL you arrived on and pages you view on our site
• Marketing attribution parameters in the URL, such as utm_source, utm_campaign, gclid (Google), fbclid (Meta), and msclkid (Microsoft/Bing)
• Cookies and pixel data from our analytics and ad-measurement partners (see Section 5)

Information from third parties

We may receive limited information about your interaction with our ads from advertising platforms (Meta, Google, Microsoft) for the purpose of measuring conversion performance.

3. How we use information

We use the information we collect to:

• Match you with one vetted licensed local contractor in our network who serves your area
• Schedule and confirm your inspection appointment
• Communicate with you about your request, including SMS and phone confirmations (with your prior consent — see Section 7)
• Verify and re-route your booking if the matched contractor is unavailable
• Maintain a record of your TCPA consent for legal compliance
• Measure the performance of our advertising and improve our service (we report aggregated and hashed data to ad platforms — see Section 4)
• Detect and prevent fraud or abuse of the service
• Comply with legal obligations

4. How we share information

With the matched local contractor

When you submit a request, we share the relevant details (name, phone, address, your qualification answers, and any notes you provide) with one vetted licensed local contractor in our network so they can prepare for and contact you about the inspection. We do not send your information to multiple contractors or auction your lead.

With service providers we use to operate Surgepoint

We share information with vendors who help us run the service, such as:

• Hosting and database providers (e.g., Vercel, Supabase, AWS)
• Analytics providers (e.g., PostHog)
• Communication providers (e.g., Postmark, Resend, Twilio, OpenPhone)
• Customer-data and CRM tools we use internally to track lead handling

These vendors are contractually limited to using your information to provide their services to us.

With advertising platforms (server-side conversion measurement)

We send conversion events (such as “a homeowner submitted a form”) to Meta, Google, and Microsoft so we can measure ad performance. When required, we hash certain identifiers (such as email and phone) before transmission. These platforms use the data subject to their own privacy policies.

For legal reasons

We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect the rights, property, or safety of GCM Ventures LLC, our customers, or the public.

What we do not do

• We do not sell your personal information.
• We do not auction or distribute your lead to multiple competing contractors.
• We do not handle, file, or take any action on your insurance claim.

5. Cookies and tracking technologies

We and our partners use cookies, pixels, and similar technologies to measure how our advertising and website are performing. These include, among others:

• Meta Pixel & Conversions API for Facebook/Instagram conversion measurement (cookies _fbp, _fbc)
• Google gtag for Google Ads conversion measurement
• Microsoft UET for Bing Ads conversion measurement (when enabled)
• PostHog for product analytics and funnel attribution

Most browsers let you control cookies through their settings. You can also opt out of personalized advertising at AdChoices and the Network Advertising Initiative.

6. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we have collected about you in the past 12 months
• Request a copy of that information in a portable format
• Request that we correct inaccurate information
• Request that we delete information we hold about you, subject to legal record-keeping exceptions (including TCPA-required consent records)
• Opt out of the sale or sharing of personal information (we do not sell, but you can confirm in writing)
• Not receive discriminatory treatment for exercising your rights

To exercise any of these rights, email us at privacy@surgepoint.io from the address you used with us, or call us at the number listed on our Contact page. We will verify your identity before responding to substantive requests. We will respond within the timeframe required by applicable law (typically 30–45 days).

7. SMS and phone communications (TCPA)

When you submit a request, you provide express written consent for GCM Ventures LLC d/b/a Surgepoint and the one local contractor matched to your request to call, text, or email you at the contact information you provide about your request, inspection scheduling, related services, and follow-up. Where permitted by law, those communications may use automated technology, prerecorded messages, or artificial voice. The exact consent language you saw and agreed to is preserved in our records.

Standard message and data rates from your carrier may apply. Frequency varies based on your request and follow-up needs. Your consent is not a condition of using the service. To opt out at any time, reply STOP to any text from us, or email us at privacy@surgepoint.io. Note: opting out of marketing texts does not affect transactional messages required to confirm or reroute an active appointment you have requested.

8. Data retention

We retain personal information as long as needed to provide the service, comply with legal obligations (including TCPA consent records), resolve disputes, and enforce our agreements. Lead and consent records are typically retained for at least four years after your last interaction, in line with TCPA litigation defense requirements.

9. Children's privacy

Surgepoint is intended for adult homeowners. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, please contact us at privacy@surgepoint.io and we will delete it.

10. Security

We use commercially reasonable physical, technical, and organizational safeguards to protect personal information, including encryption in transit, encrypted storage, access controls, and vendor security review. No internet transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. International users

Surgepoint is operated from the United States and is intended for U.S. homeowners. If you access the service from outside the U.S., you consent to the transfer and processing of your information in the U.S., where data protection laws may differ from those in your country.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. If we make material changes, we'll post a notice on this page and, where appropriate, notify you by email or in-product notice.

13. Contact us

Questions, requests, or complaints about this Privacy Policy can be sent to:

GCM Ventures LLC d/b/a Surgepoint
Email: privacy@surgepoint.io
Web: surgepoint.io