Privacy Policy

SurplusProfit ("the Company", "we", "us") operates the SurplusProfit Software ("the Service") that aggregates public tax-delinquent and surplus-funds market data, performs skip tracing and heir discovery, generates outreach documents and contracts, and provides CRM and AI-agent outreach tooling for enrolled surplus funds recovery specialists ("Enrollees", "you").

This Privacy Policy describes what information the Service processes, how it is used, how it is safeguarded, and the rights of the individuals whose data appears in the records the Service surfaces — all in accordance with applicable state and federal privacy and data-protection laws.

The Service processes two categories of information:

• Account data — the name, email, phone, and billing information you provide directly when you enroll and subscribe.
• Public-record & third-party data — county tax-sale, tax-delinquent, and surplus-funds records; probate and heirship records; and skip-trace outputs (verified phone, email, and mailing address) obtained from lawful public and regulated data providers.

We rely on the lawful public-record and legitimate-interest bases under applicable state law and federal statutes for processing this data solely for the purpose of enabling Enrollees to pursue lawful surplus-funds recovery. We do not collect sensitive health or biometric data.

Public-record and skip-trace data is used only to:

• identify and contact former owners or lawful heirs who may be entitled to surplus;
• generate outreach letters, follow-ups, and notarized representation contracts;
• power AI-agent outreach (calls, SMS, email) under your direction and control;
• track recovery cases through the CRM pipeline and State Rules module; and
• compile aggregate, anonymized market statistics shown across the Service.

We do not sell personal data to third parties. We do not use owner or heir PII for unrelated advertising or commercial purposes.

The Service is designed to support — not replace — your compliance obligations under federal law, including:

• Gramm-Leach-Bliley Act (GLBA) — nonpublic personal information is handled only as permitted for the recovery use case and is not disclosed to non-affiliates.
• Telephone Consumer Protection Act (TCPA) — AI-agent call and SMS tooling requires your prior-express written consent and DNC-list screening, which the Service flags but does not guarantee.
• CAN-SPAM Act — email outreach includes a functional opt-out and accurate sender identity.
• FCRA — the Service does not furnish consumer reports for credit, insurance, or employment purposes.
• UETA / ESIGN — e-signature and notarization features follow the e-signature law adopted by the relevant state.

Surplus-funds recovery is governed state by state. Each state sets its own claim window, eligible claimants, filing authority, notarization requirement, and — where it applies — its own consumer-privacy and data-breach statute. The Service's State Rules module surfaces reference rules for each jurisdiction, but you remain responsible for confirming and following the specific statute of any state in which you operate.

Where a state imposes heightened data-protection requirements (for example a comprehensive consumer privacy act or specific data-disposal rules), the Service's controls are available to assist, but do not override your independent duty of compliance. Noncompliant handling may expose the responsible individual to civil and criminal liability under that state's law.

Account data is retained for the life of your subscription and the records-retention period required by applicable law and for legitimate billing/tax purposes thereafter. Public-record and skip-trace data is retained for the longer of your active subscription or the claim window applicable to each lead's state. Upon expiration of the relevant retention period, data is securely deleted or de-identified consistent with state data-disposal requirements.

We employ industry-standard safeguards including encrypted transit (TLS), encrypted storage at rest, access controls, and audit logging. Payment processing is handled by PCI-DSS compliant processors; we do not store full card numbers. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute security.

We share data only with processors necessary to operate the Service — hosting, payment processing, email/SMS/telephony providers, and skip-trace data sources — under written contracts that require them to handle data in accordance with applicable law.

We may disclose information when required by law, court order, or lawful government request, or to enforce these Terms, including referral to state or federal authorities in the event of suspected data misuse.

Enrollees may access, correct, or export their account data and may close their account at any time, subject to our no-refund Terms.

Individuals whose records appear in the Service (owners, heirs) may submit a request to access, correct, or delete personal data we hold about them, to the extent permitted by applicable state law and the public-record nature of the underlying data. Send requests to the contact below with reasonable identity verification.

Misuse of data obtained through the Service — including using PII outside the lawful recovery purpose, re-selling contact data, harassing owners, or bypassing TCPA/DNC rules — violates these Terms and may expose the responsible individual to state and federal civil and criminal liability. Suspected misuse may be reported to us and to the relevant state attorney general or federal authority. See our Terms & Conditions, Section 7.

The Service is intended for licensed adults acting as surplus funds recovery specialists. We do not knowingly collect personal data from minors. Heir records referencing minors are surfaced solely from public probate records and are not used to contact the minor directly.

We may update this Privacy Policy as laws or our practices change; the "last updated" date below reflects the current version. Material changes will be surfaced in-app or by email where feasible.

To exercise your rights, report a concern, or request enforcement of this Policy, contact our privacy team through the in-app support channel. This Policy is enforced in conjunction with applicable state and federal law, and any conflict is resolved in favor of the stricter applicable legal requirement.