Last updated: 09.10.2026
This Privacy Policy explains how Dzeya OÜ collects and uses personal data when you visit designsystems.surf and its subdomains (including my.designsystems.surf and survey.designsystems.surf), subscribe to our emails, buy our products or use your account.
1. Who we are
The controller of your personal data is Dzeya OÜ, registration number 17182117, VAT EE102834336, Vesivärava tn 50-201, 10152 Tallinn, Estonia ("we", "us"). Design Systems Surf is our brand.
Contact for any privacy question or request: hey@designsystems.surf.
2. What data we collect
Data you give us
Email address and name when you subscribe, download a free resource, fill in a form, take a survey or quiz, or create an account.
Optional profile and survey answers, such as job title, design experience, team size, whether you have a design system, how you use AI, and feedback you send us.
Messages you send to our support address.
Data created when you buy
Name, email, billing address, country, the product or plan, price, currency, taxes, and payment and subscription status. Card details are entered directly with our payment providers (Stripe and Link) and are never stored by us.
Data created when you use your account (my.designsystems.surf)
Login records (email, sign-up date, last sign-in), the products you have access to, files you download and when, items you save, onboarding answers, notification preferences and feedback.
If you choose "Continue with Google", we receive your name, email address and profile picture from Google.
Data collected automatically
Device and browser information, IP address, approximate location (country or city), pages you visit, referring site, campaign parameters (UTM), and interactions such as clicks and form submissions. On the main site, analytics and advertising tools are used only as described in our Cookie Policy.
When you open or click our emails, our email provider records this, along with an approximate location derived from it.
Links in our emails may contain a subscriber identifier so that our site can recognise you and pre-fill your email address at checkout.
3. Why we use your data and on what legal basis
Selling and delivering products, giving you access to your account and subscription content, handling cancellations, refunds and support. Performance of a contract (6(1)(b))
Sending the newsletter, free resources you asked for, product news and offers by email. Your consent (6(1)(a)); you can withdraw it at any time with the unsubscribe link
Emails about your purchase, subscription or account (receipts, access, failed payments). Performance of a contract (6(1)(b))
Analytics and advertising cookies and pixels on the main site. Your consent (6(1)(a)), given through the cookie banner
Measuring sales from our ads by sending events to Google and Meta from our server, with personal identifiers hashed. Our legitimate interest in measuring our advertising (6(1)(f))
Showing our ads to existing subscribers and customers (for example Google Customer Match, using hashed email addresses). Our legitimate interest in marketing to our existing audience (6(1)(f)); you can object at any time
Product analytics inside your account, to understand which features are used. Our legitimate interest in improving the product (6(1)(f))
Tailoring content and offers, such as regional pricing codes based on your approximate country, or results and recommendations based on your quiz answers. Our legitimate interest (6(1)(f)); this does not produce legal or similarly significant effects for you
Preventing fraud and abuse, keeping our services secure, and handling payment disputes and chargebacks. Our legitimate interest (6(1)(f))
Keeping accounting and tax records. Legal obligation (6(1)(c))
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Who we share data with
We do not sell your personal data. We share it only with service providers that process it on our behalf or as independent controllers where stated:
Payments: Stripe and Link (Sold through Link, LLC, a Stripe affiliate). For most purchases Link acts as merchant of record and processes your payment and tax data as an independent controller under its own terms and privacy policy.
Email and CRM: Kit (email marketing and subscriber management).
Account, survey and website hosting: Framer (main website and its forms), Lovable and Supabase (account and survey apps, databases, login emails), Cloudflare (content delivery and security).
Sign-in: Google, if you choose to sign in with Google.
Analytics: Google Analytics, Microsoft Clarity, Ahrefs Web Analytics, Framer Analytics, Kit Insights, Lovable's page analytics on our subdomains, and PostHog (product analytics inside your account, EU data region). Details are in our Cookie Policy.
Advertising: Google (Google Ads), Meta (Meta ad network), TikTok (TikTok ad network), and LinkedIn (LinkedIn ad network), as described in our Cookie Policy.
Automation and internal tools: Make (moves form and purchase data between our tools), Google Cloud (our server-side tracking services), Slack and Asana (internal notifications and tasks), and Google Workspace (email).
Authorities and advisers, where required by law or to defend legal claims.
5. International transfers
Some of these providers are based in, or store data in, the United States or other countries outside the European Economic Area. Where this happens, the transfer is protected by an adequacy decision (such as the EU–U.S. Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses.
6. How long we keep data
Email subscription data: until you unsubscribe or ask us to delete it. After unsubscribing we may keep your email address on a suppression list so that we do not email you again.
Account data: while your account exists. You can ask us to delete your account at any time.
Purchase, invoice and tax records: 7 years, as required by Estonian accounting law.
Support emails and feedback: as long as needed to handle the request and any follow-up.
Analytics and advertising data: according to the retention settings of each tool, which we keep limited.
7. Your rights
You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (this does not affect processing before withdrawal). You can object at any time to the use of your data for marketing.
To exercise these rights, email hey@designsystems.surf. We will reply within one month.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the data protection authority where you live.
8. Children
Our services are intended for professionals and are not directed at children under 16. We do not knowingly collect their data.
9. Security
We use access controls, encrypted connections and reputable providers to protect your data. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where the law requires.
10. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
11. Changes
We may update this Privacy Policy. The "Last updated" date at the top shows the latest version. If changes are significant, we will let you know by email or on the site.