1. Scope and Who We Are

This Privacy Policy explains how Hits Surf (collectively, “Hits Surf,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you use hits.surf, create an account, surf websites, submit a website or offer, purchase or redeem points, contact support, or otherwise use our traffic exchange and related services (the “Service”).

For purposes of applicable privacy law, Hits Surf is generally the controller or business responsible for the personal information described in this Policy. Advertisers, payment providers, hosting companies, analytics providers, and websites you visit through the traffic exchange may independently control information they collect from you.

2. Information We Collect

Depending on how you use the Service, we may collect the following categories of information:

We may also create aggregated or de-identified information that is not reasonably linked to an identifiable individual. We may use that information for analytics, security, product improvement, and business reporting as permitted by law.

3. How We Collect Information

• Directly from you, such as when you register, edit your account, add a website, create an offer, purchase points, request a redemption, or contact support.
• Automatically from your browser or device, including through server logs, cookies, sessions, request headers, security tools, and activity records.
• From other members, such as referrals, website reports, offer disputes, or abuse reports.
• From service providers, such as payment-status confirmations, fraud signals, hosting logs, email delivery results, and CAPTCHA verification.
• From publicly available or submitted sources, such as the public content of a website or offer submitted to the Service.

4. How We Use Personal Information

We use personal information to:

• create, authenticate, maintain, and secure accounts;
• operate the traffic exchange, timers, visit validation, website rotation, country targeting, statistics, offers, points, rewards, referrals, purchases, and redemptions;
• attribute completed visits and offers, prevent duplicate credit, and correct inaccurate or fraudulent statistics;
• review websites and offers for safety, legality, quality, and compliance with our Terms of Service;
• detect bots, scripts, multiple-account abuse, payment fraud, chargebacks, phishing, malware, circumvention, and other prohibited conduct;
• send service messages, security alerts, account notices, support responses, transaction confirmations, and policy updates;
• process payments and redemptions through third-party providers;
• analyze performance, troubleshoot errors, improve features, and understand use of the Service;
• enforce agreements, resolve disputes, protect users and third parties, and comply with legal obligations;
• establish, exercise, or defend legal claims and respond to valid governmental or legal requests.

5. Traffic Exchange and Third-Party Websites

Those third parties operate under their own privacy policies and are not controlled by Hits Surf. A submitted website may set cookies, request information, display advertisements, or track activity after you leave Hits Surf. Review the destination’s privacy practices before providing personal information or completing an external action.

Advertisers may receive aggregated visit counts and operational statistics for their campaigns. We do not intentionally provide advertisers with a surfer’s account password or full payment credentials. We may disclose limited account, visit, device, or security information when reasonably necessary to investigate fraud, resolve a dispute, comply with law, or protect the Service.

6. Cookies and Similar Technologies

We use cookies, PHP sessions, local storage, and similar technologies where applicable to keep you signed in, remember preferences, protect forms, maintain security, prevent duplicate rewards, measure traffic, and operate core Service features.

You can manage cookies through your browser. Blocking all cookies may log you out, break timers or verification, and prevent visits or offers from being credited. Where applicable law requires consent for non-essential cookies, we will request that consent before activating them.

7. How We Disclose Information

We may disclose personal information to:

• Service providers that provide hosting, databases, content delivery, email, security, CAPTCHA, fraud prevention, analytics, customer support, backups, and technical operations.
• Payment and redemption providers that process purchases, payouts, chargebacks, refunds, identity checks, or transaction risk.
• Advertisers and other members when necessary to operate campaign statistics, referrals, offers, disputes, reports, or other member-directed features.
• Professional advisers, including attorneys, accountants, insurers, auditors, and security consultants.
• Authorities or affected parties when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, users, the public, or the integrity of the Service.
• A successor or transaction participant in connection with a merger, financing, reorganization, acquisition, sale of assets, bankruptcy, or similar business transaction, subject to appropriate safeguards.
• Other parties at your direction or with your consent.

We do not currently sell personal information for monetary consideration. We may display third-party advertising or load third-party content. Those providers may collect information directly from your browser under their own policies. If our practices involve a “sale,” “sharing,” or targeted advertising as defined by applicable law, we will provide the notices and opt-out methods required by that law.

8. Payments, Redemptions, and Financial Information

Payments and redemptions may be processed by third-party providers such as PayPal or another provider shown at checkout or redemption. Their privacy policies govern information submitted directly to them. We may receive transaction identifiers, payer or payout email addresses, status, amount, currency, fees, chargeback information, and limited risk signals.

Do not send full card numbers, bank credentials, passwords, government identification, or other unnecessary sensitive information through ordinary support messages. When identity or fraud verification is required, we will request only information reasonably necessary for that purpose.

9. Legal Bases for Processing

Where a legal basis is required, we process personal information based on one or more of the following:

• Contract: to provide the Service you request and administer your account, points, offers, visits, purchases, and redemptions.
• Legitimate interests: to secure and improve the Service, prevent fraud, provide support, maintain accurate records, enforce rules, and protect users and business operations, balanced against your rights.
• Legal obligation: to maintain required records and respond to lawful requests, tax, accounting, consumer-protection, sanctions, or other obligations.
• Consent: where we ask permission for a specific activity, such as certain non-essential cookies or marketing communications. You may withdraw consent prospectively.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain accurate balances and statistics, meet legal and accounting obligations, resolve disputes, enforce agreements, and prevent repeat abuse.

Retention periods may be extended when information is subject to a legal hold, active investigation, unresolved dispute, security incident, or statutory requirement. We may delete or de-identify information when it is no longer reasonably needed.

11. Data Security

We use administrative, technical, and organizational safeguards designed to protect personal information, which may include access controls, password hashing, encrypted connections, CSRF protection, input validation, transaction controls, logging, backups, least-privilege access, and fraud monitoring.

No online service can guarantee absolute security. You are responsible for using a strong, unique password, protecting your email account, signing out of shared devices, and promptly notifying us of suspected unauthorized access. Never reuse your Hits Surf password on another service.

12. International Data Transfers

Hits Surf is operated from the United States, and members, advertisers, and service providers may be located worldwide. Your information may therefore be processed in countries with privacy laws different from those where you live.

Where applicable law requires additional safeguards for international transfers, we will use an appropriate legal mechanism or rely on a permitted exception. Third-party websites opened through the traffic exchange may independently transfer information under their own policies.

13. Your Privacy Rights

Depending on your location and subject to legal exceptions, you may have the right to:

• confirm whether we process your personal information and access a copy;
• correct inaccurate personal information;
• delete personal information;
• obtain a portable copy of certain information;
• opt out of certain sales, sharing, targeted advertising, or profiling;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• appeal a decision concerning a privacy request;
• receive equal service and not be unlawfully discriminated against for exercising privacy rights.

To submit a request, email admin@hits.surf with the subject “Privacy Request” and describe the right you wish to exercise. We may need to verify your identity and account ownership. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct verification with the account holder.

If we deny a qualifying request, you may appeal by replying to our decision or emailing us with the subject “Privacy Appeal.” We will explain the appeal result as required by applicable law.

14. United States State Privacy Notice

This section supplements the rest of the Policy for residents of U.S. states with comprehensive privacy laws, including Delaware and California, when those laws apply to Hits Surf.

The categories of personal information we collect, sources, purposes, and recipients are described in Sections 2 through 8. Depending on applicable law, identifiers, internet or electronic-network activity, commercial information, approximate location derived from IP address, account credentials, and inferences may be treated as protected categories.

• Delaware residents: qualifying residents may request access, correction, deletion, portability, and opt out of targeted advertising, sale of personal data, or certain profiling. Qualifying users may also appeal a denied request.
• California residents: qualifying residents may request to know, correct, or delete personal information; obtain information about categories collected and disclosed; opt out of sale or sharing; limit certain uses of sensitive personal information where applicable; and receive nondiscriminatory treatment.

We do not knowingly use or disclose sensitive personal information for purposes that require a right to limit under California law. We do not currently sell personal information for money. If applicable practices change, we will update this Policy and provide legally required opt-out controls, including support for recognized universal opt-out signals where required.

15. EEA, UK, and Similar Jurisdictions

If you are in the European Economic Area, United Kingdom, or another jurisdiction with similar rights, you may have rights of access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You may also complain to your local data protection authority.

Automated security and anti-fraud tools may flag activity for review, restrict rewards, or temporarily limit access. Material account enforcement decisions should involve appropriate review rather than relying solely on an automated result where applicable law requires it.

16. Marketing and Service Communications

We may send transactional or service-related communications about account security, points, purchases, redemptions, websites, offers, support, or material policy changes. These messages are necessary to operate the Service and may not include an unsubscribe option.

If we send optional promotional emails, you may unsubscribe through the message or contact us. Opting out of marketing does not stop operational messages.

17. Children and Age Restrictions

The Service is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

18. Do Not Track and Universal Opt-Out Signals

Some browsers send a “Do Not Track” signal, but there is no single universally accepted response standard. Because essential fraud prevention and visit validation are core to the Service, certain operational tracking cannot be disabled while using affected features.

Where applicable law requires recognition of a universal opt-out mechanism—such as a qualifying browser-based signal for sale, sharing, or targeted advertising—we will process that signal for the browser or device as legally required.

19. Changes to This Policy

We may update this Policy to reflect changes in the Service, technology, providers, security practices, or law. We will post the revised version with a new effective date and provide additional notice when required. Continued use after an update is subject to the revised Policy, but we will request consent when the law requires it.

20. Contact Us

Questions, privacy requests, appeals, or complaints may be sent to:

Before publication, the site operator should replace or supplement these details with the legal business name and mailing address where required by applicable law.