Privacy Policy

1. Information We Collect

Account and identity information. When you sign in through our identity provider, we receive identifiers such as your email, a subject identifier, and your workspace/tenant assignment.

Your Content. The documents, conversations, notes, and materials you capture. We store these to provide the Service and generate technical artifacts (chunks, embeddings) so features like search and answering work. We do not sell Your Content and do not use it to train third-party foundation models.

Usage and metering data. Records of actions (captures, edits, retrievals, model calls) for operating, securing, billing, and improving the Service. Our internal event ledger records counts and content hashes — not the substance of Your Content.

Technical data. IP address, device/browser information, timestamps, correlation identifiers, and log data, used for security, debugging, and abuse prevention.

Legal-acceptance records. When you accept our legal terms, we record the version, your identifier, a timestamp, and IP address as proof of agreement.

2. How We Use Information

To provide, secure, maintain, and improve the Service; to authenticate you and enforce tenant isolation; to operate features you invoke; to meter and bill usage; to prevent fraud and abuse; to comply with legal obligations; and to communicate with you about the Service. We process personal information under legal bases including performance of our contract with you, our legitimate interests in operating and securing the Service, your consent where required, and compliance with law.

3. AI Processing and Third-Party Model Providers

When you use AI features or connect third-party assistants, relevant content may be transmitted to model providers you direct us to use (for example, via a configured gateway or a connector you enable). Those providers process that content under their own terms and privacy policies. You control which providers are configured for your workspace. Where you connect external assistants (such as Claude or ChatGPT), the connection operates in your own authenticated session or under a key you mint; we do not receive your third-party account credentials.

4. How We Share Information

We share personal information only: with service providers/subprocessors who host and support the Service under confidentiality obligations; with third-party providers you direct us to use; to comply with law or valid legal process; to protect rights, safety, and the integrity of the Service; and in connection with a merger, acquisition, financing, or sale of assets (subject to this Policy). We do not sell your personal information.

5. Security

We use technical and organizational safeguards including tenant-level row isolation, encryption of sensitive secrets at rest, credential hashing, scoped and revocable keys, transport encryption, and access controls. No system is perfectly secure; we cannot guarantee absolute security.

6. Data Retention

We retain Your Content while your account is active and as needed to provide the Service. You may delete content at any time; deletion removes it from active systems, with residual copies purged on routine backup cycles. We retain certain records (such as metering and legal-acceptance logs) as needed for legitimate business, security, and legal purposes.

7. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, port, or restrict processing of your personal information, and to object or withdraw consent. You can exercise many of these directly in the Service (viewing, editing, exporting, and deleting content) or by contacting privacy@supamynd.com. We will respond consistent with applicable law and may need to verify your identity. If you are in the EEA/UK, our legal bases are described in Section 2; if you are a California resident, we do not sell or share personal information as defined by the CCPA/CPRA and honor applicable rights.

8. International Transfers

We may process and store information in countries other than yours. Where required, we use appropriate safeguards for cross-border transfers.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their information.

10. Changes and Contact

We may update this Policy; material changes will be reflected in the effective date and, for signed-in users, surfaced for acknowledgment. Contact us at privacy@supamynd.com.