Privacy Policy

SuperHQ is run by Plutio Ventures FZE LLC, Ajman, United Arab Emirates (licence 58425). For anything in this policy, email hello@superhq.app.

• Your account data. The people who sign up and work in a workspace: you and your team. For this data we are the controller, and this policy covers it.
• Your customers' data. What your business brings into its workspace about its own customers: records synced from your systems, conversations, emails, payments read from your Stripe, files they send you. For this data your business is the controller and we are your processor. We act only on your instructions, as set out in the Data Processing Addendum. If you are one of our customer's customers, the business you deal with decides how your data is used, so ask them first; we will help them answer you.

• Account: your name, email address, password (stored only as a hash by our auth provider) and the workspaces you belong to.
• Use: what you do in the app so it can work (drafts, approvals, settings), and sign-in records such as time, IP address and browser, which we use for security.
• Correspondence: what you send us when you email us.
• A captcha check by Cloudflare Turnstile on the sign-up, log-in and password forms, to keep bots out.

We don't use advertising trackers or third-party analytics in the app.

• To provide the service you signed up for (our contract with you).
• To keep it secure and stop fraud and abuse (our legitimate interest, and yours).
• To send you service email: sign-in links, password resets, invites and notices about your workspace.
• To meet legal obligations.

We don't sell personal data, and we don't share it for advertising.

Pal, the assistant inside SuperHQ, sends the text it needs to read or write to Anthropic's Claude models through Anthropic's commercial API. Anthropic's commercial terms state that it may not train models on customer content from its services, so what Pal reads is not used to train Anthropic's models. What Pal learns about how your team works is stored inside your workspace and is never used for another workspace.

We use a small set of providers to host and run SuperHQ: hosting, database, email, AI and security. Each is listed with what it does and where on the Subprocessors page. Our hosting and database are in London, United Kingdom; some providers, such as Anthropic, are in the United States. Where data leaves the UK, the EEA or the UAE, we rely on the provider's standard contractual clauses or an equivalent safeguard.

• Account and workspace data: for as long as the workspace is open.
• Recorded video and voice notes: 30 days after the last play, 90 days if never played, and a customer's own upload 30 days after its conversation closes, unless your team chooses to keep one. Your workspace can change these periods.
• When a workspace is closed and you ask us to delete it, we delete its data within 30 days. Copies in backups are gone once those backups expire, within the same 30 days.
• Records we must keep by law are kept only as long as the law requires.

Depending on where you are, laws such as the EU GDPR, the UK GDPR and the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) give you the right to:

• see the personal data we hold about you and get a copy;
• correct it;
• have it deleted;
• restrict or object to how we use it;
• take it with you in a usable format;
• complain to your data-protection authority.

Email hello@superhq.app and we will answer within 30 days. For deletion, write from the email on the account, or from the workspace owner's address for a whole workspace.

Data is encrypted in transit, and our database provider encrypts it at rest. Access to production is limited to the people who run the service. Every record belongs to one workspace and is logically separated from every other workspace's. If a breach affects your data, we will tell you without undue delay.

If we change this policy in a way that matters, we'll email workspace owners before it takes effect. The date at the top always shows the current version.