Privacy Policy

Effective June 14, 2026 · Last updated June 14, 2026

This Privacy Policy describes how DeepSuper ("DeepSuper", "we", "us") collects, uses, and shares information when you use our AI-agent workspace platform at https://app.deepsuper.com (the "Service").

Plain-English summary. DeepSuper is a multi-tenant SaaS where workspace members run AI agents that act on their explicit instructions. We collect what we need to run your workspace (account info, the tasks you create, the data your agents work with). We store third-party credentials you connect (Google, Stripe, etc.) encrypted in our database; we never sell them or use them for advertising. You can revoke access from inside the app at any time. We are not a free consumer product trading personal data for ads.

1. Information We Collect

1.1 Information you provide to us directly

Account information — name, email address, password hash, workspace name, and workspace role when you sign up or are invited.
Task and content data — the tasks you create, messages you send to agents, files you upload, and instructions you write. This content is your data; we process it only to run your workspace.
Connection credentials — when you connect a third-party service (Google Workspace, GitHub, Stripe, Slack, etc.), we receive and store the OAuth tokens or API keys you authorize. These are encrypted at rest with per-workspace KMS-managed keys.
Support correspondence — when you email us, we keep the message and our reply so we can follow up.

1.2 Information we collect automatically

Usage and diagnostic data — task counts, agent runtimes, API request metadata, error logs. Used to operate, debug, and improve the Service.
Device and connection data — IP address, user-agent, timestamps. Used for security (audit log, rate limiting, abuse prevention).
Cookies and similar technologies — strictly-necessary session cookies for authentication. We do NOT use advertising trackers or third-party analytics that profile you across sites.

1.3 Information from third parties (only when you connect them)

When you connect a third-party service, we receive the data you authorize that service to share. For example: when you connect Google Workspace using OAuth, we receive your Google email, name, and access tokens scoped to the specific Google APIs you grant (e.g. Sheets, Calendar, Drive files YOU pick). We never access more than the scopes you grant.

2. How We Use Information

To operate the Service: run agents, dispatch tasks, deliver notifications, surface data through the UI.
To secure the Service: authenticate users, detect abuse, write the audit log, respond to security incidents.
To improve the Service: debug failures, analyze aggregate usage patterns, ship features. We do NOT use your task content to train external machine-learning models.
To communicate with you: send product updates, billing notices, security alerts, and replies to support requests.
To comply with legal obligations: respond to lawful requests, enforce our Terms.

3. How We Share Information

We do NOT sell your personal information. We share data only as follows:

Service providers we use to run the Service. Cloud hosting (Amazon Web Services), email delivery (Amazon SES), error monitoring, and similar infrastructure providers under written data-processing agreements that restrict their use of your data to providing services to us.
Third-party services YOU connect. When you instruct an agent to send a message to Slack, post to Twitter, write to a Google Sheet, etc., we send the relevant data to that service on your behalf using the credentials you authorized. We do not share data with third parties you have not connected.
Inside your workspace. Other members of your workspace can see workspace-scoped data per their assigned role. We do not share data across workspaces.
Business transfers. If DeepSuper is acquired or merges with another company, your information may transfer; the successor will be bound by this Policy (or a successor policy at least as protective) for as long as your data is held.
Legal requirements. We may disclose information when legally required (subpoena, court order) or to protect the rights, safety, and property of DeepSuper, our users, or others. Where lawful, we will notify you first.

4. Data Retention

Account and workspace data is retained for the life of your account.
Task content, messages, files are retained until you or a workspace admin deletes them, or 30 days after the workspace is deleted (whichever comes first).
Audit log entries are retained for 12 months for security investigation purposes.
Backups are retained for up to 35 days as part of operational resilience.

5. Security

We protect your information with a layered defense:

Encryption in transit. All Service traffic uses TLS 1.2 or newer.
Encryption at rest. Database storage is encrypted; third-party credentials in our Connections vault are encrypted with per-workspace KMS-managed keys.
Access control. Workspace data is isolated by tenant; staff access requires multi-factor authentication and is audit-logged.
Audit log. Privileged operations on your account and credentials are recorded.

No system is 100% secure. If a security incident affects your data, we will notify you without undue delay as required by applicable law.

6. Your Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate information.
Delete your information (subject to legal hold).
Export your information in a portable format.
Object to or restrict certain processing.
Withdraw consent for processing based on consent.
Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at info@deepsuper.com. We will respond within the timeframes required by applicable law (typically 30 days).

7. Children

The Service is not directed to children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

8. International Transfers

DeepSuper processes data on infrastructure located in the United States. If you access the Service from outside the US, your information may be transferred to, stored in, and processed in the US under appropriate safeguards (Standard Contractual Clauses where applicable).

9. Google API Services User Data Policy

DeepSuper's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only request the OAuth scopes required for features you actively use.
We do not transfer or use the information received from Google APIs for advertising or to train external generalized machine-learning models.
We do not sell information received from Google APIs.
We only allow humans to read your data when (a) you give us explicit consent to view specific data, (b) it is necessary for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) to operate the Service in aggregate, anonymized form.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be announced inside the Service or via email to workspace administrators at least 7 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions about this Policy or our handling of your data? Email info@deepsuper.com. Postal mail: DeepSuper, PO Box 667561, Houston, TX 77266.