Privacy Policy

This policy covers superhq.ai, SuperHQ accounts at app.superhq.ai, and every SuperHQ product and service. SuperHQ is run by Harsh Singh in Lucknow, Uttar Pradesh, India, who is responsible for the personal data described here.

What we collect

• Account data. When you sign in with GitHub: your GitHub id, name, email address and avatar. The organisations you belong to and your role in each.
• Payment data. Dodo Payments tells us about each purchase: the order id, amount, currency, date, country, status and email address. We never see your card or bank details.
• Service data. Hashes of your API tokens (never the tokens themselves), names and settings of what you create, usage meters such as CPU time, memory and storage, and request logs with IP addresses, routes, status codes and times.
• Abuse signals. Resource and network metadata from hosted services, such as CPU and memory patterns, connection counts, destinations and traffic volumes. Not the contents of your files or traffic.
• Your content. The code, files and data you put into hosted services, and the credentials you store there, which are encrypted at rest.
• Messages. What you send to support@superhq.ai, including abuse reports.

The website and our tools

superhq.ai has no forms, analytics or advertising and sets no cookies; its fonts are served from superhq.ai. The account site and our consoles use cookies only to keep you signed in and secure. Our open source tools run on your machine and send no telemetry or usage data to us. Downloads from GitHub, Homebrew or Hugging Face are seen by those services under their own policies, and models you download run where you run them, so we never see their inputs or outputs.

How we use it

To provide the Services, sign you in, bill you, enforce limits, prevent and investigate abuse, keep the Services secure and reliable, answer you, and meet legal obligations. We do not sell personal data, use it for advertising, or use your content to train models.

Your content

We process your content only to run the Services. We do not look at it except to investigate abuse or a security incident, to meet a legal obligation, or when you ask for support and give permission, and then only as much as that needs. Automated abuse detection uses metadata, not contents.

Who we share it with

• GitHub, for sign in.
• Cloudflare, which hosts our websites, APIs and databases and carries traffic to hosted services.
• Amazon Web Services, whose servers and storage run hosted sandboxes and hold their snapshots.
• Dodo Payments, merchant of record for purchases, which handles payment data as an independent controller under its own privacy policy.
• Providers you connect, such as model providers your sandboxes call; they receive those requests under their own policies.
• Authorities and others, where the law requires it or to protect people from harm, including reports of child sexual abuse material.
• A buyer or successor, if SuperHQ is reorganised, merged or sold, under this policy.

These providers process data in India, the United States and other countries where they operate. We transfer data out of India in line with Indian law, and from the EU and UK under the safeguards those laws require.

How long we keep it

• Account data: while the account is open, and deleted within 30 days after it closes.
• Your content: until you delete it, and within 30 days after the account closes.
• Request logs: 30 days. Abuse signals: 90 days.
• Records of abuse and enforcement: as long as needed to stop repeat abuse, up to 3 years after closing.
• Payment and usage records: as long as tax and accounting law requires, up to 8 years.
• Messages to support: up to 3 years after the last contact.

We may keep data longer where the law requires it or to deal with a legal claim.

Security

Data is encrypted in transit, API tokens are stored only as hashes, stored credentials are encrypted at rest, and hosted sandboxes run in separate virtual machines. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Your rights

You can ask to access, correct or delete personal data we hold about you, get a copy of it, object to how we use it, or withdraw consent you gave, by writing to support@superhq.ai. We answer within 30 days. This includes your rights under the Digital Personal Data Protection Act, 2023 in India, the GDPR in the EU and UK, and California law. We do not sell or share personal data for advertising. If you are not satisfied with our answer, you may complain to the data protection authority where you live.

Grievance contact: Harsh Singh, support@superhq.ai.

Children

The Services are not for anyone under 18, and we do not knowingly collect their personal data.

Changes

We will update this policy here and change the date above when we change what we collect or how we use it, and tell account holders by email or in the product before a material change takes effect.