Privacy policy

Effective Date: November 25, 2025

Last Updated: September 30, 2026

1. Introduction

Welcome to Supercomms (“we,” “our,” or “us”). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, store, and protect your information when you use our email intelligence platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Your email address

  • Your name (as provided by Google OAuth)

  • Profile picture (as provided by Google OAuth)

2.2 Email Data

With your explicit permission through Google OAuth, we access and process:

  • Email metadata (subject, sender, recipients, timestamps, labels, thread information)

  • Email previews (short snippets for classification and display)

  • Gmail labels and categories

If you grant email sending and modification permissions, we may also:

  • Send emails on your behalf through your Gmail account

  • Modify email labels (e.g., mark emails as read, add or remove labels)

Important: We store the full content of your emails, including message bodies (plain text and HTML), encrypted at rest, so Supercomms can classify, search, summarize, and draft replies for you. We do not store the file contents of attachments — only attachment metadata and the reference needed to fetch a file from Gmail on demand. Stored data is retained until you delete it or close your account.

2.3 Calendar Data

If you grant calendar permissions, we may access and manage:

  • Calendar events and availability

  • Event details (title, description, attendees, time, location)

  • Create, update, and delete calendar events

3. How We Use Your Information

We use the collected information to:

  • Provide Core Services: Sync, classify, and organize your emails using AI. Email content — including full message bodies — is processed for classification and stored encrypted at rest.

  • Email Intelligence: Analyze email metadata and previews to provide insights, classifications, and smart actions

  • Draft Assistance: Generate suggested email replies and responses by accessing email content on-demand via Gmail API

  • Email Actions: Send emails on your behalf and mark emails as read when you use these features

  • Calendar Integration: View, create, update, and delete calendar events. Suggest meeting times and manage scheduling

  • Service Improvement: Analyze usage patterns to enhance features and user experience

  • Security: Detect and prevent fraud, abuse, and security incidents

  • Communication: Send service-related notifications and updates

4. Google API Services User Data Policy

Supercomms’ use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only request access to the specific Google user data we need to provide our services

  • We do not use, transfer, or sell Google Workspace API user data (including raw data, aggregated data, anonymized data, or derived data) to create, train, or improve foundational machine learning or artificial intelligence models. We only use Google Workspace API data to provide personalized AI features for your specific use case, such as email classification and draft generation tailored to your communication patterns.

  • We do not use Google user data for serving advertisements

  • We do not allow humans to read your email unless:

    • You have given explicit consent for a specific message

    • It’s necessary for security purposes (e.g., investigating abuse)

    • Required by law

  • We do not transfer Google user data to third parties except:

    • As necessary to provide or improve our services

    • To comply with applicable laws

    • As part of a merger, acquisition, or sale of assets (with notice to users)

4.1 How Supercomms uses Google user data

Supercomms connects to your Google Account to provide its email-assistant (“Chief of Staff”) features. We request only the access needed for the features you use:

  • Read Gmail (gmail.readonly) — to organize, prioritize, and summarize your inbox.

  • Manage Gmail (gmail.modify) — to mark messages as read and manage drafts on your behalf.

  • Send Gmail (gmail.send) — to send the replies you review and approve.

  • Google Calendar (calendar, calendar.readonly) — to check availability and create events you request.

  • Google Drive (drive.file) — to open only the files you pick, or that Supercomms creates for you, and use their contents to inform a draft when you ask.

Limited Use. Supercomms’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial intelligence and machine learning. To power features such as prioritization, summaries, and draft generation, Supercomms sends the relevant content to trusted third-party AI providers acting as our service providers (e.g., OpenAI, Google, Groq, and AssemblyAI). These providers process the content only to return results for your request and do not use it to train their models. We do not retain or use Google Workspace data (including Gmail, Calendar, and Drive content) to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. Any AI/ML processing is limited to providing the user-facing features described above for you, the individual user.

Storage and security. Authentication tokens and the Google content we store are encrypted at rest. We store only what is needed to provide the features above; Google Drive file contents are used in-session and are not retained.

Retention and deletion. You can delete your account and data at any time from Settings. This removes the Google data we store and revokes Supercomms’ access to your Google Account.

No sale, no advertising, no unauthorized access. We do not sell your data or use it for advertising. We do not allow humans to read your Google user data except (a) with your consent, (b) as necessary for security or to comply with the law, or (c) where the data has been aggregated and anonymized for internal operations.

5. Third-Party Services

We use the following service providers (“sub-processors”) to run Supercomms. Each processes data only on our instructions and only to provide the service described.

Hosting and storage

  • Fly.io (United States): runs the Supercomms application and background processing. Your data passes through these servers while we provide the service.

  • Supabase (database hosted on AWS in Ireland, EU): stores your account data, synced email and calendar data, and the AI-generated results derived from them. Data is encrypted at rest, and the content of your emails and your connection tokens are additionally encrypted by Supercomms before storage.

Google services

  • Google Workspace APIs (Gmail, Google Calendar and Google Drive): with your permission, we read and manage your email, read and update your calendar, and open only the Drive files you choose. How we handle this data is governed by our commitments in “Google API Services User Data Policy” above.

AI providers

These receive only the content needed for the feature you are using, return the result, and do not use your data to train their models:

  • OpenAI (United States): email classification and prioritization, summaries, your daily brief, draft replies, and Chief of Staff chat.

  • Google Gemini (Google Cloud): AI features, including as a fallback when another provider is unavailable.

  • Groq (United States): writing suggestions (autocomplete) while you compose an email.

  • AssemblyAI (United States): turns your voice into text when you dictate. Audio is streamed only while you are dictating and is not kept by Supercomms.

Product analytics

  • PostHog (EU, Frankfurt): records how the app is used, such as page views, feature usage and error reports, and session recordings that help us fix usability problems. Session recordings mask all on-screen text and everything you type, so they never contain the content of your emails, calendar or files. Analytics events are linked to an internal account ID, not your name or email address.

We share only the minimum data each provider needs, under agreements that require them to protect it. We do not sell your data, and we do not share Google user data for advertising.

6. Data Storage and Security

  • Encryption in Transit: All data is encrypted in transit using TLS/SSL

  • Database Encryption: Data is encrypted at rest by our database provider (Supabase)

  • Access Controls: Strict access controls and authentication limit who can access user data

  • Application-Level Encryption: Sensitive data is encrypted using AES-256-GCM before storage:

    • OAuth access and refresh tokens

    • Email content (sender, recipients, subject, preview, and full message body)

    • AI-generated email summaries and classifications

    This provides an additional security layer beyond database encryption, ensuring data remains unreadable even with direct database access

  • Data Retention: We retain your data only as long as necessary to provide services or as required by law

  • Security Reviews: We regularly review our security practices and infrastructure

7. Your Rights and Choices

You have the right to:

  • Access: Request a copy of your personal data

  • Correction: Update or correct inaccurate information

  • Deletion: Request deletion of your account and associated data

  • Revoke Access: Disconnect your Google account at any time through your Google Account settings or our app

  • Export: Export your data in a machine-readable format

  • Object: Object to certain types of processing

To exercise these rights, please contact us at info@supercomms.io  or use the account settings in the application.

8. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in these limited circumstances:

  • With Your Consent: When you explicitly authorize us to share specific information

  • Service Providers: With trusted third-party providers who assist in operating our platform (under strict confidentiality agreements)

  • Legal Requirements: When required by law, court order, or governmental request

  • Business Transfers: In connection with a merger, acquisition, or sale of assets (users will be notified)

  • Security: To protect our rights, property, safety, or that of our users

9. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable data protection laws.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy on this page

  • Updating the “Last Updated” date

  • Sending an email notification for significant changes

Your continued use of Supercomms after changes become effective constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

  • Email: info@supercomms.io

  • Support: info@supercomms.io

12. Additional Information for EU/EEA Users

If you are located in the European Union or European Economic Area, you have additional rights under GDPR:

  • Right to data portability

  • Right to restrict processing

  • Right to object to automated decision-making

  • Right to lodge a complaint with a supervisory authority

The legal basis for processing your data includes: consent, contractual necessity, legal obligations, and legitimate interests.