Privacy notice
This is the notice for SuperIntelligence specifically. It is written from the code, not from a template, and every row below can be checked against §08 of the guarantees page and the inventory in the repository (docs/legal/data-inventory.md). The Super family privacy policy covers the rest of the family; where the two differ about this service, this notice is the precise one.
Who
SuperFile Inc. ([form and state of incorporation — set SUPERINTEL_ENTITY_FORM]), [postal address — set SUPERINTEL_ENTITY_ADDRESS], is the controller for the account you hold here. Write to [email protected]. EU/UK representative under Art. 27: [EU/UK Art. 27 representative — set SUPERINTEL_EU_REP]. When a company or an app uses the relay on behalf of its own users, SuperFile Inc. is the processor and that company is the controller — see the data processing addendum.
What is never kept
Your question, the answer, the alias map that put your words back, and the key that protected them. The key is overwritten with zeros in the same code path that seals the answer; the aliased prompt is in one process's memory for the seconds an answer takes and is not written anywhere. There is no prompt log, no transcript and no cache. If you chose a frontier model, that provider received the aliased prompt under its own terms and the receipt names the provider.
What is kept, and for how long
| What | Why | How long | Your control |
|---|---|---|---|
| Your account row — SuperID subject, name, email, handle, first and last sign-in | So the service knows whose account it is, and so an administrator sees a name rather than an identifier | Until you delete your account | Export · delete on your page |
| Receipts — model, time, hashes of the aliased prompt, answer and alias map, signature. Never words | So you can prove, later, which model answered you | 365 days, then purged by a daily job | Erase one or all on your page; in the export |
| Your usage — one row per answer: time, model, app, token counts, cost | The meters and limits on your page, and the spending cap | 31 days, enforced by the same daily job | Shown on your page; deleted with the account |
| Site totals — per day, how many answers, tokens and how much they cost, per model | To know how busy the service is | 400 days. The list of who asked exists for the current day only and collapses to a count the day after | Aggregate. A Global Privacy Control signal keeps you out of the list entirely |
| Audit trail — sign-ins, erasures, consents, privacy requests, moderation decisions, settings and key changes, hash-chained; the address is ten hex of its hash, never the address | The integrity record: a removed or altered line breaks the chain | For the life of the service | Not erasable by design. An erasure leaves one line saying an erasure happened |
| Your AI files, your models, your preferences — ciphertext sealed on your device, plus the labels you gave them, the model you chose, and any provider stand-in key | So your files and models reach your devices | Until you erase them or delete your account | List, open, erase on your page; in the export |
| Consent records — which document, which version, when, and ten hex of the hash of the address | To prove what you agreed to and when, which is the only honest way to hold a consent | Until you delete your account | Listed on your page |
| Privacy requests — what you asked for, when, when it was due, when it was answered | The compliance record | Kept, with you replaced by a hash and the text blanked, after a deletion | Listed on your page |
| Sign-in session | To keep you signed in | 12 hours | Sign out |
| Marketplace orders — order and listing id, amount, paid, the Stripe session, and the buyer's subject | The accounting record of a payment, which the law requires us to keep | Kept after an account is deleted; the deleted person's name, email and handle are gone and their listings are delisted and blanked | Listed on your page |
| The demo lane on the live monitor | To let an anonymous visitor try it | 15 minutes, in memory. A pseudonym derived from the hash of your address; no receipts, no usage rows | Wait fifteen minutes |
Who else sees anything
| Who | What they get | Why |
|---|---|---|
| SuperID | the sign-in exchange and your subject; the request to mint a stand-in key when you connect your own provider account | Signing you in; the products grid |
| The model that answers — by default hardware SuperFile Inc. operates | the aliased prompt and the system instruction | Answering |
| OpenAI, Anthropic, IBM watsonx — only if a frontier model was chosen, which is off by default and needs a recorded yes | the aliased prompt, under that provider's published API terms. The receipt names which one | Answering. See the provider table |
| A customer's own on-prem relay | the aliased prompt, on their premises | Answering where answers may not leave the building |
| Stripe | the listing title and the amount. Your card details are entered on Stripe and are never seen here | Paying for a listing |
| Cloudflare, IBM Cloud | request metadata; hosting | Getting the bytes to you and running the relay |
Nothing is sold. Nothing is shared for cross-context behavioural advertising. There is no advertising, no analytics, no tag manager, no session replay and no third-party cookie anywhere in this service — see docs/legal/client-side-audit.md, which lists every request a page makes. New subprocessors are announced 30 days before they start.
What the service asks of you, and what it does not
It asks for a SuperID sign-in. It does not ask for your location, your contacts, your calendar, a photograph, a fingerprint or a face. It does not fingerprint your device and it does not track you across sites. If you sign in to SuperID with a passkey, your device's sensor never leaves your device: SuperID receives a public key and a signature, never a fingerprint or a face template, and SuperIntelligence receives neither.
AI, and what it is not allowed to decide
Every answer here is generated by a language model and is labelled as such where it appears. A model can be confidently wrong; check anything you would act on. No decision with a legal or similarly significant effect is made automatically: the relay's only automatic choice is which model answers you, which follows the pins an administrator or your company set and the model you chose. Nothing here scores you, profiles you or decides anything about you. See the AI section for what each provider does with the aliased prompt.
Your rights, and the control that answers each one
| Right | Where it is |
|---|---|
| Know and access | Export everything (JSON) on your page — it is the machine-readable copy too |
| Portability | The same export. One file, open format |
| Correct | Your name, email and handle are mirrored from SuperID each time you sign in. Correct them at superid.com and sign in again; nothing here originates them |
| Delete | Delete my account on your page, or DELETE /v1/me. What survives is listed above, and why |
| Opt out of sale, sharing, targeted advertising or profiling | There is none to opt out of. A Sec-GPC: 1 header is honoured anyway: it is recorded as a standing opt-out and keeps you out of the day's list of who asked. Our declaration is at /.well-known/gpc.json |
| Keep your words on our hardware | That is the default. A frontier model needs a recorded yes and can be withdrawn by choosing a local model again |
| Withdraw a consent | Every consent is listed on your page with the version and the date, and every one can be withdrawn there |
| Ask a human, and appeal | Your privacy requests on your page, or [email protected]. We answer within 45 days. If we refuse, you may appeal within 45 days and a second reviewer answers in writing |
| Complain | To your supervisory authority or state attorney general. We would rather you told us first |
We do not charge for any of this and we will not treat you differently for asking.
Where the data is
The relay runs on IBM Cloud, and the house model on hardware SuperFile Inc. operates or on IBM watsonx.ai in us-south. If you chose a frontier model, that provider processes the aliased prompt in its own regions. For transfers out of the EEA or the UK we rely on the Standard Contractual Clauses and the UK Addendum where they apply — [COUNSEL: confirm the transfer mechanism and complete a transfer impact assessment before selling into the EEA/UK.]
Children
SuperIntelligence is not directed to children. You must be 16 or older to hold an account, and you are asked to say so when you first sign in; that answer is recorded with its date. If we learn that an account belongs to someone younger we delete it and everything under it. Tell us at [email protected] — see docs/legal/children.md.
Security
What actually protects this is written down in full: the security section, docs/security/security-program.md, and the disclosure policy. If something here is wrong we would rather be corrected than trusted — [email protected].
Changes
This notice is versioned with the code; its version is at the top. A material change is announced by email to account holders and takes effect 30 days later. The old version stays in the repository's history.