Privacy Policy

Effective date: October 18, 2026 · Contact: [email protected]

This Privacy Policy describes how Suprsuit (“Suprsuit,” “we,” “us”) collects, uses, stores, and shares information when you use the Suprsuit AI work environment and related services (the “Service”). It includes additional disclosures required when you connect Google accounts such as Gmail.

1. Who we are

Suprsuit provides a dedicated AI work environment for owner-operated small businesses. Each business customer receives a dedicated Suprsuit node (a hosted server) where agents run, browser sessions execute, and most customer data is processed and stored.

2. Information we collect

2.1 Account and contact information

We collect information you provide when onboarding, such as your name, business name, email address, and Telegram account identifier used for approvals and notifications.

2.2 Google user data (Gmail)

If you connect Gmail, we access Google user data only after you complete Google’s OAuth consent screen for the scopes you approve. Reading and sending are separate authorizations, and Suprsuit may request:

• https://www.googleapis.com/auth/gmail.readonly — to read messages needed to learn your writing style and business context from mail you have sent, and to look up messages for tasks and inbox features you enable. This scope does not allow sending, labeling, or deleting mail.
• https://www.googleapis.com/auth/gmail.send — to send email only after you explicitly approve a specific message in Suprsuit. This scope does not allow reading your mail. It is requested separately, the first time an email needs to be sent.
• openid and email — to identify which Google account you connected.

Drafts are prepared and held inside Suprsuit for your review; we do not create or modify drafts in your Gmail Drafts folder. We do not request the broad https://mail.google.com/ scope or gmail.compose. If we later add features that need additional scopes (for example, organizing mail), we will ask for them separately and update this policy first.

2.3 Other service data

When you connect other tools (for example, business software or bank portals), we process data from those services only to perform tasks you request, subject to the same approval and security model described in our product documentation.

2.4 Technical and security logs

We maintain append-only audit logs on your node (for example, approval decisions, agent actions, and security events). These logs are used for security, troubleshooting, and compliance—not for advertising.

3. How we use information

We use information to:

• Run agents and complete tasks you request or approve;
• Learn business context and writing style from Gmail (when connected) to draft messages that sound like you;
• Send notifications and approval prompts to your Telegram account;
• Protect the Service, investigate abuse, and comply with law;
• Improve the Service for your organization (on your node), not to build generalized profiles across unrelated customers.

4. Google API Services User Data Policy & Limited Use

Suprsuit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, for Google user data obtained through Gmail scopes:

• We use Google user data only to provide or improve user-facing features that are prominent in Suprsuit’s interface—such as drafting email in your voice for your review, answering questions about your business context you have confirmed, and sending mail you approve.
• We do not use Google user data for advertising, retargeting, interest-based advertising, or sale to data brokers.
• We do not use Google user data to train generalized machine learning or artificial intelligence models. We may send excerpts to model providers (currently Anthropic) only to deliver a visible feature you requested (for example, summarizing sent mail into a voice profile or drafting a reply). Our agreements with model providers prohibit using your content to train their generalized models.
• We do not allow humans to read Google user data except: (a) with your explicit consent for a specific message or export; (b) when necessary for security (for example, investigating suspected abuse); (c) when necessary to comply with applicable law; or (d) when aggregated and anonymized for internal operations.
• We do not transfer Google user data to third parties except as needed to provide or improve the user-facing features above (with your consent), for security, to comply with law, or as part of a merger or acquisition with your explicit prior consent.

5. How we store and retain data

• Processing location. Primary processing and storage for your business occur on your dedicated Suprsuit node.
• Raw email. When Suprsuit reads Gmail for learning or task execution, raw message bodies are processed to extract structured facts and writing-style signals you can review. We do not retain full raw mailbox contents as a long-term archive; extracted artifacts live in your business memory on the node subject to your review and deletion controls.
• OAuth tokens. Gmail refresh tokens are stored encrypted on your node with restricted file permissions. They are excluded from routine backups where configured so a rebuild requires you to reconnect.
• Audit logs. Security and approval logs may be retained for a longer period for integrity and compliance.

6. Sharing

We do not sell your personal information. We share information only:

• With infrastructure providers that host your node ;
• With model providers strictly to perform features you use, as described in Section 4;
• When required by law or to protect rights and safety;
• With your consent.

7. Your choices

• Disconnect Gmail. You can disconnect Gmail from Suprsuit by contacting us or, where available, in the product. We revoke tokens with Google and delete grant files on your node.
• Delete learned context. You can review, edit, or delete proposed business facts and voice profiles before agents use them, and request deletion of stored context on your node.
• Revoke Google access. You may revoke Suprsuit’s access at any time in your Google Account permissions page.

8. Security

We use technical and organizational measures appropriate to a hosted agent environment, including encrypted credential storage, network isolation between services on the node, approval gates for outbound actions, and append-only auditing. No method of transmission or storage is 100% secure.

9. Children

The Service is not directed to children under 13 (or the age required in your jurisdiction). We do not knowingly collect their data.

10. Changes

We may update this policy. We will post the revised policy on this page and update the effective date. If we change how we use Google user data, we will notify you and obtain your consent where required before new uses.

11. Contact

Privacy questions, deletion requests, or Google data inquiries: [email protected]