Privacy Policy

SupaSec ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the SupaSec platform ("Service").

SupaSec acts as the data controller for the personal data processed through the Service. This policy applies to all users regardless of location, with additional provisions for users in the European Union / European Economic Area (GDPR) and Brazil (LGPD).

We collect the following categories of data:

Account Information

• Name, email address, and phone number provided during registration
• Authentication credentials (managed via Supabase Auth)
• Subscription tier and billing information (processed by Stripe)

WhatsApp Messages & Media

• Text messages from groups and direct conversations accessible via your linked device
• Media files (images, audio, video, documents) shared in conversations
• Message metadata (timestamps, sender identifiers, group identifiers)

OAuth Connector Data

• Access and refresh tokens for Google and Microsoft services, stored encrypted
• Email messages (content and metadata) from Gmail and Outlook
• Calendar events from Google Calendar and Microsoft Calendar
• File metadata and file content from Google Drive and OneDrive
• Tasks from Google Tasks and Microsoft To Do
• Basic profile information (name and email address) of the connected account

Usage & Analytics Data

• Dashboard usage patterns and feature interactions, associated with your account when you are signed in
• Error logs and performance metrics
• IP address and approximate geolocation (country-level, for locale detection)

Cookies

• locale — First-party functional cookie storing your language preference (1 year)
• ip-country — First-party functional cookie storing your detected country code for locale and GDPR detection (30 days)
• ph_* — First-party analytics identifier set by PostHog to measure feature usage; events are associated with your account when you are signed in (1 year)

We process your data for the following purposes:

• Service delivery: Processing WhatsApp messages to provide AI-powered assistance, scheduling, and commitment tracking
• Memory building: Creating semantic episodes, entities, and relationships from your conversations to provide contextual assistance
• Skill execution: Executing skills such as meeting scheduling, image analysis, and commitment tracking on your behalf
• AI processing: Generating AI responses and suggestions using the context needed to answer your request, sent to language model providers (pattern-based redaction for retrieved WhatsApp context; Google user data is handled as described in "Google User Data")
• Communication: Sending account-related notifications, security alerts, and service updates
• Service improvement: Analyzing usage patterns to improve features and fix issues

This section explains how SupaSec accesses, uses, stores, and shares data received from Google APIs ("Google user data"). SupaSec accesses Google user data only after you connect your Google account, either from the dashboard or through a connection link the assistant sends you, and only for the Google services you authorize.

What We Access and Why

• Gmail (gmail.readonly, gmail.send, gmail.compose): We read your email messages so the assistant can search, summarize, and answer questions about your email. We send emails and create drafts only when you ask the assistant to
• Google Calendar (calendar): We read your events to answer questions about your schedule and prepare meeting briefings. We create and update events only when you ask the assistant to schedule a meeting
• Google Drive (drive.readonly): We read file metadata and the content of your files to answer questions about your documents. Access is read-only — we never modify or delete your Drive files
• Google Tasks (tasks): We create and update tasks for the commitments the assistant tracks for you
• Basic profile (openid, email, profile): We identify which Google account is connected

We do not create aggregated or anonymized datasets from Google user data for advertising, analytics, or any purpose other than providing the features above. Aggregated metrics that cannot identify you may be used only for internal operations and service reliability.

How We Use Google User Data

We use Google user data only to provide and improve user-facing features of SupaSec that are visible to you. This includes indexing and summarizing synced email, calendar, tasks and document content so that you can search it and ask questions about it later. We do not sell Google user data. We do not use it for advertising, including personalized, retargeted, or interest-based advertising, and we do not use it to determine credit-worthiness or for lending purposes.

AI Models

We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI and/or ML models. We do not use it to train models shared with other users, and we do not transfer Google user data to third-party AI/ML services that use that data to train their models. Google user data is sent to AI providers for two purposes: (a) to generate a response when you ask, and (b) during connector sync, to create embeddings and summaries that make your synced email, calendar, tasks and documents searchable in your memory. Both happen under terms that prohibit training on API data.

Human Access

No one at SupaSec reads your Google user data unless:

• You give us explicit consent to view specific messages, files, or other data (for example, when you contact us for support)
• It is necessary for security purposes, such as investigating abuse
• It is necessary to comply with applicable law
• The data has been aggregated and anonymized and is used for internal operations

Sharing and Transfers

We transfer Google user data only to the processors needed to provide the features described above, all listed in "Third-Party Data Processors":

• OpenRouter: AI response generation
• OpenAI: Embeddings for semantic search
• Nanonets DocStrange: Text extraction from documents and images
• Cloudflare: Compute
• Supabase: Encrypted storage

Google user data is never sold and is never transferred for any other purpose, except as necessary to comply with applicable law or as part of a merger, acquisition, or sale of assets, in which case we will notify you. We do not transfer Google user data to data brokers, advertisers, or any other party for advertising, lending, or model training.

Storage and Protection

• Google OAuth access and refresh tokens are encrypted with AES-256-GCM before they are stored
• Content synced from your Google services is encrypted at rest with your per-user encryption keys
• All Google user data is transmitted over TLS

Retention, Revocation, and Deletion

• You can disconnect Google at any time in Dashboard → Connectors. Disconnecting permanently deletes the Google access and refresh tokens we store and revokes SupaSec's access at Google, so SupaSec can no longer access your Google account
• You can also revoke SupaSec's access directly at Google at any time at https://myaccount.google.com/permissions
• To delete Google user data already synced into your SupaSec memory, delete your account or contact us at Click to reveal email. We delete it within 30 days of your request

Limited Use

SupaSec's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

SupaSec also complies with the Google Workspace API User Data and Developer Policy.

For users in the EU/EEA, we process your personal data under the following legal bases (Article 6 GDPR):

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you subscribed to, including message handling, memory building, and skill execution
• Legitimate interests (Art. 6(1)(f)): Service security, fraud prevention, usage analytics for service improvement, and enforcing our terms. We balance these interests against your rights and freedoms
• Consent (Art. 6(1)(a)): Where required, such as for optional features, marketing communications, or processing specific categories of data. You may withdraw consent at any time

For users in Brazil, we process your personal data under the following legal bases (Article 7 LGPD):

• Contract performance (Art. 7, V): Processing necessary to fulfill the service agreement
• Legitimate interest (Art. 7, IX): Service security, improvement, and analytics, conducted with respect to your fundamental rights
• Consent (Art. 7, I): For optional processing activities. Consent may be revoked at any time without affecting the lawfulness of processing based on consent before its withdrawal

When you link your WhatsApp account, SupaSec passively listens to all conversations accessible through the linked device. Here is how we handle your messages:

• Encryption at ingestion: Messages are encrypted with your personal AES-256-GCM key immediately upon receipt, before storage. Plaintext message content is never stored in the database
• Per-user isolation: Each user's data is processed in an isolated sandbox. Your encryption keys are unique to your account
• Limited redaction before AI processing: Before retrieved memory context is sent to external AI providers, we replace email addresses, phone numbers, URLs and payment-card numbers that match our detection patterns with placeholders. This is pattern-based redaction, not full anonymization: free-form names, company names and locations are not automatically removed. Your current message, recent conversation turns and tool results are sent as-is so the assistant can follow the conversation. Placeholders are restored only within your encrypted sandbox
• No human access: SupaSec staff do not have access to your decrypted message content. All processing is automated
• Group messages: Group messages are stored passively for context building only. SupaSec does not respond in groups unless explicitly invoked

We implement a zero-trust security architecture to protect your data:

• Per-user encryption keys: Each user has a unique master key derived via HKDF, with separate sub-keys for messages, episodes, entities, and OAuth tokens
• AES-256-GCM encryption: All sensitive content is encrypted with AES-256-GCM, an authenticated encryption algorithm that provides both confidentiality and integrity
• Scoped database roles: Different services access only the database tables they need. No single service has full database access
• Encrypted media storage: Media files are encrypted with your personal key before storage in Cloudflare R2
• Service-to-service authentication: Internal communications use HMAC-SHA256 signed tokens with short expiry
• Audit logging: Security-relevant events (auth failures, service access) are logged for monitoring

We use the following third-party processors to deliver the Service. All processors are bound by data processing agreements:

For WhatsApp, we apply pattern-based redaction to retrieved memory context before it is sent to AI providers; the current message, recent conversation turns and tool results are sent as-is. Google user data, such as email and document content, is not anonymized: it is sent to AI providers to answer your request and, during connector sync, to create embeddings and summaries for search. In both cases the data is processed only to provide these features, and our AI providers are bound by terms that prohibit using API data to train their models.

Your data may be transferred to and processed in countries outside your country of residence. When we transfer personal data from the EU/EEA or Brazil to third countries, we rely on:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms ensuring adequate data protection
• Adequacy decisions: Transfers to countries recognized by the European Commission as providing adequate data protection
• Supplementary measures: Technical safeguards including encryption at rest and in transit, pseudonymization, and access controls

Our primary database and structured records are hosted in Supabase's São Paulo (Brazil) region. Encrypted media files (images, audio and documents) are stored in Cloudflare R2, which may use a region near the user. Some processing (for example AI model inference and CDN caching) may also occur in other regions, as listed in "Third-Party Data Processors", protected by the safeguards described in "International Data Transfers".

• Active accounts: Your data is retained for as long as your account remains active and is necessary to provide the Service
• Post-cancellation: Upon account cancellation, your data is retained for 30 days to allow for account recovery. After 30 days, all personal data is permanently deleted
• Billing records: Payment and invoice records may be retained for the period required by applicable tax and accounting regulations
• Security audit logs: Retained for 90 days, then automatically purged

If you are located in the EU/EEA, you have the following rights under Articles 15–22 of the GDPR:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to restriction (Art. 18): Request that we limit the processing of your personal data
• Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right regarding automated decisions (Art. 22): Not be subject to decisions based solely on automated processing that produce legal effects
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent
• Right to lodge a complaint: File a complaint with your local supervisory authority

To exercise any of these rights, contact our Data Protection Officer (see Section 17).

If you are located in Brazil, you have the following rights under Articles 18–19 of the LGPD:

• Confirmation of processing (Art. 18, I): Confirm whether we process your personal data
• Access (Art. 18, II): Access your personal data held by us
• Correction (Art. 18, III): Request correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion (Art. 18, IV): Request anonymization, blocking, or deletion of unnecessary or excessive data
• Data portability (Art. 18, V): Request portability of your data to another service provider
• Information about sharing (Art. 18, VII): Know which public and private entities your data has been shared with
• Revocation of consent (Art. 18, IX): Revoke consent at any time
• Contact ANPD: File a complaint with the Autoridade Nacional de Proteção de Dados (ANPD)

To exercise any of these rights, contact our Encarregado de Dados (see Section 17).

SupaSec uses first-party functional cookies and first-party product analytics (PostHog) on our website and dashboard to understand feature usage. PostHog may store a first-party identifier in a cookie or local storage. When you sign in, we associate analytics events with your account ID and create an identified analytics profile so we can see which features are used. We do not use advertising cookies or cross-site tracking pixels, we do not sell analytics data, and we do not intentionally send Google user data to PostHog.

The functional cookies above are strictly necessary and do not require consent. Analytics events may be associated with your account as described above; we use them to improve the Service and never for advertising.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete such data promptly. If you believe a child has provided us with personal data, please contact us immediately.

Our Data Protection Officer (DPO) / Encarregado de Dados can be reached at:

• Email: Click to reveal email

We will respond to all data protection inquiries within 30 days of receipt. For GDPR requests, we will respond within 1 month as required by Article 12(3).

We may update this Privacy Policy from time to time. When we make material changes, we will provide at least 30 days' advance notice via email or a prominent notice on the dashboard before the changes take effect.

We encourage you to review this policy periodically. Your continued use of the Service after the updated policy becomes effective constitutes your acceptance of the changes.

If you have any questions about this Privacy Policy, please contact us:

• General inquiries: hello@supasec.bot
• Privacy inquiries: Click to reveal email
• Website: https://supasec.bot