How we handle data that belongs to your customers.

Not yet a signable instrument

This is an accurate description of how the platform processes data, drafted so that a lawyer can review rather than start from nothing. It has not been through that review, it is not legal advice, and it does not yet incorporate Standard Contractual Clauses. The contracting entity is also being finalised, and a DPA without a named processor is not executable. If you need a signed DPA to proceed, write to [email protected] and we will handle it directly and tell you honestly how long it will take.

For personal data inside the applications you build, you are the controller and Supero is the processor. You decide what is collected and why; we process it to provide the service.

For your own account data — the people on your team who log in — we are the controller. That is covered by the privacy policy.

We process customer data only to provide, secure and support the service, and only on your documented instructions — which include your configuration of the platform and your use of its APIs. If we believed an instruction broke the law, we would tell you rather than quietly comply.

We do not use customer data to train models, and we do not use it for our own analytics or marketing.

The platform and the applications it deploys run on infrastructure in the regions our providers operate. Where processing crosses a border, an appropriate transfer mechanism applies — the specific mechanism, including Standard Contractual Clauses where they are required, is part of the review noted above rather than something we will claim before it is in place.

If your data must stay in a particular region, raise it before you build. It is a solvable constraint and a bad surprise.

The measures we actually operate — tenant isolation enforced below the application, role-based access at object and field level, secrets sealed at rest under a key held outside the image, saga compensation, audit records — are described on the security page, together with what we do not do yet. That page names the gaps deliberately; a security annexe that lists only strengths tells a reviewer nothing.

Access to customer data is limited to people who need it to run or support the service, and everyone with access is under a confidentiality obligation.

If we become aware of a breach affecting your data we will notify you without undue delay, with what we know, what we are doing, and what we do not yet know. We will not wait for a complete picture before telling you there is one.

Report a suspected issue to [email protected].

If one of your users exercises a right — access, correction, export, erasure — the platform gives you the tools to act on it directly. Where you need our help, ask and we will help.

You can export your data at any time. On termination we delete customer data from the live system; backups age out on their own cycle rather than being selectively edited, and we will tell you that cycle rather than implying instant erasure everywhere.

We will provide the information reasonably needed to demonstrate compliance with this addendum. We do not hold a third-party audit report today — the security page says so plainly — and we would rather tell you that than point at a badge.