Last updated: February 16, 2026
This Privacy Policy describes how SuperAgentic (“we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use our AI-powered financial research service (“the Service”). We are committed to transparency about our data practices.
SuperAgentic is an experimental research project operated by an individual. We process data in accordance with applicable privacy laws including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and other applicable regulations.
| Data Type | Examples | Purpose |
|---|---|---|
| Account information | Name, email address, password (hashed) | Account creation and authentication |
| Profile information | Profile image (via Google OAuth) | Display in UI |
| Conversation content | Chat messages, queries, prompts | Providing the Service (AI analysis) |
| User-generated skills | Prompt templates, skill metadata | Enabling custom skill functionality |
| Saved prompts | Shortcut templates | User productivity features |
| Feedback | Message ratings (like/dislike), general feedback text | Service improvement |
| Waitlist submissions | Name, email, organization | Managing beta access |
| Data Type | Examples | Purpose |
|---|---|---|
| Usage data | Features used, tools invoked, credit consumption | Service operation and analytics |
| Device information | Browser type, operating system | Compatibility and debugging |
| Authentication data | Session tokens, login timestamps | Security |
| AI interaction metadata | LLM provider used, model ID, token counts | Cost management and quality assurance |
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide and operate the Service | Contract performance (Art. 6(1)(b)) |
| Process your queries via third-party AI providers | Contract performance (Art. 6(1)(b)) |
| Maintain your conversation history | Contract performance (Art. 6(1)(b)) |
| Evaluate AI output quality (automated, platform-absorbed) | Legitimate interest (Art. 6(1)(f)) |
| Generate conversation titles (automated) | Legitimate interest (Art. 6(1)(f)) |
| Manage your credit balance and usage | Contract performance (Art. 6(1)(b)) |
| Send service notifications and updates | Legitimate interest (Art. 6(1)(f)) |
| Improve the Service based on aggregated usage patterns | Legitimate interest (Art. 6(1)(f)) |
| Respond to your feedback and support requests | Contract performance (Art. 6(1)(b)) |
| Ensure security and prevent fraud | Legitimate interest (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do NOT:
When you send a message, your conversation is transmitted to one of our third-party AI providers (Anthropic, OpenAI, or Google — depending on your selected provider) for processing. The AI provider generates a response which is streamed back to you.
| Provider | Uses API Data for Training? | Data Retention |
|---|---|---|
| Anthropic (Claude) | No (API data never used for training) | 7 days (abuse monitoring) |
| OpenAI (GPT-4o) | No (API data not used by default) | 30 days (abuse monitoring) |
| Google (Gemini) | Varies by product; we use API tier | Per Google’s API terms |
We use API-tier access with all providers, which provides stronger data protections than consumer-tier access. None of our AI providers use API-submitted data for model training by default.
We use AI for the following platform-internal purposes at no cost to you:
These platform-absorbed AI calls process your conversation content but are not shared with any party beyond the AI provider.
We do not currently use your data to train or fine-tune AI models. If we introduce this capability in the future, we will:
We share your data only with the following categories of service providers, solely as necessary to operate the Service:
| Category | Providers | Data Shared |
|---|---|---|
| AI Processing | Anthropic, OpenAI, Google | Conversation content |
| Financial Data | Finnhub, Alpha Vantage, FMP, SEC EDGAR | Query parameters only (no PII) |
| Hosting | Vercel | Application data, IP addresses |
| Database | Neon (PostgreSQL) | All stored data (encrypted) |
| Authentication | Google (OAuth only) | OAuth tokens, profile data |
| Payments (future) | Stripe (when implemented) | Payment information |
We do not sell, rent, or trade your personal information. We may disclose information if required by law, legal process, or government request.
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Account data | Until account deletion + 30 days | Permanent deletion |
| Conversations | Until deleted by you or account deletion + 30 days | Soft-delete, then permanent |
| User-generated skills (private) | Until deleted by you or account deletion + 30 days | Permanent deletion |
| Community-shared skills | Survives account deletion (anonymized) | Anonymized to “deleted user” |
| Feedback | Until account deletion or no longer needed | Permanent deletion |
| Credit transaction logs | 7 years (financial record-keeping) | Automatic deletion |
| System logs | 90 days | Automatic rotation |
We implement reasonable technical and organizational measures to protect your data, including:
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
We do not sell or share (as defined by CCPA) your personal information. We do not use sensitive personal information for purposes beyond what is necessary to provide the Service.
To exercise any of these rights, contact us at privacy@superagentichat.com. We will respond within 30 days (or within legally required timeframes).
Your data may be processed in the United States and other countries where our service providers operate. For transfers of EU/EEA personal data, we rely on:
We use cookies and similar technologies as described in our Cookie Policy. Essential cookies (authentication, security) are used without consent as they are strictly necessary for the Service. Non-essential cookies (analytics) require your consent.
The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will delete it promptly.
In the event of a personal data breach that poses a risk to your rights, we will:
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. The “Last updated” date will always reflect the most recent revision.
For privacy-related questions, data subject requests, or complaints: