Privacy Policy

Information we collect

We collect account information you provide (name, email, organization), workspace and organization settings, agent instructions, messages, files, tool outputs, logs, and usage metadata needed to run Superclerk. When you connect third-party services such as Instagram, Google, Slack, HubSpot, Telegram, or LinkedIn, we collect the authorization tokens and the service data needed to perform the actions you request.

Instagram, Facebook, and Meta data

When you connect an Instagram Business or Creator account through Superclerk, we use Meta's Instagram Graph API and receive the following on your behalf: your Instagram account identifier, username, profile picture, account type, and aggregate account metadata; comments on media you own and replies you author; direct message threads your account participates in and the text of those messages; webhook events delivered by Meta when comments or messages are posted to your account. We use this access solely to provide the connected features you choose, such as drafting and publishing posts, replying to comments and DMs, or surfacing inbox activity for your review. We do not download or persistently store media files served from Instagram's CDN; we render media in our UI using Instagram's CDN URLs and remove cached references when the source becomes unavailable.

When you connect Meta Lead Forms, we receive the Facebook Page and Instant Form identifiers you select and retrieve leads submitted to that form. Lead data can include names, email addresses, phone numbers, custom form answers, consent-checkbox responses, lead creation time, and related ad, ad set, or campaign identifiers. We use it only to run the agents or workflows you configure. Page access tokens are used in memory for Meta API calls and are not stored in trigger configuration or lead records.

TikTok data and publishing

When you connect TikTok, we store encrypted authorization tokens and receive your account identifier, display name, profile image, and current creator publishing settings. We use this information to show the account you selected and the publishing choices TikTok allows. We store media you upload, captions, your publishing choices, scheduled posts, and publication status so you can review and manage your content. TikTok receives the media and metadata you approve when you publish or schedule a post. Disconnecting TikTok stops new access, revokes the connected tokens at TikTok, and erases the tokens from the connection after successful revocation. Drafts, uploaded media, and publication history remain until you delete them or request deletion.

Shopify store data

The Shopify app connects your product catalog to Superclerk. We receive store identifiers and domains, currency and plan information, products, variants, inventory information, location identifiers and names, and the product and inventory events you select. We use the store owner's Shopify identity and verified email to authenticate installation and link the workspace you approve. Authorization tokens are stored encrypted. Shopify receives product and variant changes you request through Superclerk.

The Shopify app does not request access to customers, orders, draft orders, or fulfillments. Do not include customer personal information in catalog instructions or uploaded files. Catalog data and the instructions you provide may be processed by the service providers listed below to perform your requested AI tasks and workflows. We do not sell Shopify data or use it to train foundation models.

Uninstalling the Shopify app stops access and removes its authorization tokens. Shopify privacy requests are authenticated and their request details are stored encrypted while we handle them. You can also request access, export, or deletion through privacy@superclerk.com. We fulfill authenticated privacy requests within 30 days; Shopify store-data deletion requests apply even if you keep using Superclerk for other services. Completing a request removes its stored request details. We do not delete unrelated workspace data merely because one store is disconnected.

Google user data

When you connect a Google service, Superclerk receives OAuth tokens and the Google data covered by the permissions you approve. Depending on the services you connect, this can include your Google account identifier and email; Gmail messages, threads, labels, and attachments; Calendar data; Drive file and folder metadata; content from Drive, Docs, and Sheets; and account, campaign, property, profile, and performance data from Google Ads, Analytics, Search Console, and Business Profile.

We use Google user data only to provide the Superclerk features you request, such as finding and summarizing files, drafting or sending email, managing calendar events and documents, running configured workflows, and reporting marketing performance. We do not sell Google user data, use it for advertising, credit, or lending, or use it to train or fine-tune foundation models.

We store encrypted Google OAuth tokens while your service is connected and may store relevant content and results in agent run history, configured workflows, and audit logs so you can inspect the work you requested. We share Google user data only with contracted service providers, including AI model providers, when necessary to provide those features, or when required for security or by law. Our personnel do not access Google user data unless you affirmatively request support, access is necessary for security or legal compliance, or the data is aggregated and de-identified for internal operations.

Superclerk's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Advertising measurement

When you reach superclerk.com or app.superclerk.com from an ad, our Cloudflare servers read the ad's click identifier from the page address (Google's gclid, gbraid or wbraid, Meta's fbclid, TikTok's ttclid, LinkedIn's li_fat_id, or Microsoft's msclkid), the campaign tags (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the page you landed on, the website that sent you, and the country Cloudflare estimates from your connection. We keep this in a first-party cookie on your browser and record nothing on our servers unless you create an account or ask for a demo or setup call (see Our quizzes, free audit and demo calls below). We drop campaign tags that look like email addresses.

In the European Economic Area, the United Kingdom, Switzerland and Quebec, and whenever we cannot tell where you are, we only do this after you allow it on Your Privacy Choices. Elsewhere it is on unless you opt out there. We treat a Global Privacy Control signal from your browser as an opt-out everywhere, and using Superclerk signed in from a browser that sends it also turns sharing off for your account. Opting out deletes the cookie and stops us from recording anything from that browser.

When you create an account, we save that information to your workspace together with the IP address and browser user agent of your sign-up, and delete the cookie. We do not save it if you opted out or your browser sent Global Privacy Control, if you joined through an invitation from a team or an agency, or if you signed up through the Shopify app.

When we turn reporting on, we tell an ad network about your workspace only when you arrived from that network's ad, so it can measure which of its ads worked:

• Meta receives that you signed up, that you started checkout (and the plan's price) and that your workspace first paid (and how much), with its own click identifier (fbclid), the IP address and browser user agent of your sign-up, the page where it happened, and hashed (SHA-256) forms of your verified email address and of your Superclerk user ID.
• Google receives only that your workspace first paid, when, and how much, with its own click identifier (gclid), in a file we upload to Google Ads ourselves. It does not include your email address.

For the European Economic Area, the United Kingdom, Switzerland and Quebec we tell Google you agreed to ad measurement, as you did on Your Privacy Choices, and that you did not agree to ad personalization. Under California and other US state privacy laws this reporting and the Meta pixel can count as "sharing" personal information for cross-context behavioral advertising. We do not report anything for a browser that opted out or sent Global Privacy Control, or for an account whose owner turned sharing off in Settings, including an event that happened but was not yet sent.

Cookies

__Secure-sc_attr holds the advertising measurement information described above until you create an account. It is set by our own servers for superclerk.com and its subdomains, cannot be read by page scripts, and expires 90 days after it was last updated. Signing up or opting out deletes it.

__Secure-sc_visitor holds a random ID that connects your visits to our pages, your sign-up, your setup and your first payment in PostHog, our product analytics. When you request a demo or book a call, our servers also send Meta a hashed (SHA-256) form of it, as described below. It is set by our own servers for superclerk.com and its subdomains, cannot be read by page scripts, and expires 90 days after your last visit. In the European Economic Area, the United Kingdom, Switzerland and Quebec it is set only after you allow measurement on Your Privacy Choices. Opting out or sending Global Privacy Control deletes it.

sc_privacy remembers the choice you make on Your Privacy Choices for 400 days. Signing out does not remove it.

superclerk.com uses Google Analytics (cookies _ga and _ga_*, which last up to 2 years) to measure visits, page views and interactions on our marketing pages. In the European Economic Area, the United Kingdom, Switzerland and Quebec it loads only after you allow measurement on Your Privacy Choices. If your browser sends Global Privacy Control or you opt out, it doesn't load.

superclerk.com also loads the Meta pixel (cookies _fbp and _fbc, which last up to 90 days). In the European Economic Area, the United Kingdom, Switzerland and Quebec it loads only after you allow it on Your Privacy Choices. It tells Meta which of our pages you visit and when you request a demo or book a call, with your IP address and browser details, so Meta can measure our ads and show them to people like you. When you request a demo or book a call, our servers tell Meta too, with hashed (SHA-256) forms of the email address, phone number and name you entered, the country Cloudflare estimates from your connection and the visitor ID described above, and the ad click and cookies above; Meta counts the two reports as one. Neither tells Meta your answers. For a browser that opted out or sent Global Privacy Control, the pixel doesn't load and our servers tell Meta nothing.

Videos on our ad pages play through Mux. When a video loads or plays, Mux receives your IP address, your browser details, which of our ads brought you to the page and how much of the video you watched, so it can deliver the video and show us how it is watched. It sets no cookies.

Sign-in cookies from app.superclerk.com and api.superclerk.com keep you signed in and protect sign-in flows. They are strictly necessary and last up to 7 days, renewing while you use Superclerk. The Superclerk app loads neither the Meta pixel nor Google Analytics.

Product analytics

PostHog, through our own domains, receives which pages of superclerk.com you view and, on the app's sign-up and setup pages, which screens you see, how you signed up, your kind of business, team size and how you found us (including a community you name), the tools you connect and that you used voice. It does not receive your other answers. Each event carries the page's address, which during setup can include your website address and business name, your IP address and your browser details. After you sign up our servers add that you signed up, started checkout and first paid (and how much), with your workspace ID and the ad's campaign tags. PostHog itself sets no cookies. It keeps the visitor ID described under Cookies, an ID for this visit and where the visit started in your browser tab's session storage, which your browser clears when you close the tab. It follows the same privacy choices as Google Analytics above; turning sharing off in Settings stops our servers' reports too. Nothing is reported once you are past setup.

Our quizzes, free audit and demo calls

When you search for your business, what you type goes through our servers to Google, which suggests matching Google listings. For the audit we read the public Google listing you pick and the businesses ranked near it (through Google and DataForSEO), and we check your website. We keep the audit report so its link keeps working. The competitor map's tiles come from OpenFreeMap, which receives your IP address.

The quiz reports to PostHog, through our own domain, which screens you see, the answers you tap, your clicks and a recording of the page, so we can see where people stop. Everything you type is masked in the recording, and the business search, the audit, your recap, the contact form and the calendar are left out of it. PostHog receives your IP address and browser details, sets no cookies and keeps only what Product analytics above describes in your browser tab's session storage. It follows the same privacy choices as Google Analytics above.

When you ask for a setup call, your name, business name, phone number, email, quiz answers (including your age range, team size and yearly revenue range) and audit results go to our own CRM in Superclerk, with the ad that last brought you to our site (its campaign tags and the page it led to). Google Analytics and Meta are told you requested a call, without your answers. The calendar is Cal.com: it receives your name, email, your answers in the booking notes and the ID of your request, and sends your confirmation. Meta and Google Analytics are told when you book. Where a setup-call form asks your email first, we save it when you press Continue, so we can reach you about your call even if you stop there. Each step also alerts our team in a private Telegram group, with your name, email, phone number, the form and page you used and your answers. We keep your request in our CRM and that alert until you ask us to delete them at privacy@superclerk.com; the copy our workflow keeps of each step is deleted after 30 days.

Our "Book a demo" form asks your work email, your kind of business, your team size, what you want AI to handle first, the chat you would use and how you heard about us, then your name and, if you give them, your website, phone number and what you want to solve. We save your work email when you press Continue, so we can reach you about your demo even if you stop there. PostHog receives the screens you see, the answers you tap and the page you opened the form on, without a recording of the page. Your details, answers, that page and the ad that last brought you go to our CRM. Google Analytics and Meta are told you requested a call, without your answers, and when you book. The calendar is Cal.com, as above.

How we use information

We use information to authenticate users, operate agents, connect external tools, execute the actions you request, debug and secure the service, improve reliability, and communicate about the product. We do not use data from Google, Instagram, or other connected services to train foundation models.

Connected services

Superclerk accesses a connected service only after you authorize it and uses that access only to provide the features and actions you request. You can revoke connected service access from Superclerk or from the provider's own account settings at any time.

Sharing

We do not sell personal information, and we never transfer connected-service data to data brokers, advertising networks, or any party that would use it independently. Apart from the advertising measurement described above, we share information only with service providers that help us operate Superclerk and deliver requested features, with connected services you authorize, when required by law, or at your direction. Our service providers are bound by contractual data-protection terms. See our Sub-processors page for the current list.

SMS and business communications

Businesses use Superclerk for customer conversations, support, service coordination, and marketing to recipients who have consented. We process communications for the business operating the program. Depending on the features enabled, this includes sender and recipient phone numbers, message contents, call metadata, recordings and transcripts, AI-generated replies and summaries, delivery status, and consent and opt-out records. We use this information to provide the requested communications, troubleshoot delivery, prevent abuse, and honor messaging preferences. Our service providers, including communications and AI providers, process the information needed to deliver these features.

We do not sell SMS-program mobile information or share it with third parties or affiliates for their marketing or promotions. Text messaging originator opt-in data and consent are excluded from the advertising and sharing categories elsewhere in this policy. Contracted providers may process this information to operate the messaging service, subject to the same restrictions. Consent to receive a named business's marketing texts does not permit us to share your number for another business's marketing. We retain necessary consent and opt-out records to honor your choices and resolve messaging disputes.

The sending business determines its program's purpose, recipients, and consent process and provides its own privacy notice. Contact that business about its messages or recipient records; contact privacy@superclerk.com for help with our processing. Reply STOP to the sending number to unsubscribe or HELP for assistance. Entering a number on our demo form does not enroll you in SMS. See our SMS Terms and messaging support.

Security and retention

We use technical and organizational safeguards to protect information, including encryption in transit, encryption at rest, access controls, audit logs, and least-privilege service credentials. We retain account and integration data for as long as your Superclerk account remains active. Disconnecting a service stops new access; provider revocation may continue asynchronously. Connected-service data already saved in agent run history or workflows remains with your Superclerk account until you delete it or request full deletion. We complete full deletion within 30 days, except where retention is required by law, by an ongoing security investigation, or to enforce our agreements.

Advertising measurement information saved at sign-up stays with your workspace until the workspace or your account is deleted, except the sign-up IP address and user agent, which we delete after 90 days. The browser cookies last as described under Cookies.

For each event we report, we keep a record of what was reported (its type and time, the amount of a first payment, and the click identifier sent) and of Meta's answer, with your workspace until it is deleted. The hashed email address, IP address and user agent prepared for Meta are deleted as soon as Meta accepts or refuses them, and at the latest 7 days after the event, when Meta's reporting window closes.

Your choices and data deletion

You can request access, correction, export, or deletion of your information at any time. To opt out of the sale or sharing of personal information, use Your Privacy Choices or send a Global Privacy Control signal; once you have an account, you can also turn off sharing in Settings. You can disconnect external accounts from inside Superclerk. You can also revoke Google access from your Google Account's third-party connections page, remove Superclerk from Instagram under "Apps and Websites," or remove the app from your Facebook Business integrations. Revoking provider access stops future access but does not by itself delete data already stored in Superclerk. For complete instructions, see our Data Deletion Instructions.

International transfers

Superclerk operates from the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States, subject to appropriate safeguards.

Changes

We may update this policy as the product evolves. We will update the effective date at the top of this page, and for material changes we will notify customers by email or in-product notice before the change takes effect.

Contact

For privacy questions or requests, email privacy@superclerk.com or call +1 (628) 202-3113. The operating entity is Benrov, Inc.