# Privacy policy

> What Super Assist collects from organizations and their end users, who processes it, and how to have it deleted.

Last updated October 10, 2026.

Super Assist is the hosted backend for the `@super-assist/react` assistant panel, at superassist.app. It is run by Mert Dogar, a sole proprietor in Turkey ("we"). This policy covers the site, the dashboard and the service behind them.

Two groups of people's data reach us:

- **Members** sign in to the dashboard for an organization, our customer.
- **End users** use an organization's app and talk to its agents there. The organization decides what its app sends us and why, and we process that data on its behalf.

## What we collect

From members and organizations:

- Your name, email address and a hash of your password, and the sessions that keep you signed in.
- Your organization's name, members, invitations, projects, agents, skills and databases.
- The plan, the credits bought or granted, and the Stripe customer, subscription and checkout ids. Stripe holds your payment details; we never see your card.

From end users, through an organization's app:

- An id for the end user. It is either the id the app supplies, with a name and email if the app passes them, or a random visitor id the browser keeps in local storage.
- Threads: the messages between the end user and the agent, and what the page lends the agent during them. That includes page content, field values, and the actions and tools the page offers, with their results.
- Rows an agent writes to the organization's databases.

The site and the dashboard run no advertising or analytics trackers. The dashboard sets only the cookies that keep you signed in.

## How we use it

- To run the service: answer end users with the agent the organization configured, keep threads so a conversation can continue, and show members their organization's data.
- To send account email: verification links, password resets and invitations.
- To bill subscriptions and enforce plan limits, including AI spend.
- To find and fix faults and abuse, using request logs and agent traces.

We don't sell personal data. We don't train models on threads or organization data.

## Who processes it

- **Cloudflare** hosts the service. Everything above is stored in Cloudflare D1 and Durable Objects, in Cloudflare's network. Cloudflare also sends our email, and runs agents set to a Workers AI model.
- **Vercel AI Gateway** carries each agent turn to the model provider of the agent's chosen model, such as Anthropic, OpenAI or Google. A turn includes the thread so far and what the page lent. The provider generates the answer under its own terms.
- **Stripe** takes payments and manages subscriptions.
- **Langfuse** receives traces of agent turns, including their messages, when we turn tracing on to debug.

These providers may process data outside Turkey and outside your country, including in the European Union and the United States.

## How long we keep it

- Account and organization data stays until you delete it or ask us to.
- Threads stay until the organization deletes the project or agent they belong to. Deleting either deletes its end users' threads. Deleting a database deletes its rows.
- Billing records stay as long as tax law requires.
- Request logs and traces expire on their providers' retention schedules.

## Your choices

- **Members** can edit their organization's data in the dashboard at any time. Email us to delete your account or your organization.
- **End users** should ask the organization whose app they used, since it controls their threads. If you write to us instead, we will pass your request on.

Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to how it is used. Email us to exercise any of them.

## Changes

We post changes here and update the date above. If a change is material, we email organization owners before it takes effect.

## Contact

Email [hello@superassist.app](mailto:hello@superassist.app) with any question about your data.