Privacy policy

Last updated 5 September 2026

This explains what SuperTechStack collects, why, who else touches it, and what you can do about it. The data controller is the individual operating SuperTechStack as a sole trader in Thailand, contact support@supertechstack.com. This page will name a registered company here once the business is incorporated.

What we collect

Account data

Your email address and authentication details, handled by Supabase. If you set a display name or profile details, those too. We never see or store your password.

Google account data, if you sign in with Google

Signing in with Google is optional. If you use it, Google gives us the basic profile information covered by the openid, email and profile scopes: your email address, whether Google has verified it, your name, your profile picture, and the account identifier Google uses to recognise you.

We use it for one purpose — to authenticate you and to create or open your SuperTechStack account. Your email address identifies the account and receives service messages; your name and picture appear only to you in the interface. It is stored by Supabase alongside the rest of your account record and kept for as long as the account exists.

We request no other scopes. SuperTechStack cannot read your Gmail, Drive, Calendar, Contacts, or any other Google service, and it never asks Google for permission to do so.

We do not sell Google user data, transfer it to anyone except the processors listed below that operate the service on our behalf, use it for advertising, or use it to train AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Google at any time under Settings, Account, provided you have set a password first so you are not locked out, and you can revoke our access from your Google account permissions page. Deleting your SuperTechStack account deletes the Google profile data we hold, on the schedule set out below.

Content you create

Documents you upload, links you save, notes, conversations, investment theses, assumptions, risks and anything else you enter. This is the substance of the product and it is stored against your account.

Usage records

Which metered operations you ran, when, and what they cost — because the product meters AI usage against a credit allowance and you are entitled to see the same figures we bill from. We also keep answer traces recording what was retrieved and how long it took, so a bad answer can be diagnosed.

Payment data

Handled entirely by our payment provider. We receive a subscription status, a plan, a customer reference and the fact that a payment succeeded or failed. We never receive your card number or bank details.

Technical data

Standard server logs — IP address, browser type, timestamps, which endpoint was called — kept to operate the service, diagnose faults and enforce rate limits.

Why we may process it

• To perform our contract with you: running the product, storing your work, metering and billing your plan.
• Our legitimate interests: keeping the service secure, diagnosing faults, preventing abuse, and understanding which features are used in aggregate.
• Legal obligation: keeping records tax and accounting rules require us to keep.

Who else processes your data

These are the third parties involved in running the service. Each receives only what its job requires.

• Supabase — authentication and account records, including anything Google returns when you sign in with Google.
• OpenAI and Anthropic — the AI models that generate answers, summaries and challenges. They receive the extracts relevant to your request. We use their API tiers, under which submitted content is not used to train their models.
• DeepSeek — an additional model provider, available for the same generation work when you select one of its models. DeepSeek is based in China and processes what it receives there. If you would rather your content did not leave the United States or the EEA, choose an OpenAI or Anthropic model; the one in use is shown wherever a model can be picked.
• Railway — hosting for the application and database.
• Stripe — subscription billing. Card details go to Stripe directly and are never held by us; Stripe is the controller of your payment details, not us.
• Sentry — diagnostic reports when something in the product fails, so it can be fixed. Stored in the European Union. We have turned off the options that would attach personal data to a report: credential headers are redacted before an event is sent, the body of your request is never included, and there is no session recording of any kind.

Some of these operate outside your country, including in the United States and, where you select a DeepSeek model, China; Sentry stores our error reports in the European Union. Where data leaves Thailand or the EEA, transfers rely on the safeguards those providers offer, such as standard contractual clauses.

Public and shared content

Most of what you create is private to your account. Three things are not, and each requires a deliberate act by you or by us:

• A workspace you share by link is visible to anyone holding that link, with the role you granted.
• A post you publish is public if you choose that visibility.
• Company valuation and research pages are public by design and indexed by search engines. They contain no personal data about you.

News briefs you submit are stored privately and require a person to review and publish them before any other reader sees them.

How long we keep it

• Your content: until you delete it, or 30 days after you close your account.
• Backups: deleted content can persist in backups for up to 35 days before being overwritten.
• Usage and billing records: up to 7 years, where tax and accounting rules require it.
• Server logs: 30 days.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing we base on legitimate interests. Export is available in the product on every plan, including free — that is deliberate, so leaving is never blocked by a paywall.

Email support@supertechstack.com and we will respond within 30 days. If you are in the EEA or UK and you think we have got this wrong, you can complain to your local data protection authority.

Cookies

We use cookies and equivalent browser storage only to keep you signed in and to remember interface preferences such as which panel you last opened. We do not use advertising cookies and we do not run third-party tracking.

Children

The service is not for anyone under 18 and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

Security

Data is encrypted in transit and at rest. Access to production systems is restricted. No system is perfectly secure; if a breach affects your data we will tell you and the relevant regulator as the law requires.

Changes

We will update this page when our processing changes and revise the date at the top. For material changes we will give notice in the product or by email. See also our terms of service.