Who is responsible for your data
The data controller is the administrator of the supermarketer.com service. For any question about this policy or your personal data, write to support@supermarketer.com. We answer privacy requests by email, and you do not need to use any special form.
Data we collect
We collect only the data needed to run the service, secure it and bill for it.
- Account data: your email address and a hashed version of your password. We never store your password in readable form.
- Signup details: the page you signed up from, the referring site and any campaign parameters in the link you used (such as utm_source or utm_campaign), and the plan you selected.
- Homepage demo inputs: the website address you enter in the homepage demo, the goal and channel you pick, the public text we read from that website and the plan and posts generated for it.
- Brand and workspace data: your answers to the onboarding questions, your brand brief, plans, drafts, images, approvals, edits, rejections and autonomy settings.
- Connected channel data: access tokens and basic account identifiers for the channels you connect, such as your blog, social profiles, email platform, ad accounts and analytics, plus the metrics we read from them for your reports.
- Billing data: your plan, billing period, invoices and payment status. Card details are entered on the payment operator's secure page and handled by that operator. We do not receive or store full card numbers.
- Support data: messages you send to support@supermarketer.com and our replies.
- Technical data: IP address, browser type, device type, pages visited and timestamps, kept in server logs and in analytics that does not use cookies.
Why we use your data and on what legal basis
Where the GDPR or similar laws apply, we rely on the following legal bases.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your account | Account, workspace and connected channel data | Performance of a contract |
| Running the homepage demo | Homepage demo inputs and technical data | Our legitimate interest in showing how the service works, and steps taken at your request before a contract |
| Generating plans, drafts and reports | Brand, workspace, demo inputs and connected channel data | Performance of a contract |
| Sending sign-in codes and service emails | Email address | Performance of a contract |
| Billing, invoices and tax records | Billing data | Performance of a contract and legal obligation |
| Security, fraud prevention and abuse checks | Technical and account data | Legitimate interest and legal obligation |
| Understanding which pages and campaigns bring signups | Signup details and cookieless analytics | Legitimate interest |
| Answering support requests | Support data | Performance of a contract and legitimate interest |
We do not sell your personal data and we do not share it for cross-context behavioral advertising.
Your content and AI models
To draft plans, posts, articles, emails, ads and reports, the content of your workspace is processed by AI model providers on our behalf, only to produce output for your account. Your content and outputs are never used to train public or general-purpose models, by us or by those providers under our agreements with them. Outputs are stored in your workspace until you delete them or close your account.
Who receives your data
We share personal data only with service providers that help us run the service, under contracts that limit their use of the data to the services they provide to us.
- Hosting provider that runs our servers and databases.
- Payment operator that processes subscription payments and stores card data.
- Email delivery provider that sends sign-in codes, invoices and service emails.
- AI model providers that process content to generate output for your account.
- Analytics provider or tool that measures site use without cookies.
When you connect a channel, data you choose to publish is sent to that channel, and that platform's own privacy policy applies to it. We may also disclose data when required by law, to protect our rights or the safety of others, or as part of a merger or sale of the service, in which case this policy continues to apply.
International transfers
Our service providers may process data in the United States, the European Economic Area and other countries. Where data from the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses or another lawful transfer mechanism, together with additional safeguards where needed.
How long we keep data
- Account, brand and workspace data: for as long as your account is open, and deleted within 30 days after you close it, except backups, which roll over within a further 30 days.
- Homepage demo inputs without an account: up to 30 days, then deleted. If you create an account, the demo plan moves into your workspace.
- Connected channel tokens: until you disconnect the channel or close your account.
- Billing records and invoices: as long as tax and accounting laws require, usually up to 7 years.
- Server logs and security records: up to 90 days, longer only when needed to investigate an incident.
- Support messages: up to 2 years after the last message.
Your privacy rights
Depending on where you live, you have some or all of the following rights.
- Access: ask what personal data we hold about you and receive a copy.
- Correction: ask us to fix data that is wrong or incomplete.
- Deletion: ask us to delete your data, subject to records we must keep by law.
- Portability: receive your workspace content in a common machine-readable format.
- Restriction and objection: ask us to limit processing or object to processing based on legitimate interest.
- Withdrawal of consent: where we rely on consent, withdraw it at any time without affecting earlier processing.
- Complaint: lodge a complaint with your local data protection authority.
You can export and delete your workspace content from your account settings at any time. For any other request, email support@supermarketer.com from the address on your account. We reply within one month, or within the period your local law sets.
Rights for US residents
If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, you have the right to know what personal information we collect, use and disclose, to access, correct and delete it, to receive a copy in a portable format, and to opt out of the sale of personal information, targeted advertising and profiling with legal or similarly significant effects. We do not sell personal information, do not use it for targeted advertising and do not carry out such profiling. You may use an authorized agent, and we will not treat you differently for using your rights. If we decline a request, you can appeal by replying to our answer, and we will respond to the appeal within the time your state law sets.
How we protect data
We encrypt data in transit and at rest, restrict access to the people and systems that need it, use role-based access in workspaces and keep security logs. No system is perfectly secure, so if we learn of a breach that affects your personal data, we will notify you and the authorities where the law requires it. More detail is on our security page.
Children
SuperMarketer is a business service for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@supermarketer.com and we will delete it.
Cookies
We use only essential cookies and do not use advertising pixels. Details are in our cookie policy.
Changes to this policy
We may update this policy when the service or the law changes. We will change the date at the top and, for material changes, notify account holders by email before the change takes effect.