Privacy Policy

Information we collect

We collect account information you provide (name, email, organization), workspace and organization settings, agent instructions, messages, files, tool outputs, logs, and usage metadata needed to run Superclerk. When you connect third-party services such as Instagram, Google, Slack, HubSpot, Telegram, or LinkedIn, we collect the authorization tokens and the service data needed to perform the actions you request.

Instagram and Meta data

When you connect an Instagram Business or Creator account through Superclerk, we use Meta's Instagram Graph API and receive the following on your behalf: your Instagram account identifier, username, profile picture, account type, and aggregate account metadata; comments on media you own and replies you author; direct message threads your account participates in and the text of those messages; webhook events delivered by Meta when comments or messages are posted to your account. We use this access solely to provide the connected features you choose, such as drafting and publishing posts, replying to comments and DMs, or surfacing inbox activity for your review. We do not download or persistently store media files served from Instagram's CDN; we render media in our UI using Instagram's CDN URLs and remove cached references when the source becomes unavailable.

Google user data

When you connect a Google service, Superclerk receives OAuth tokens and the Google data covered by the permissions you approve. Depending on the services you connect, this can include your Google account identifier and email; Gmail messages, threads, labels, and attachments; Calendar data; Drive file and folder metadata; content from Drive, Docs, and Sheets; and account, campaign, property, profile, and performance data from Google Ads, Analytics, Search Console, and Business Profile.

We use Google user data only to provide the Superclerk features you request, such as finding and summarizing files, drafting or sending email, managing calendar events and documents, running configured workflows, and reporting marketing performance. We do not sell Google user data, use it for advertising, credit, or lending, or use it to train or fine-tune foundation models.

We store encrypted Google OAuth tokens while your service is connected and may store relevant content and results in agent run history, configured workflows, and audit logs so you can inspect the work you requested. We share Google user data only with contracted service providers, including AI model providers, when necessary to provide those features, or when required for security or by law. Our personnel do not access Google user data unless you affirmatively request support, access is necessary for security or legal compliance, or the data is aggregated and de-identified for internal operations.

Superclerk's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How we use information

We use information to authenticate users, operate agents, connect external tools, execute the actions you request, debug and secure the service, improve reliability, and communicate about the product. We do not use data from Google, Instagram, or other connected services to train foundation models.

Connected services

Superclerk accesses a connected service only after you authorize it and uses that access only to provide the features and actions you request. You can revoke connected service access from Superclerk or from the provider's own account settings at any time.

Sharing

We do not sell personal information or transfer connected-service data to data brokers, advertising networks, or any party that would use it independently. We share information only with service providers that help us operate Superclerk and deliver requested features, with connected services you authorize, when required by law, or at your direction. Our service providers are bound by contractual data-protection terms. See our Sub-processors page for the current list.

Security and retention

We use technical and organizational safeguards to protect information, including encryption in transit, encryption at rest, access controls, audit logs, and least-privilege service credentials. We retain account and integration data for as long as your Superclerk account remains active. When you disconnect a service, we delete its OAuth tokens and stop new access within 24 hours. Connected-service data already saved in agent run history or workflows remains with your Superclerk account until you delete it or request full deletion. We complete full deletion within 30 days, except where retention is required by law, by an ongoing security investigation, or to enforce our agreements.

Your choices and data deletion

You can request access, correction, export, or deletion of your information at any time. You can disconnect external accounts from inside Superclerk. You can also revoke Google access from your Google Account's third-party connections page or remove Superclerk from Instagram under "Apps and Websites." Revoking provider access stops future access but does not by itself delete data already stored in Superclerk. For complete instructions, see our Data Deletion Instructions.

International transfers

Superclerk operates from the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States, subject to appropriate safeguards.

Changes

We may update this policy as the product evolves. We will update the effective date at the top of this page, and for material changes we will notify customers by email or in-product notice before the change takes effect.

Contact

For privacy questions or requests, email privacy@superclerk.com. The operating entity is Benrov, Inc.