Privacy policy

The controller for account, billing, website, and business-administration data is Nikolaus Redl, trading as Supercenter, Kleistgasse 18/41, 1030 Vienna, Austria. VAT ID: ATU82884407.

Privacy and security requests: security@supercenter.app. We have not appointed a data protection officer because our current activities do not meet the mandatory appointment criteria; the address above remains the direct privacy contact.

For account, payment, security, and website data, we act as an independent controller. When a business customer uses the service to retrieve, enrich, or process data for its own purposes, that customer determines the purpose and legal basis and we normally act as its processor. Customer instructions include requests made through the dashboard, REST API, MCP, CLI, or a connected AI agent.

Our Data Processing Agreement sets out the Article 28 terms, security measures, and authorized subprocessors for that customer-directed processing.

Providing core account, workspace, capability, and billing data is necessary to enter into or perform the service contract. Without it, we cannot provide the requested service. Optional analytics and marketing consent is never required to use the site or product.

Capability results can contain personal data that was not collected directly from the person concerned. It may originate from publicly accessible websites, search results, company websites, professional profiles, social networks, marketplaces, advertisement libraries, and the public pages or APIs of those services. The categories are described in section 3.

We disclose that data to the customer who requested it and to the technical providers needed to execute the request. When we act only as a processor, the customer is responsible for any notice required by Article 14 GDPR. If you believe a result contains inaccurate or unlawfully processed personal data, email security@supercenter.app with the source URL and enough information for us to locate it.

We share data only where needed to provide, secure, measure, or charge for the service; when you instruct us to; or when law requires it. Our intended launch providers are listed below. A provider is used only when its related feature is configured or requested.

The retrieval-provider rows identify the current vendors that may receive a query, source URL, requested fields, public-source content, and technical request metadata when the related capability is used. We do not sell customer content or capability results.

Some providers process data outside the European Economic Area. Where the destination does not benefit from an EU adequacy decision, we use an available lawful transfer mechanism such as the European Commission’s Standard Contractual Clauses, together with contractual, technical, and organizational safeguards. Some providers also participate in the EU–US Data Privacy Framework for eligible transfers. You may request information about the relevant safeguards from our privacy contact.

• Account, workspace, and membership records: while the account or workspace remains active, then normally up to 30 days after verified deletion, subject to backups and legal exceptions.
• Authentication sessions: up to seven days; OAuth and one-time-code records use shorter security-driven periods.
• Capability inputs, normalized outputs, and private raw provider responses: retained for the workspace so results can be supported and audited; there is currently no routine automatic expiry. They are removed with workspace deletion or a valid deletion request, unless a legal hold applies.
• Usage, credit, fraud-prevention, and operational records: for as long as needed to operate and defend the service, generally the account term plus applicable limitation periods.
• Invoices, transactions, and tax records: for the statutory accounting period, which can be up to ten years in Austria.
• Optional analytics and advertising data: according to the configured provider retention and your consent; expected browser-storage periods appear in the cookie policy.

We may retain a minimal suppression record after an opt-out so we can continue to respect it.

We use transport encryption, provider-managed encryption at rest, hashed API keys and one-time codes, scoped authorization, workspace isolation, restricted production access, request validation, billing idempotency, and operational monitoring. No service can guarantee absolute security. If you believe credentials or data have been exposed, contact security@supercenter.app promptly.

Subject to the GDPR’s conditions and exceptions, you may request access, correction, deletion, restriction, portability, or information about recipients. You may object to processing based on legitimate interests and at any time object to direct marketing. You may withdraw consent at any time without affecting processing already carried out lawfully.

Send requests to security@supercenter.app. We may need to verify your identity and normally respond within one month. Where we act for a customer, we will forward or refer the request to that customer.

You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, at dsb.gv.at, or to the authority in your habitual residence, workplace, or place of the alleged infringement.

Necessary authentication and security storage operates without an optional choice. For visitors identified as being in Europe, PostHog, Google Analytics, Google advertising tools, and Meta Pixel remain off until the relevant consent category is granted. Outside Europe, they can start by default where local rules permit. Rejecting optional technologies does not prevent account creation or product use. Use “Privacy choices” in the footer to change or withdraw consent. Global Privacy Control is treated as a decline. Details are in our cookie policy.

We do not make decisions about website visitors or account users that produce legal or similarly significant effects based solely on automated processing. The service is intended for business users aged 18 or older and is not directed to children.

We update this policy when our processing changes. Material changes will be highlighted in the service or sent to the account email where appropriate. The effective date and version at the top identify the current notice.

The transparency requirements reflected here follow Articles 13 and 14 of the EU General Data Protection Regulation.