Supa Privacy Policy

1. Who we are and what this policy covers

Supa is a product operated by BuildPass Pty Ltd and BuildPass Inc., as allocated below. The AI assistant is provided through getsupa.ai, app.getsupa.ai and the related features and messaging channels we make available. This policy explains how we collect, use, disclose and retain personal information about users, website visitors, people contacting us and people whose information a user lawfully provides through Supa.

For US customers, the responsible Supa operator is BuildPass Inc., EIN 37-2168499, at 3212 E Cesar Chavez, Building 1, Suite 1115, Austin, TX 78702, United States. For Australian and other customers where Supa is offered, it is BuildPass Pty Ltd, ABN 61 652 324 635, ACN 652 324 635, at Unit 2, 33 Stewart St, Richmond, VIC 3121, Australia, unless your order expressly identifies otherwise. References to we, us or Supa mean the relevant operator. Both companies may help provide the Services under the restrictions in this policy.

Contact us at privacy@getsupa.ai about this policy or your information. The SMS Privacy Statement provides additional protections for mobile numbers and messaging-consent information.

This is a notice of our practices. Acknowledging it does not provide blanket consent. Where a particular collection, use, disclosure or transfer requires consent, we request that consent separately.

2. The roles we play

We handle account administration, security, billing and our own customer relationships in our own capacity. When an organisation uses Supa to process information about staff, customers or other people, we may act as its processor or service provider under its instructions and any applicable data-processing agreement. That organisation determines its own purposes and must provide appropriate notices and authority.

If your information appears in another customer's account, you may contact that customer or us. We will help route and respond to requests according to our role and legal obligations, while protecting other people's information. An organisation's account administrator may control access to information placed in its workspace; check the organisation's policies before submitting personal material there.

3. Information we collect and where it comes from

The information collected depends on the features you use and the permissions you give:

Category	Examples and source
Account and contact information	Name, email, phone number, organisation, account preferences and authentication information you provide or an authorised sign-in provider supplies.
Customer Content	Messages, prompts, files, instructions, outputs, feedback and corrections provided or generated during your use. Audio or images are included only if you submit them through an available feature.
Connected-service information	Content and metadata we access with permission, such as relevant messages, documents, calendar details and records; connection identifiers and access tokens needed to maintain the connection.
Actions and activity records	Tasks requested, permissions, confirmations, tools used, results, errors and relevant action history. These records can contain personal information.
Billing and transactions	Plan, billing contact, payment status, transaction reference and payment details handled by the payment provider where paid features are used.
Technical and usage information	IP address, browser/device information, timestamps, feature interactions, performance and security logs. These are not anonymous merely because they are technical records.
Communications and preferences	Support enquiries, survey responses, marketing choices, SMS consent evidence, opt-outs and your "Help improve Supa" setting.

We receive information directly from you, from your use of Supa, from authorised integrations, from your organisation and from providers helping operate the Services. Another user may include information about you in a message or document. We do not need unrestricted access to every account you hold; connected access depends on the scopes and permissions granted.

Content may incidentally contain sensitive information. Only provide what a task needs, and ensure you have authority to provide information about others. We seek additional consent where required to collect or handle sensitive information. You can decline to provide optional information or revoke permissions, although the dependent feature may then be unavailable. You may make a general enquiry anonymously or using a pseudonym where practicable; accounts, payments and some rights requests require identification.

4. How we use personal information

We use information reasonably needed to:

• Create and administer accounts, authenticate users and provide customer support.
• Understand requests, generate responses, retrieve relevant information and carry out authorised tasks, including disclosures to a recipient or connected service required by your instruction.
• Maintain preferences and context for your account and provide any available personalisation features.
• Process agreed payments and manage subscriptions.
• Monitor reliability, diagnose faults, evaluate service performance and improve product design, subject to the AI restrictions in section 5.
• Detect misuse, protect accounts and investigate security incidents, with access limited to what is needed.
• Send requested communications and service notices, and send marketing only where permitted and subject to your choices.
• Meet legal obligations, keep required records and establish, exercise or defend legal claims.

Where applicable law requires a lawful basis, this may be providing a contractually requested service, complying with law, a permitted legitimate interest balanced against your rights, or consent for a specific purpose. We do not treat a general acknowledgement of this policy as consent for every activity.

5. AI processing and improvement

Providing your service

We store your conversations, attachments and records of Supa's tasks. Supa can search previous messages and retain notes about relevant facts and preferences to provide continuity between requests. Information can remain stored even when it is not included in the immediate context used to answer a message. The retention and deletion provisions in section 10 apply to this history and saved context.

Authorised Supa staff may access relevant conversations and task records to provide support, investigate failures or abuse, and address security incidents, subject to confidentiality and purpose restrictions. Your conversations are not accessible only to you and the AI. Human access to connected-service information remains subject to the additional restrictions below.

Supa and contracted AI providers process relevant Customer Content to answer requests and perform authorised tasks. Retrieval, inference and storing a preference for your account do not necessarily train a model. We require providers processing content for these purposes to use it only for the permitted service and associated security/legal purposes, rather than independently training their general-purpose models.

We do not promise zero retention: retention and limited access for security or support depend on the service and applicable provider arrangements. We restrict those arrangements to purposes described here and disclose material changes before they apply where required.

Improvements using usage information

We may use operational information to understand performance and improve the product. Aggregated or anonymised non-content usage signals, such as response-time distributions, error rates and task-success totals, may also support evaluation and improvement of AI functionality and shared models where law and source restrictions permit.

We treat information as anonymised only when it cannot reasonably identify a person or customer, be linked back to them, or expose confidential customer content. We use reasonable safeguards against reidentification, maintain it in that form and require recipients to do the same. We do not attempt reidentification except a controlled assessment of whether our anonymisation meets applicable requirements. Identifiable or pseudonymous usage records remain protected personal information.

Broader use of private content to improve Supa is distinct from these operational metrics and from answering your requests. "Help improve Supa" is enabled by default for new accounts. You can turn it off during signup or at any time in Settings. While it is enabled, we may analyse your conversations for common topics, outcomes and product-quality signals, and members of the Supa team may review your conversations and what Supa has learned about you to improve Supa, except information from connected services whose terms restrict human access, which stays under the connected-provider restrictions below. Turning it off excludes your conversations and what Supa has learned about you from future analysis and review for this purpose. This does not prevent the support, fault investigation and security uses described above.

No model training on your content

We do not use your Customer Content to train, fine-tune or otherwise improve shared AI models, and "Help improve Supa" does not enable it. Customer Content includes your prompts, Supa's responses, files, connected-service information, feedback and corrections. Contracted AI providers process it to provide the service under purpose, confidentiality and retention restrictions and are not permitted to use it to train their own products. If we ever want to use Customer Content for model training, we will ask for your specific consent first; this policy and the "Help improve Supa" setting do not give it.

Withdrawing permission

You may turn off "Help improve Supa" in Settings at any time or contact privacy@getsupa.ai. Turning the setting off records your choice across your account. For an email request, we record the request and confirm when it has been applied. We may still process content to provide your requested service, preserve your account context, investigate faults and abuse, and comply with law, and we may improve features using aggregated or anonymised non-content operational usage as described above.

Connected-provider restrictions

If you connect Google Workspace, our use and transfer of Google Workspace API information will comply with the Google API Services User Data Policy, including Limited Use requirements. We use that information to provide the authorised user-facing feature. We do not use raw or derived Google Workspace API data to train, fine-tune, reinforce, evaluate or improve AI models, including after aggregation or anonymisation, or disclose it to AI providers for those purposes. We do not use it for advertising.

Human access to Google Workspace API data is limited to circumstances allowed by Google's policy, such as your affirmative agreement to view specific data for support, security investigation or legal requirements. Other integration-specific restrictions also apply. Neither "Help improve Supa" nor a separate consent overrides these restrictions. Mixed content containing restricted data remains excluded unless eligible material can be reliably separated in accordance with those restrictions.

6. Who receives information

We disclose information only for applicable purposes described in this policy:

• Service providers: hosting, storage, AI inference, authentication, messaging, support, security, analytics and payment providers processing information for us under appropriate contracts and access restrictions.
• Your chosen recipients and integrations: people and services you instruct Supa to interact with. They may handle the information under their own policies once an authorised disclosure occurs.
• Your organisation: authorised workspace members or administrators, consistent with the access and sharing arrangements of the feature you use.
• Group companies and professional advisers: where needed to operate Supa, obtain advice or meet obligations, with confidentiality and purpose restrictions.
• Legal and safety recipients: where disclosure is required or authorised by law, reasonably necessary to address fraud or threats, or to establish or protect legal rights.
• Business successors: in a genuine financing, reorganisation or sale, subject to appropriate safeguards and continued privacy obligations. This does not authorise using mobile consent information for another entity's marketing.

We do not sell personal information, disclose it to data brokers, or share it for cross-context behavioural advertising. Contracted AI providers act on our behalf under section 5; we do not permit them to train models using Customer Content. The narrower restrictions on mobile numbers and SMS consent in section 7 prevail over general disclosure wording.

7. SMS and mobile information

We collect the phone number supplied, message content and delivery metadata, and records of consent, preferences, help requests and opt-outs to provide the messaging programme, secure it and honour your choices.

We do not sell, rent or share mobile numbers, text-messaging originator opt-in data or SMS consent information with third parties or affiliates for their marketing or promotional purposes. We disclose this information only to providers acting for us as necessary to deliver, operate, secure and support messaging, or where required by law. This restriction also applies to disclosures otherwise described in this policy, including model-improvement activities. Mobile numbers and SMS consent/opt-out records are excluded from model-training and evaluation datasets.

Reply STOP to opt out or HELP for assistance on a reply-capable sending number, or contact support@getsupa.ai. A non-reply-capable message must provide an accessible alternative opt-out. See the SMS Messaging Terms and SMS Privacy Statement for details. An SMS opt-out is not an account-deletion request, and we may retain a minimal suppression record to avoid messaging you again.

8. Cookies, analytics and communications choices

We use essential browser storage where necessary for features such as sessions, security and preferences. If we introduce optional analytics or other tracking technologies, we will describe their purposes and obtain consent where required before using them. Browser controls can block or remove storage, but blocking essential storage may affect functionality.

We do not use Customer Content for targeted advertising. Where applicable law requires us to recognise an opt-out preference signal such as Global Privacy Control, we will honour it. If our practices change in a way that triggers new opt-out or consent requirements, we will provide the required notice and controls before beginning that processing.

You can unsubscribe from marketing using the message's mechanism or contact support@getsupa.ai. Service communications needed to operate your account may continue through an appropriate non-marketing channel. SMS remains subject to its own suppression rules.

9. Overseas processing

Supa is operated by Australian and US companies. Personal information may be accessed or processed in Australia, the United States and other countries where our service providers operate. Contact privacy@getsupa.ai for information about the processing locations relevant to your use of Supa. Your chosen integrations may process information in other locations under their own policies.

Overseas laws may differ from those where you live. We take steps required by applicable law to protect international disclosures, including appropriate contractual protections and, where required, an approved transfer mechanism or specific consent. Acknowledging this policy is not a waiver of Australian Privacy Principle 8 protections or consent to every overseas disclosure. Contact privacy@getsupa.ai for information about relevant safeguards.

10. Retention, disconnection and deletion

We retain personal information only for as long as reasonably needed for its purpose, considering your account and instructions, service functionality, security, consent evidence, legal recordkeeping and dispute requirements. Different records may have different retention periods.

Customer Content is retained for your account's features and, while "Help improve Supa" is on, the improvement purposes in section 5, only as long as reasonably needed. Deletion, account closure and turning that setting off affect retention and use as described here. Billing records may need to be retained for statutory periods. Security logs are kept for investigation and prevention needs, and minimal consent and suppression records may be retained to demonstrate and respect your choices.

You can request access, export or deletion at privacy@getsupa.ai. Disconnecting an integration stops future access under that connection but does not automatically remove existing copies, undo completed actions or erase information already sent to a recipient. Ask separately for deletion of retained content. Clearing saved memory is not the same as deleting conversation history or closing your account. A request to delete retained content can cover conversations, saved context, indexed integration data and attachments; tell us the scope you want removed.

On a valid deletion request, we delete or irreversibly anonymise information from active systems and instruct relevant processors to do so, subject to lawful exceptions. Backup removal follows the applicable backup lifecycle; retained backups are restricted from ordinary use and deletion must be reapplied if a backup is restored. Where we must retain information, we restrict it to the reason for retention and explain relevant limits in responding to your request. Model improvement is also subject to the opt-out provisions in section 5.

11. Security and AI-related privacy risks

We use reasonable technical and organisational measures to protect personal information, restrict access and manage incidents. No safeguard eliminates all risk. AI may generate incorrect information or misinterpret instructions, and material from a third party may try to influence the assistant into an unintended action or disclosure. Review consequential actions and grant only the permissions you need.

Do not send highly sensitive information through an unsuitable channel. We will assess and notify reportable breaches as required by applicable law.

12. Your rights in Australia and the United States

Depending on applicable law and our role, you may request access to, correction of, or deletion of personal information, a portable copy, information about our handling, or withdrawal of consent. We may verify your identity and authority using information proportionate to the request; we will not ask for unnecessary sensitive documents. We respond within applicable deadlines and explain any lawful refusal or limitation. Exercising a privacy right will not result in unlawful discrimination.

Australia: where the Privacy Act 1988 (Cth) applies, you can request access and correction and complain about our handling under the Australian Privacy Principles. Contact privacy@getsupa.ai. We aim to acknowledge complaints promptly and provide a substantive response within 30 days, or explain why more time is needed. You can complain to the Office of the Australian Information Commissioner at oaic.gov.au if you are dissatisfied; you do not waive regulator access by contacting us first.

United States: state privacy laws may provide rights to know or access categories and specific pieces of personal information, correct inaccuracies, delete information, obtain a portable copy, and opt out of sale, targeted advertising or certain profiling with legal or similarly significant effects. Some laws also provide rights to limit certain uses of sensitive information or require consent for that processing. Availability depends on your state, the processing and whether the law applies to us. We do not sell or share information for cross-context behavioural advertising as described in section 6.

Where applicable, an authorised agent may submit a request with evidence of authority. If we deny a request, you may appeal by contacting privacy@getsupa.ai with “Privacy appeal” in the subject. We will explain the result and any applicable route to your state regulator. We will meet the deadlines and requirements of the law governing your request rather than apply one uniform period to every state.

13. Children and third-party sites

Supa accounts are intended for adults aged 18 or older. We do not knowingly invite children to register. If you believe a child has provided information without appropriate authority, contact privacy@getsupa.ai so we can investigate and remove it where required. Information about a child contained in an adult user's documents remains protected personal information.

Links to, or interactions with, an independent third-party service are subject to that service's own practices. This does not remove our responsibilities for information we process or disclosures we make.

14. Updates and contact

We will update the effective date when this policy changes and provide notice of material changes before they apply where required. If a new use requires fresh consent, we will request it. A policy update does not silently change previously excluded Customer Content into training data.

Privacy requests and complaints: privacy@getsupa.ai. General support: support@getsupa.ai. Postal contact: the relevant operator and address in section 1.