Privacy policy

This policy explains what information Supacite (supacite.com) collects, why, who we share it with, and the control you have over it. We have written it in plain language on purpose. If anything is unclear, email us and we will explain.

In this policy, "we", "us" and "Supacite" mean the partnership of Kshetez Vinayak and Abhijay Vinayak, which operates supacite.com and the Supacite app. "You" means anyone who visits the site, uses the app or connects an AI agent to it.

1. What we collect

We only collect what we need to run the service:

• Your account. When you sign in with Google, we receive your name, email address and Google account ID.
• Your business and website. Your website address, the public pages we read from your site, and what you tell us or your agent adds: your business, customers, competitors, writing voice, keywords, buyer questions, research, drafts and posts.
• AI visibility checks. The buyer questions we track for you, the answers AI assistants gave to them, and which companies and pages those answers named.
• Connected accounts. If you connect them: read-only Search Console data for your sites (search queries, clicks, impressions and pages), the GitHub repository you choose, and your WordPress site address and application password.
• Your keys and logins. AI provider API keys and DataForSEO logins you add.
• Agent activity. When an AI agent uses one of your access tokens, we record which tools it used and when, so you can see and limit what it does.
• Messages and calls. If you email us or book a call, we keep that correspondence.
• Payments. Payments are handled by Dodo Payments, the merchant of record. We receive your name, email, country, what you bought and whether the payment went through. We never see or store your full card number.
• Usage and device data. Our hosting and analytics record technical data such as your IP address, browser and device type, the pages you view, what you click, and errors you run into. Where we turn it on, our analytics tool can also record sessions on our site so we can see where people get stuck.

2. How we use it

• To run the features you use: research, planning, writing, publishing and AI visibility tracking.
• To process payments and manage your plan.
• To send you service emails, such as when a post is ready, and to answer you.
• To keep the service secure and prevent abuse.
• To understand, in aggregate, how the site and app are used, so we can improve them.
• To meet legal and accounting obligations.

We do not build advertising profiles, and we do not make automated decisions that have legal effects on you.

3. What we never do

We do not sell your data, rent it or trade it. We do not share it with advertisers. We do not use your content to train AI models. We do not add you to marketing lists you did not ask to join.

4. Google user data

Supacite asks Google for two things: your basic profile (name and email) to sign you in, and, only if you connect it, read-only access to your Search Console data.

• We use Search Console data only to show you how your site performs in search and to inform the research, topics and reports in your workspace.
• If you connect an AI agent, it can read that data through our tools when it asks, to help you with your workspace. That agent is run by you and its own provider.
• We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train generalized AI or machine learning models.
• People on our side do not read it unless you ask us to for support, it is needed for security, or the law requires it.
• You can disconnect Search Console in the app at any time, or remove our access from your Google account settings.

Supacite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share it with

We share information only with the service providers we need to run Supacite, and only what they need to do their job:

• Supabase stores our database and runs sign-in, and Vercel hosts the site and app.
• Dodo Payments sells and processes your purchase as merchant of record, under its own privacy terms.
• PostHog provides our product analytics.
• Resend delivers our service emails.
• AI model providers, such as OpenAI, receive the content needed to write or analyze something when you use our hosted AI. When you use your own API key, the content goes to your provider under your own account and its terms.
• DataForSEO receives keywords, buyer questions and website addresses to return keyword data and the answers AI assistants give. When you use your own DataForSEO login, this runs under your own account.
• GitHub and WordPress receive the posts you publish, when you connect them.
• Cal.com handles call scheduling if you book a call.

We may also disclose information if the law requires it, or to protect our rights, safety and property. If Supacite is ever sold or merged, your information may transfer as part of that deal, and this policy will keep applying to it.

6. Where your data is processed

We are based in India, and our providers may store and process data in the United States and other countries. When data moves between countries, we rely on our providers' safeguards for those transfers.

7. How long we keep it

We keep your information while you have an account or work with us, and for a reasonable period after to handle accounting, legal and support needs. When you ask us to delete it, we do so within 30 days, except for records we must keep by law, such as invoices.

8. How we protect it

API keys, DataForSEO logins and publishing passwords are encrypted before we store them. Access tokens for agents are stored only as a one-way hash, so we cannot read them back.

Your information is stored with established providers and is available only to the people who run the service. No system is perfectly secure, but we treat your data as carefully as our own.

9. Your rights and choices

You can ask us to show you the information we hold about you, correct it, delete it, or give you a copy. Depending on where you live, you may also have the right to restrict or object to some processing. To do any of this, including deleting your account, email admin@kshetezvinayak.com. We reply within 30 days.

10. Cookies and similar storage

We use cookies that keep you signed in, a first-party analytics cookie, and your browser's storage to remember choices such as your settings. We do not use advertising cookies or cross-site tracking. You can block cookies in your browser, but signing in needs them.

11. Children

Supacite is a business service and is not meant for children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

12. Changes to this policy

If we change this policy, we will update the date at the top of this page. We will email active customers about significant changes to how we use their information.

13. Contact

Questions, requests or concerns about your privacy go to admin@kshetezvinayak.com. We read every message.