Privacy Policy

SuperAgent Auto LLC ("SuperAgent", "we") is committed to protecting your personal data. This policy explains how we collect, use, store, and protect data when you use our website, web application, and connected services.

SUPERAGENT AUTO LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States
Email: legal@superagent.auto
EU Representative: Brice Ornstein — legal@superagent.auto

• Account information: first name, last name, email, phone, company, role
• Vehicle data: inventory, documents, photos, inspection records
• Contact data: customers, suppliers, partners managed in the CRM
• Financial data: invoices, quotes, purchase orders (no payment card data stored)
• Calendar data: appointments, availability, scheduling preferences
• Email data: email threads, messages, drafts, attachments metadata (when Gmail is connected)
• Conversation data: messages exchanged via chat or AI assistant
• Technical data: IP address, browser type, preferred language, device information

• Providing the SuperAgent SaaS platform (contract performance)
• AI-powered email triage, draft generation, and reply assistance (consent)
• Calendar synchronization with Google Calendar (consent)
• Vehicle inventory management and document generation (contract performance)
• Contact relationship management (contract performance)
• Service improvement and analytics (legitimate interest)
• Security and fraud prevention (legitimate interest)

We share your data with the following service providers:

• Supabase — database, authentication, and file storage
• OpenAI — AI processing for email triage, draft generation, chat and Business Profile review reply drafts (reviewer display name, rating and comment)
• Anthropic — fallback AI processing when configured, including Business Profile review reply drafts
• Google — Gmail API, Calendar API and Business Profile APIs (for connected services); Google Ads API (for campaigns you authorize SuperAgent to manage)
• Resend — transactional email delivery
• Stripe — payment processing
• Railway — application hosting
• Sentry — error monitoring
• Knock — notification delivery

When you connect your Google account (Gmail, Google Calendar), SuperAgent accesses the following data:

• Gmail: email message content, sender and recipient information, attachment metadata, thread structure, and labels — used for inbox triage, AI-assisted draft generation, and reply sending on your behalf
• Google Calendar: calendar events, availability, and appointment data — used for appointment synchronization between SuperAgent and your Google Calendar

SuperAgent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Google Business Profile, we access the business accounts and locations available to you, their profile information (such as name, address, phone number, website and opening hours), reviews and replies, and available performance metrics. We use this data to let you select your business location, display and monitor its profile and reviews, and publish the profile changes and review replies you authorize, subject to your permissions and available features. During synchronization, unanswered reviews may automatically be sent for AI-assisted reply drafting, including the reviewer’s display name, rating and comment. OpenAI processes this information; Anthropic may process it as a fallback when configured. Drafting a reply does not itself publish it.

For campaigns you authorize SuperAgent to manage, we use SuperAgent’s Google Ads manager-account access to read advertising account identifiers and settings, campaign settings and delivery status, and performance data such as spending, impressions and clicks. We use this data to set up, manage and monitor those campaigns, subject to available features and campaign controls. These accesses use SuperAgent’s management credentials, not the tokens from a Google Ads connection added to your SuperAgent account.

For your connected services, we encrypt Google OAuth access and refresh tokens before storing them, using AES-256-GCM. Access to connected-service data is scoped to your SuperAgent account. During OAuth authorization, we check that the authorization state has not expired and reject reuse of an authorization attempt that has already been consumed.

SuperAgent uses Google API data solely to provide the features you have enabled. We do not use Google user data for advertising purposes, except Google Ads data used directly to manage the campaigns you authorize. We do not sell Google user data to third parties. We do not use Google user data for purposes unrelated to the SuperAgent features you have consented to. SuperAgent does not allow humans to read your Google data unless: (a) we have your explicit consent, (b) it is necessary for security purposes (such as investigating abuse), (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized.

Your data may be transferred to the United States. These transfers are governed by Standard Contractual Clauses (SCCs) in compliance with the GDPR.

• Account data: duration of the subscription + 3 years
• Vehicle and inventory data: duration of the subscription
• Email data (Gmail): synchronized as long as the mailbox is connected, deleted upon disconnection
• Calendar data: synchronized as long as the calendar is connected, deleted upon disconnection
• Financial documents: 10 years (legal obligation)
• Technical logs: 12 months
• Chat conversations: 12 months

Under the GDPR, you have the right to access, rectify, erase, port, restrict, and object to the processing of your data. To exercise your rights, contact us at legal@superagent.auto. You may also lodge a complaint with your local data protection authority.

The site uses strictly necessary cookies for its operation. No advertising or tracking cookies are used. We use Plausible Analytics for audience measurement, a service that does not use cookies and does not collect any personally identifiable data.

We may update this policy. The last update date is shown at the top of this page.