Privacy Policy

1. Key Definitions

• Data Fiduciary — the Company, as we determine the purpose and means of processing your Personal Data.
• Data Principal — you, the individual to whom the Personal Data relates.
• Data Processor — any person who processes Personal Data on behalf of a Data Fiduciary.
• Personal Data — any data about an individual who is identifiable by or in relation to such data, including name, email address, phone number, identification documents, and other identifying information.
• Processing — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• Sensitive Personal Data — financial information, health data, biometric data, genetic data, transgender status, caste or tribe, religious or political belief, or any other category notified by the Government.

2. Data Fiduciary Information

Superstellar Media Labs Private Limited

Attn: Data Protection Officer

55 Lane 2 Saidullajab Westend Marg, Saket, Delhi 110030, India

Email (DPO): support@superteams.ai

Email (Legal): legal@superteams.ai

3. Personal Data We Collect

Information you provide to us

• Account registration — name, email address, phone number, password, organization name, job title, business address.
• Profile information — professional details, preferences, settings, profile photo.
• Payment information — billing address, payment method details (processed by third-party payment processors), GST identification number, PAN (if applicable).
• Communication data — support requests, feedback, inquiries, and correspondence when you contact us.

Information collected automatically

• Usage information — features accessed, actions taken, time and frequency of use, interaction with content.
• Device information — device type, operating system, browser type and version, unique device identifiers.
• Log data — IP address, access times, pages viewed, links clicked, referring page.
• Cookies and tracking technologies — see Section 12.

Information from third parties

We may receive Personal Data from authentication services (Google, LinkedIn, Microsoft), business partners, third-party integrations you connect, publicly available sources, and analytics providers.

We generally do not collect Sensitive Personal Data. Where we do (e.g. financial information for billing), we obtain your explicit consent and implement additional security measures. We do not knowingly collect Personal Data from individuals under 18 without verifiable parental consent.

4. How We Use Your Personal Data

We process your Personal Data only to the extent necessary for the following purposes:

• Service provision — provide, maintain, and improve our AI and ML Services; process requests; manage and authenticate your account.
• Platform functionality — enable team collaboration, project management, API access, and third-party integrations.
• Payment processing — process payments, manage subscriptions, calculate usage-based charges, issue invoices.
• Communication — send service notifications, security alerts, support messages, and respond to inquiries.
• Analytics and improvement — analyse Platform usage, identify trends, develop new features.

We do not sell your Personal Data to third parties. Where we rely on your consent as the legal basis for processing, you may withdraw consent at any time.

5. Legal Basis for Processing

Under the DPDP Act, we process your Personal Data based on the following grounds:

• Consent — you have given clear consent for specific purposes (e.g., marketing communications, certain integrations).
• Contract performance — processing is necessary to perform our contract with you and provide the Services.
• Legal obligation — processing is necessary to comply with legal obligations under Indian law (e.g., tax compliance, law enforcement requests).
• Legitimate interests — processing is necessary for our legitimate business interests (e.g., fraud prevention, service improvement, security), provided such interests do not override your rights.

6. How We Share Your Personal Data

We do not sell your Personal Data. We may share it with:

• Service providers and Data Processors — cloud hosting, payment processing, analytics, customer support, email services, and security vendors. All are contractually obligated to protect your data.
• Third-party integrations — when you choose to connect third-party services, we share necessary data with your explicit consent. You may revoke access through account settings.
• Business partners — companies we partner with for joint services or promotions, with your consent.
• Corporate transactions — in connection with any merger, acquisition, or sale. We will notify you of any such transaction.

7. International Data Transfers

Your Personal Data is primarily stored and processed within India. When we transfer Personal Data outside India, we ensure:

The recipient country is notified by the Central Government as providing adequate protection, or Appropriate safeguards such as Standard Contractual Clauses or binding corporate rules are in place, or The transfer is necessary for the performance of our contract with you, or you have explicitly consented after being informed of possible risks.

8. Data Security

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit (TLS/SSL) and sensitive data at rest
• Multi-factor authentication and role-based access controls
• Regular security assessments, vulnerability testing, and penetration testing
• Security monitoring, intrusion detection, and incident response procedures
• Employee training on data protection and security best practices
• Vendor security assessments for third-party service providers
• Compliance with ISO 27001 and other security standards

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your Personal Data. You are responsible for maintaining the confidentiality of your account credentials.

9. Data Breach Notification

In accordance with the DPDP Rules, 2025, if we become aware of a data breach likely to cause harm, we will:

• Notify the Data Protection Board of India within 72 hours of becoming aware
• Notify affected Data Principals as soon as reasonably possible, with a description of the breach, categories of data affected, likely consequences, mitigation measures taken, and guidance on protective steps

10. Data Retention

We retain Personal Data only for as long as necessary. Specific retention periods:

• Account data — duration of active account plus 90 days after closure
• Payment and billing data — 7 years (tax and accounting regulations)
• Usage and log data — up to 2 years
• Support communications — 3 years
• Marketing communications — until consent is withdrawn, plus 90 days
• Legal and compliance data — as required by applicable laws or until conclusion of legal proceedings

After the retention period expires, we will securely delete, destroy, or anonymize your Personal Data. Anonymized or aggregated data may be retained indefinitely for analytics and research.

11. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

• Account data — Right to Access (§11(1)) — obtain confirmation of whether we are processing your Personal Data, a summary of the data and processing activities, and the identity of Data Processors and third parties.
• Right to Correction (§11(2)) — correct, complete, update, or amend inaccurate, incomplete, or outdated Personal Data.
• Right to Erasure / Right to be Forgotten (§11(3)) — request erasure when consent is withdrawn and there is no other legal basis, or when data is no longer necessary. We may retain data if required by law.
• Right to Grievance Redressal (§11(4)) — a readily available means of grievance redressal via our Data Protection Officer.
• Right to Nominate (§11(5)) — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email support@superteams.ai with subject line "Data Principal Rights Request", including your full name, email address, a description of your request, and proof of identity. We acknowledge within 7 days and respond within 30 days (extendable for complex cases). We do not charge a fee unless a request is manifestly unfounded or repetitive.

12. Cookies & Tracking Technologies

We use the following types of cookies:

• Essential / strictly necessary — required for the Platform to function. Cannot be disabled.
• Functional — enable enhanced functionality such as remembering your preferences and settings.
• Analytics / performance — help us understand how visitors interact with the Platform (e.g., Google Analytics).
• Advertising / targeting — deliver relevant advertisements (only with your consent).

We also use web beacons, pixels, local storage objects, and session storage. You can manage cookies via our consent banner, your browser settings, or by contacting us. To opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout. Disabling certain cookies may affect Platform functionality.

13. Third-Party Links & Services

Our Platform may contain links to third-party websites or services not operated by us. We are not responsible for their privacy practices. Before providing Personal Data to third-party sites, please review their privacy policies. When you integrate third-party services, we will inform you of what data will be shared, obtain your explicit consent, and allow you to revoke access through account settings at any time.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy with a new "Last Updated" date, sending an email notification, and displaying a prominent notice on the Platform. We will provide at least 30 days' notice before material changes take effect (unless required by law or to address security issues). Your continued use of the Services after the effective date constitutes acceptance. We maintain an archive of previous versions — contact us to request access.

15. Contact Us

For questions, concerns, or Data Principal rights requests regarding this Privacy Policy:

Superstellar Media Labs Private Limited

Attn: Data Protection Officer

55 Lane 2 Saidullajab Westend Marg, Saket, Delhi 110030, India

Email (DPO): support@superteams.ai

Email (Legal): legal@superteams.ai

We acknowledge within 7 business days and provide substantive responses within 30 days.