Privacy Policy

Last updated: October 29, 2026

Superstorm, a Delaware company, and its affiliates (collectively, "Superstorm", "we", "our" or "us") welcome you to Superstorm. We are committed to protecting the privacy of our customers ("Customers") and their authorized users ("End Users", and together with Customers, "Users", "you" or "your"), and to giving Users transparency and control over the use of their data. We designed the Service to collect only the data it needs to work. This Privacy Policy supplements, and should be read together with, our Terms of Service (the "Terms"). Capitalized terms not defined here have the meaning given to them in the Terms.

This Privacy Policy describes how we collect, use, process and share information related to you when you use Superstorm, the online service that adds an AI copilot to a software company's own product: it learns the company's API from the company's own product (its code, the description its API gives of itself, and how it is used) and lets the company's users carry out tasks by describing them, through the company's own API (the "Service"), together with the websites at superstorm.ai and app.superstorm.ai and any related services (collectively, the "Services").

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING THE SERVICES. YOU ARE NOT OBLIGATED BY LAW TO PROVIDE US WITH ANY PERSONAL INFORMATION. IF YOU DO NOT AGREE WITH ANY PART OF THIS POLICY, YOU SHOULD NOT USE THE SERVICES. BY SIGNING IN TO OR USING THE SERVICES, YOU AGREE TO THE COLLECTION AND USE OF YOUR INFORMATION IN ACCORDANCE WITH THIS PRIVACY POLICY.

1. What information do we collect?

What is personal information? "Personal Information" is information that identifies an individual or that may, with reasonable effort or together with other information we have access to, enable the identification of an individual, or that may be of a private or sensitive nature relating to an identified or identifiable person. This includes associating a person with a persistent identifier such as a name, an identification number or a cookie identifier. Personal Information does not include information that has been de-identified, anonymized or aggregated so that it can no longer identify a specific person.

What categories of information do we collect?

• Information you give us when you use the Services ("Customer Data").
  • Account details: your name and email address, which we receive from Google when you sign in, and the copilots in your account.
  • About your product: its name and address, and what your product sends us so the copilot can learn it (see "Learning your product" below). The copilot runs in your users' own browsers, so we never receive their credentials.
  • Your copilots: what our AI learned your product can do, the changes it notices as your product changes, and your choices about what each copilot may do.
  • Support: the contents of your communications with us, for example by email.
  • Information we are required or authorized to collect by applicable law.
  You can view and change much of this information in the Service, and you can ask us to remove Personal Information you provided by writing to support@superstorm.ai.
• Early access requests. If you asked for early access on our website, we keep the email address, website and message you sent, and use them only to reply to you about Superstorm. Ask us to delete them at any time.
• Learning your product. To learn what your product can do, you open it, signed in, with our script tag in it (using the link from your Superstorm console, which carries a key only you have) or with your Superstorm bookmark. Your browser then sends us your product's own code (the JavaScript files your product loads, or the API calls, page addresses and menu links found in them), your API's own description where your product publishes one (such as a GraphQL schema or an OpenAPI file), and the address of the page it ran on. It never sends cookies, passwords, sign-in tokens, the contents of browser storage or the data your product shows.
• Keeping up with your product. Once our script tag is in your product, each page load checks with us whether the copilot is switched on, sending only the copilot's key. At most once a day, or when your product's code changes, it also sends a fingerprint (a short code computed from the addresses of your product's scripts and its version). When your product's code has changed, one of your End Users' browsers sends us your product's code and API description in the same way as above, so the copilot keeps up with your product. You can turn this off in the script tag's settings.
• Learning from how your product is used. Unless you turn it off in the copilot's settings, our script notes, in your End Users' browsers, the shape of the calls your product's pages make to your own API: the method and address (keeping only the words your product's code uses for its API, such as its addresses and the names of its operations, and version numbers like v2; anything else, such as a name or a number, is replaced), the names of the query parameters and headers, the names and types of the fields sent and received, the name of a GraphQL operation, and whether the call succeeded. For calls a page made before our script started, it notes only their addresses, in the same form. It never records values: no names, email addresses, ids, contents or tokens. Each shape is sent to us once per browser. When a call the copilot made fails, we note which call it was, in the same form, so the copilot can learn to do it right. None of this identifies your End Users.
• Data the copilot works with. When one of your users asks the copilot to do something, the copilot sends us their request together with where they are in your product (the page's address and title, its main headings, the title of an open dialog, and any text they selected), so it knows what they mean by "this". It then reads and (for actions you allow, and only after the user confirms) changes data through your product's own API, from the user's own browser, and can open pages of your product for them. To work out the answer, the data the copilot reads, and the result of each change, is sent to us. When an answer is shown on a page rather than given by your product's API, the copilot can also read the text of the page the user is on, or of another page of your product's site, and that text is sent to us in the same way. To make its calls the way your product does, our script notes which headers your product's pages send with their calls (for example a sign-in header) and where the page takes their values from; the values stay in the End User's browser and are never sent to us. Depending on your product, that data can include personal data of your users ("End Users"), such as names, email addresses, phone numbers or records they can see. We process it on your behalf, as described in Section 2 and in the Terms.
• Information we collect automatically.
  • Activity: which copilot action ran, when, for which copilot, and whether it succeeded, including error details.
  • Usage: how many answers each copilot gave and how much AI it used, for your plan's limits and billing.
  • System data: technical information such as IP addresses and browser types, recorded in our server logs for security and troubleshooting. We also use IP addresses, held only in memory for a short time, to limit how much one visitor can use a copilot.
• Information from other sources. Google (your name and email address, when you sign in with Google); and our payment provider, our merchant of record (your billing status, invoices and the country used for tax; never your full card number).

2. How do we use your personal information?

Legal basis. We collect, process and use your information for the purposes described in this Privacy Policy based on at least one of the following legal grounds:

• Performing our agreement with you: to provide the Services under the Terms, including learning your product's API, keeping the copilot up to date as your product changes, running the copilot, maintaining and improving the Services, and developing new features.
• Legitimate interests: to detect, prevent and address fraud, abuse, security, usability, functionality or technical issues, and to protect the rights, property or safety of our Services, our Users or the public, as required or permitted by law, while applying safeguards that protect your privacy.
• Your consent: where we ask for your agreement to process your information for a specific purpose. You can withdraw your consent at any time.

Purposes of use. We use the information we collect to provide and operate the Services, learn your product's API from what your product sends us, run the copilot when your End Users ask it to do things, bill you, support you, secure the Services, comply with legal requirements, and for other legitimate business purposes, including:

• Product improvement: analyzing use of the Services to prioritize and develop features, improve reliability and improve our support, using anonymized and aggregated information where we can.
• Legal requirements: complying with applicable law, protecting our legal interests, and responding to or defending against legal proceedings.

AI. To learn your API, we share your product's code, its API description and the call shapes described above with our AI provider, Anthropic (Claude). When an End User uses the copilot, we share their request, where they are in your product, and the data the copilot reads to carry it out with Anthropic, so it can work out the answer. Anthropic processes these solely to return a response and does not use them to train its models. We keep copilot conversations for ninety (90) days after their last message, to run and support the Service.

Support. To help you, our staff can view your Superstorm console as you see it. Each such view lasts at most an hour and is recorded.

Data about your End Users. We process data about your End Users only on your behalf and on your instructions, which are the Terms and the actions you approve. You are the controller of that data and we are your processor (or service provider). If an End User asks us about their data, we will refer them to you and help you respond.

3. With whom do we share personal information?

We share your information with third parties, or allow them access to it, only in the following ways:

Third-party service providers. We share Personal Information with selected service providers that help us provide and operate the Services, under written terms that protect it ("Third-Party Service Providers"):

• Railway: hosting and databases, in the United States.
• Anthropic: the AI that learns your product's API and runs the copilot.
• Our payment provider: payments, invoicing and taxes, as our reseller and merchant of record.
• Google: sign-in, our email, and the fonts our pages load.
• Cloudflare: domain name services and visit counts for our website.
• Our business, legal and financial advisors.

Law enforcement, legal proceedings and as authorized by law. We may disclose or allow access to Personal Information under a legal requirement or request, such as a subpoena, search warrant or court order, or in compliance with applicable law.

Protecting rights and safety. We may share Personal Information, with or without notice to you, if we believe in good faith that this will help protect the rights, property or personal safety of Superstorm, any of our Users, or any member of the public.

Our affiliated companies. We may share Personal Information within our family of companies, current or future, for the purposes described in this Privacy Policy. If we or any of our affiliates undergo a change in control, including by merger, acquisition or purchase of substantially all of its assets, Personal Information may be shared with the parties involved.

We may also share your Personal Information in other ways with your explicit approval, or where we are legally obligated to. We may use and share non-personal information at our discretion. We do not sell your Personal Information.

4. Direct contact

With your consent, we may use the contact details you provided to tell you about our products and services. You can withdraw your consent at any time by writing to support@superstorm.ai or by using the "Unsubscribe" link in the email.

We may also contact you with important information about the Services, for example about changes to our terms, your billing, a connection, or service maintenance. You cannot opt out of these service messages.

5. Where do we store your information?

Information about Users is maintained, processed and stored by us and by our authorized affiliates and service providers in the United States and, as needed, in other countries where our service providers operate, in secured cloud infrastructure.

Although data protection laws in these countries may differ from those where you live, we, our affiliates and our service providers that store or process your Personal Information on our behalf are each committed to keeping it protected and secure in accordance with this Privacy Policy and industry standards. Where we transfer Personal Information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission.

6. Cookies and similar technologies

A cookie is a small data file stored by your browser. We use only what the Service needs to work, and no advertising or analytics cookies:

• Sign-in cookie (kb_session): keeps you signed in to the account site, for up to 30 days or until you sign out.
• Sign-in step cookie (kb_login): protects the step where Google confirms who you are, for up to 15 minutes.
• Browser storage in your product: our copilot script keeps a few notes in each browser, on your product's site: when it last checked your product for changes; whether the browser was opened with your link (with your key, in your own browser); which call shapes it already sent; the words your product's code uses in its API addresses; where your product's pages take the values they sign their calls with (names only, never the values); and whether it needs our connection frame on that site. For each browser tab it also keeps the conversation with the copilot, which is cleared when the tab closes and starts fresh after six hours. These notes stay in the browser.

When you add a payment method or pay, our payment provider's checkout sets its own cookies under its own privacy policy. Our pages load fonts from Google Fonts, which receives your IP address under Google's privacy policy. Our website counts visits with Cloudflare Web Analytics, which uses no cookies and does not follow you across sites. You can block or delete cookies in your browser settings; the Service will not work without the sign-in cookies. Learn more about cookies at www.allaboutcookies.org.

7. Minors

You must be at least eighteen (18) years old to use the Services. We do not knowingly collect Personal Information from anyone under eighteen (18), and we may ask for proof of age at any stage to verify that minors are not using the Services.

8. Information security

We have implemented administrative, technical and physical safeguards to help prevent unauthorized access to, use of or disclosure of your Personal Information. Data is encrypted in transit. We never receive your End Users' credentials: the copilot acts in each End User's own browser session, so it can do only what that user can. It runs only the actions you leave on, and asks the End User to confirm a change before it runs. Learning your product the first time, or again when you ask, needs the key in your own link or bookmark. Access to your information within Superstorm is limited to employees and partners on a need-to-know basis. Despite these measures, we cannot eliminate all security risks, and security breaches may happen. If you have questions about security, contact us at support@superstorm.ai.

9. Data retention

We keep your information only for as long as you use the Services, or as needed for the purposes for which it was collected. In particular:

• Removing a copilot deletes its settings, what your product sent, the call shapes it learned from and its conversations.
• For each copilot we keep the newest code and API description your product sent, so we can learn it again; removing the copilot deletes it. What a setup sent is kept for thirty (30) days, so a setup that didn't finish can be tried again.
• Copilot conversations are deleted ninety (90) days after their last message, and earlier on request.
• Within thirty (30) days after you stop using the Services and ask us to close your account, we delete the information you provided, unless the law requires us to keep it. Records of billing and usage are kept as needed for tax, accounting and audit purposes.
• Deleted data may remain in our routine backups for up to twelve (12) months before the backup rotation removes it. Backups are used only for disaster recovery.

10. Your rights under applicable privacy laws

Depending on where you live, you may have the following rights regarding your Personal Information. To exercise them, contact us at support@superstorm.ai. We may ask for information to confirm your identity before handling your request. If you are an End User of one of our Customers, please contact that company first: it controls your data, and we will help it respond.

10.1 European Economic Area, United Kingdom and Switzerland (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your Personal Information in accordance with the General Data Protection Regulation (EU 2016/679) ("GDPR") and its local equivalents. You have the right to:

• Access your Personal Information and receive a copy of the data we hold about you.
• Rectification of inaccurate or incomplete Personal Information.
• Erasure ("right to be forgotten") of your Personal Information in certain circumstances.
• Restriction of processing in certain situations, such as when you contest the accuracy of your data.
• Data portability: receive your Personal Information in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time, where processing is based on consent, without affecting processing before the withdrawal.
• Lodge a complaint with your local data protection supervisory authority.

10.2 California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA") gives you the right to:

• Know what Personal Information we collect, use and disclose.
• Delete your Personal Information, subject to certain exceptions.
• Correct inaccurate Personal Information.
• Opt out of the sale or sharing of your Personal Information. We do not sell your Personal Information, and we do not share it for cross-context behavioral advertising: our website uses no advertising cookies or tags.
• Limit the use of sensitive Personal Information to what is necessary to perform the Services.
• Non-discrimination for exercising your privacy rights.

Categories of Personal Information collected: as described in Section 1, identifiers (name, email address, IP address), commercial information (account and billing data, and data the copilot processes for our Customers) and internet activity information (activity and usage records), for the business purposes described in Section 2. To submit a verifiable consumer request, contact us at support@superstorm.ai. You may also designate an authorized agent to make a request on your behalf. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

10.3 Virginia (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act ("VCDPA") gives you the right to access and confirm whether we process your Personal Information, correct inaccuracies, delete it, obtain a portable copy, and opt out of processing for targeted advertising, sale or profiling. We do not sell your Personal Information, use it for targeted advertising, or profile you in furtherance of decisions that produce legal or similarly significant effects. If we decline your request, you may appeal by contacting us at support@superstorm.ai, and if you are not satisfied with the outcome, you may contact the Virginia Attorney General.

10.4 Colorado (Colorado Privacy Act)

If you are a Colorado resident, the Colorado Privacy Act ("CPA") gives you rights similar to those described for Virginia, including the right to access, correct, delete and obtain a portable copy of your Personal Information, and to opt out of targeted advertising, sale or certain profiling. You may exercise these rights by contacting us at support@superstorm.ai. If we decline your request, you may appeal, and if you are not satisfied, contact the Colorado Attorney General.

10.5 Other jurisdictions

We comply with the data protection laws that apply to us. If your jurisdiction grants you privacy rights not listed above, contact us at support@superstorm.ai and we will respond in accordance with applicable law.

11. Updates to this Privacy Policy

We may change this policy from time to time, so please revisit this page. We will notify you of substantial changes by notice in the Service or by email, and they will take effect seven (7) days after that notice. All other changes take effect on the "Last updated" date shown above, and your continued use of the Services after that date constitutes acceptance of them.

12. General information

This Privacy Policy, its interpretation, and any claims and disputes related to it, are governed by the laws of the State of Delaware, United States. Any such claims and disputes shall be brought in, and decided exclusively by, the state and federal courts located in the State of Delaware.

This Privacy Policy was written in English and may be translated into other languages for your convenience. If a translated version conflicts with the English version, the English version prevails.

13. Questions?

If you have questions or comments about this Privacy Policy, email us at support@superstorm.ai, and we will reply within a reasonable time. Superstorm is operated by Superstorm, a company organized in the State of Delaware, United States.