Skip to main content

Privacy Policy

Last updated October 13, 2026

Superdesk is a customer relationship management tool for wedding and event professionals, currently in early access. This policy explains what data we collect, how we use it, and how you can control it.

Data we collect

  • From you, when you sign up: your name, email, organization name, and any business details you add (address, logo, branding). If you sign in with Google or Microsoft, we receive your name and email from that provider.
  • Content you add: every event, contact, document, note, file, and template you create while using Superdesk. This content belongs to you.
  • From your clients and invitees: when someone books a meeting, fills out a form, or opens a page you share, we collect the details they submit (name, email, phone, and their responses) so we can deliver it to you.
  • Pricing page views: when someone opens a pricing page you share, we count the visit and which parts of the page they scrolled to, by day, so you can see how your page is read. We don’t set a cookie for this or keep the visitor’s IP address, and nothing in it identifies who visited.
  • Connected accounts: if you connect Gmail, Outlook, Google Drive, or a calendar, we access only the email, calendar, and file data you authorize, to power those features. Google user data below covers exactly what we do with data from Google.
  • AI assistants & API access: if you connect an AI assistant (like Claude) or create an API token, that connection can read and act on your Superdesk data exactly as your own login allows — never more — until you disconnect it in Settings. We only honor connections you explicitly approve, and we log when they’re used.
  • Technical data: IP address, browser, device type, and pages viewed — used to keep the service running and spot abuse.
  • Product analytics: PostHog, our analytics provider, records the pages you view, which buttons and links you click (never what they say), and the setup steps you reach. It also gets the date your business first creates an event, first sends a client a document, and first takes a payment (the dates only, never the client, the document, or the amount). When you’re signed in, this is tied to your account by an internal ID, not your name or email. It doesn’t record your screen or what you type into forms. It doesn’t run at all on the pages your clients open (quotes, invoices, contracts, pricing pages and the rest).
  • Payment data: Stripe handles your card details. We never see or store your card number. We keep your subscription status and, for a card that starts a free trial, Stripe’s fingerprint of it (an identifier, not the number), including after an account is deleted, so the same card can’t start a second free trial.

How we use it

To run the service, bill you correctly, email you about your account, and fix things that break. We also look at how Superdesk is used, through the product analytics above, to find where people get stuck and decide what to build next.

We don’t sell your data. We don’t share it with ad networks. We don’t use it to train AI models.

Service providers we rely on

  • Supabase: database and authentication, hosted in the US.
  • Stripe: payment processing. If you collect payments from your own clients through Superdesk, Stripe Connect processes those too.
  • Resend: transactional email.
  • Vercel: application hosting.
  • PostHog: product analytics.
  • Sentry: error monitoring.
  • Upstash: rate limiting and abuse prevention.
  • Anthropic / OpenAI: the AI models behind Superdesk’s AI features. When a mailbox is connected, new incoming email is sent to Anthropic so Superdesk can sort it (you can turn this off); anything else is sent only when you use an AI feature. They don’t train their models on your data.
  • Google (Gmail, Calendar, Drive, and Places): Gmail, Calendar, and Drive only if you connect them, as described under Google user data below; Places powers address and venue search. Google sign-in shares your name and email.
  • Microsoft (Outlook mail, Calendar, and sign-in): only if you connect Outlook or sign in with Microsoft. We only access the data you grant.
  • Apple Maps: map images for venue locations.
  • Geoapify: converts venue addresses to map coordinates. Built on OpenStreetMap data.

Each provider has its own privacy policy. We chose them because their privacy posture fit ours.

Google user data

This section covers what Superdesk receives through Google’s APIs when you connect Gmail, Google Calendar, or Google Drive. Signing in with Google shares only your name and email address.

  • Gmail: we read the email in your mailbox so client conversations show up in Superdesk next to the right event. We send, archive, and mark messages as read when you do those things in Superdesk. Email goes out from your mailbox only when you send or schedule it, or when an automation you set up sends it.
  • Google Calendar: we read your calendars so your schedule and busy times show in Superdesk, and Google tells us when they change. We add, update, and remove only the events Superdesk manages: your Superdesk events, and meetings people book with you, including any Google Meet link. Superdesk can create its own calendar in your account for them.
  • Google Drive: Superdesk can only see files it creates or files you choose. It makes a folder for your events and copies the document templates you pick into it.

AI. When a mailbox is connected, Superdesk sends new incoming email to Anthropic’s Claude to sort it for you, for example to spot a new inquiry or match a message to its event. What’s sent is the subject, sender, recipients, date, and the first part of the message, never attachments. This is on by default, and each brand can turn it off in Settings, under Email (“Ambient triage”). When you ask Superdesk to draft a reply or to change an email you are writing, the conversation and your draft are sent to Claude, and what comes back is a draft you review before anything is sent. Anthropic doesn’t train its models on this data, and we never use Google user data to train or improve AI models.

Sharing and access. We don’t sell Google user data or use it for advertising. We share it only with the service providers above that run Superdesk, and with Anthropic for the AI features described here. Nobody at Superdesk reads it unless you ask us to (for example, to help with a support request), it’s needed for security, or the law requires it.

Storage and deletion. Google user data is stored in our database, hosted by Supabase in the US and encrypted in transit and at rest. The tokens that let Superdesk reach your Google account are encrypted separately, and deleted when you disconnect. You can disconnect Gmail, Calendar, or Drive in Settings at any time, which stops Superdesk from using that connection, and you can remove Superdesk’s access completely in your Google Account settings. After you disconnect Gmail, email already in Superdesk stays so your event history stays complete: the body of any message not linked to an event is deleted 90 days later, while its sender, recipients, subject, date, and a short preview stay until you delete your account or ask us to delete them. Disconnecting Google Calendar removes the events we copied from it and the events Superdesk added to it. Nothing in your Drive is changed. To have everything deleted sooner, email us (see Your rights).

Superdesk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights

  • Access and export: email us and we’ll send you everything we have about you.
  • Deletion: email us and we’ll delete your account and associated data within 30 days. Some records (like invoices) may be retained longer to meet accounting obligations, and the fingerprint of a card that started a free trial is kept so that card can’t start another (see Payment data above).
  • Correction: most account data you can edit yourself in-app.

Reach us at hello@superdesk.app.

Cookies

We use cookies to keep you signed in, and PostHog sets its own cookies for the product analytics described above, never on the pages your clients open. We don’t use advertising cookies. Analytics can’t be switched off in the app; if you’d like your analytics data deleted, email us and we’ll delete it.

Changes to this policy

If we change this policy in any material way, we’ll email you at least 14 days before the change takes effect.

Contact

Questions? Email hello@superdesk.app.