Privacy Policy

This Privacy Policy explains what information Superpower Discovery ("we", "us") collects when you use the Service, how we use it, who we share it with, and the choices you have. It is maintained by us to answer common privacy questions; it is not a legal opinion or an independent certification.

1. Information We Collect

We collect the following categories of information:

• Account information — your email address and (optionally) display name, collected when you sign up. If you sign in with Google or Apple, we receive your name and email address from that provider.
• Content you create — the answers, prompts, and edits you submit, plus the AI-generated outputs produced for your account (positioning, personas, transformations, offers, roadmap, add-ons).
• Billing information — Stripe processes your card details directly; we never see or store your full card number. We store the Stripe customer/session identifiers, purchase amounts, credit balances, and ledger entries.
• Signup signals — to prevent abuse of free credits, we store a salted hash of your IP address and browser user-agent at signup, along with your country. We do not store the raw IP or user-agent.
• Operational logs — server logs, error reports, and basic request metadata used to keep the Service running and secure.

2. How We Use Information

• to create and maintain your account and authenticate you;
• to generate AI content in response to your requests;
• to process payments, grant credits, and issue receipts;
• to prevent fraud, abuse of free credits, and violations of our Terms;
• to communicate service updates, security alerts, and support responses;
• to improve reliability and performance of the Service.

We do not sell your personal information, and we do not use Your Content to train foundation models offered to other customers.

3. AI Processing

Your prompts and the outputs generated for you are sent to third-party AI providers through the Lovable AI Gateway to produce responses. Those providers process the data on our behalf under their own terms. We do not send your billing information to AI providers.

4. How We Share Information

We share information only with service providers acting on our behalf:

• Supabase — database, authentication, and storage;
• Stripe — payment processing;
• Lovable AI Gateway and its upstream model providers — AI inference;
• Hosting and CDN providers that deliver the app to your browser.

We may also disclose information when required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).

5. Data Storage and International Transfers

Your data is stored on infrastructure operated by our providers, which may be located outside your country of residence, including the United States and the European Union. By using the Service you understand that your information may be transferred to and processed in those jurisdictions. Where required, we rely on standard contractual clauses or equivalent safeguards.

6. Retention

We keep account data and Your Content while your account is active. If you delete your account, we remove your personal data and content within 30 days, except where we must retain records for legal, tax, or fraud-prevention purposes (for example, invoices and payment records typically retained for up to 7 years).

7. Security

We use industry-standard measures including encryption in transit (HTTPS), row-level security on user data, hashed passwords, and access controls. No online service can be guaranteed 100% secure; if you believe your account has been compromised, contact us at security@superpowerdiscovery.com.

8. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. In the United States, residents of certain states (including California) have additional rights under laws such as the CCPA/CPRA. In the European Union and Spain, residents have rights under the GDPR. In Indonesia, residents have rights under the Personal Data Protection Law (UU PDP).

To exercise any of these rights, email privacy@superpowerdiscovery.com from the address associated with your account. We will respond within the time required by applicable law.

9. Cookies and Similar Technologies

We use strictly necessary cookies and local storage to keep you signed in and remember your preferences (for example, theme and language). We do not currently use advertising or cross-site tracking cookies.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced through the Service or by email. The "Last updated" date at the top of this page indicates when the current version took effect.

12. Contact

Privacy questions or requests: privacy@superpowerdiscovery.com.