Privacy Policy

Who is responsible

Supacode (supacode.io) is operated by Transcend Technologies. Transcend Technologies is the controller of your personal data under this policy.

Privacy contact: info@supacode.io. Write to this address to access, correct, delete or download your data, to object to processing, or with any question or complaint about privacy.

We don't have an office in the EU or the UK. People in the EU, the UK and anywhere else can send every privacy request to info@supacode.io.

What we collect

• Account data: email address, display name, profile picture, language and how you sign in. If you sign in with Google or GitHub, we receive your name, email address and profile picture from them. Passwords are stored only as hashes by our sign-in provider. If you turn on two-step sign-in, we store its setup and salted hashes of your recovery codes.
• Your content: prompts and chat messages, files you upload, generated code, text and images, saved versions of each project and the sites you publish.
• Usage and billing data: AI usage (model, amount of work, credits charged), your credit history, plan and purchases. Card and PayPal details are entered directly with Stripe or PayPal; we never see or store full card numbers.
• Security data: IP address, approximate country, browser and device type (user agent), sign-ins and important actions such as publishing, purchases, data exports or password changes.
• Connections you set up: if you connect GitHub, Supabase or Vercel, we store an access token (encrypted) and the account and project details needed to work with that service.
• Messages and reports: what you send through the contact form or to our email addresses, abuse reports about published sites, and a record of the emails we send you (address, type, subject, date and delivery status).
• Invite data: if you sign up through an invite link, the invite code and, to stop reward abuse, a normalized form of your email address, your IP address and browser type.

Why we use it and our legal basis

• To provide the service you signed up for (contract, Art. 6(1)(b) GDPR): your account and sign-in, building with AI, saving versions, previews, publishing sites and custom domains, credits, plans and payments, and support.
• Based on our legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure, detecting fraud and abuse (including invite abuse and rate limits), fixing errors, understanding how features are used from our own logs (no third-party analytics), sending service emails, and sending product news about Supacode. You can turn product news off at any time in Settings → Notifications or with the link in each email, and you can object to any processing based on legitimate interests.
• With your consent (Art. 6(1)(a) GDPR): tips and marketing emails, which are off until you turn them on and always include an unsubscribe link, and the connections to GitHub, Supabase or Vercel that you choose to set up. You can withdraw consent at any time; this doesn't affect processing that already happened.
• To meet legal obligations (Art. 6(1)(c) GDPR): tax and accounting records for payments, and answering lawful requests from authorities.

AI providers

When you ask Supacode to build or change something, your prompt, the relevant chat history and project files, and any files you attach are sent to an AI provider to produce the result: Anthropic (Claude) for code and text, and Google (Gemini) for generating or editing images.

We use these providers through their paid APIs, under their API terms, which do not allow them to use your data to train their models. They may keep it for a limited time to detect abuse, as those terms allow. We don't use your content to train AI models either.

Stock photo search through Pexels sends only the search terms, never personal data.

Who processes your data

These service providers process personal data on our behalf, under contracts that limit them to our instructions:

• Supabase: database and sign-in. United States (US East).
• Vercel: hosting the app and its servers, and preview sandboxes for Next.js projects. United States (US East).
• Cloudflare: file storage (R2), published sites and custom domains, content delivery, protection against attacks and page screenshots for project thumbnails. Stored in the United States; sites are delivered from Cloudflare's global network.
• Anthropic: AI generation of code and text. United States.
• Google: AI image generation (Gemini) and, if you choose it, sign-in with Google. United States.
• Stripe and PayPal: payments and subscriptions. United States and other countries; for some payment data (such as fraud checks) they act as independent controllers under their own privacy policies.
• Resend: sending email. United States.

Other services and disclosures

• Services you connect or sign in with (GitHub, Google, Supabase, Vercel) receive what is needed for the action you start, such as code you push or a database you link, and handle it under their own terms and privacy policies.
• When you publish, the public addresses of your pages may be sent to search engines through IndexNow. When you add a custom domain, we look up its DNS records through Cloudflare. Neither includes personal data about you.
• A small team of Supacode staff can access account data when needed for support, billing, security or abuse handling. Staff actions are recorded in an audit log.
• We disclose data to authorities only when the law requires it. If Supacode is ever sold or merged, your data may transfer to the new owner under this policy, and we will tell you first.
• We don't sell your personal information and we don't share it for cross-context behavioral advertising.

International transfers

Our servers and providers are mainly in the United States, so data from the EU, the UK and Switzerland is transferred to the US. We protect these transfers with the European Commission's Standard Contractual Clauses (with the UK and Swiss additions where needed) and, where a provider is certified, with the EU-US Data Privacy Framework and its UK and Swiss extensions.

How long we keep it

• Account data: until you delete your account. Deletion is immediate: your profile, projects, versions, chats, credit history and connections are deleted, your sites go offline and any paid plan is cancelled. Stored files are then removed by the storage cleanup described below.
• Deleted projects: they stay in Recently deleted for 30 days so you can restore them, then they are permanently deleted. Their stored files are removed by our regular storage cleanup once no other project or published site uses them.
• Chats and messages: kept with their project and deleted with it.
• Security logs: full IP addresses are shortened after 90 days (the last part is removed). Log entries are kept for security and fraud prevention and are no longer linked to you after you delete your account.
• Invite records: kept after account deletion, without the link to your account, so the same person can't collect invite rewards twice.
• Support messages, abuse reports and our record of sent emails: kept as long as needed to handle them and as a record, and no longer linked to your account after deletion.
• Payment and tax records: kept by us and by Stripe or PayPal as long as tax and accounting law requires, usually up to 7 years.
• Backups: our database provider keeps rolling backups for a short period; deleted data disappears from them as they are replaced.

What is public

Projects are private by default. Sites you publish and projects you share in the gallery are public, together with your display name and profile picture on gallery projects. Your chat history is never public.

Your rights

• Access and portability: download your data at any time in Settings → Account & security → Download your data (a zip with your account, credit and usage history, chats and project files), or ask us for a copy.
• Correction: change your name, picture and email in Settings, or ask us to correct anything else.
• Deletion: delete projects yourself, or your whole account in Settings → Account & security → Delete account. You can also ask us by email.
• Restriction and objection: ask us to limit processing, or object to processing based on our legitimate interests, including product news.
• Withdraw consent: change your emails in Settings → Notifications or use the unsubscribe link, and disconnect services in Settings → Connections.
• No solely automated decisions: we don't make decisions with legal or similarly significant effects about you by automated means alone. Automatic checks such as rate limits or invite-abuse checks can pause a feature; you can ask a person to review them.
• Complaints: you can complain to the data protection authority where you live or work (in the UK, the ICO). We'd appreciate the chance to help first at info@supacode.io.
• California and other US states: you have the right to know, access, correct and delete your personal information, and not to be treated differently for using these rights. We don't sell or share personal information. You can use an authorized agent.
• How to use your rights: use Settings, or email info@supacode.io, ideally from the email address of your account. We may ask you to confirm your identity, and we reply within 30 days.

Cookies and similar technologies

We use only essential cookies and browser storage: cookies that keep you signed in, and browser storage (localStorage) that remembers your theme and small display choices such as dismissed notices. We use no advertising cookies. Analytics cookies are used only if you agree: when Google Analytics is turned on for supacode.io, a banner asks first, and Google Analytics (Google LLC, which may process the data in the United States) loads only after you choose Accept, and only on our public pages, never in the studio, your settings or the sites you publish. It records pages viewed, approximate location and device type. If you choose Decline, nothing is loaded, and your choice is remembered in browser storage on this device; clearing it lets you choose again.

If you open a friend's invite link, a first-party cookie (sc_ref) remembers their invite code for up to 30 days so your sign-up can credit them; it is deleted when you sign in and never shared with third parties.

Security

• All connections use encryption in transit (HTTPS).
• Access tokens for connected services are encrypted at rest (AES-256), and database access is limited per account.
• Two-step sign-in is available, and Settings shows your recent sign-ins and security changes.
• Staff access is limited and logged in an audit log; previews and published sites run on separate domains from the app.
• If a data breach puts your rights at risk, we will tell you and the authorities as the law requires.

Your sites and their visitors

If a site you build collects data from its visitors (for example through a form or a database you connect), you are responsible for that data and for your site's own privacy notice. Cloudflare processes visitors' IP addresses to deliver and protect published sites.

To show site owners simple visitor statistics, the service that delivers published sites counts page views: which page was opened, the referring website (its domain only), the country (worked out from the IP address) and whether the device is a phone or a computer. To estimate unique visitors per day, it turns the IP address and browser type into a short one-way code together with the date and a secret key, so the code changes every day and differs per site; the IP address and browser details themselves are not stored. No cookies, browser storage or fingerprinting are used, and visits from browsers that send Do Not Track or Global Privacy Control, and from known bots, are not counted. These counts are kept in Cloudflare Analytics Engine (United States) for 3 months, and daily totals are kept with the project and deleted with it. We use them only to show them to the site's owner (legitimate interests, Art. 6(1)(f) GDPR).

Children

Supacode is not meant for children under 16, or under the age of digital consent where they live if that is higher. We don't knowingly collect their data; if we learn that we have, we delete it.

Changes

We update this page when our practices change and show the date at the top. We tell you about significant changes by email before they take effect.