Privacy Policy

01

Account data

We collect the information needed to create and secure your workspace: name, email, company, password metadata, billing state, settings, team membership, and security preferences.

02

Customer conversations

When SuperBot is installed on a website, the platform may process visitor messages, chat transcripts, lead details, routing decisions, widget events, and support handoff context configured by the workspace owner.

03

Training sources

Workspace users can provide public website URLs, pasted text, policies, FAQs, product details, service rules, published help articles, and page text imported through a platform app such as the Webflow Designer extension. SuperBot uses those sources to produce grounded answers for that workspace only.

04

Usage data

We collect operational telemetry — page paths, device metadata, timestamps, feature usage, error logs, and security events — to keep the service reliable, prevent abuse, and improve product performance.

05

Product analytics

On superbotapp.ai and in the SuperBot dashboard we use PostHog (posthog.com), a product analytics provider, to understand how people find and use SuperBot: pages viewed, sign-up steps, features used, errors, and, for some sessions, a replay of the dashboard screen with every form field masked. Signed-in dashboard activity is linked to your account. This data is sent through our own domain, is used only to improve SuperBot, and is never sold or used for advertising. Install, uninstall and plan-change events from our platform apps (Shopify, Wix, WordPress, Webflow, Squarespace, Square, WooCommerce and Adobe Commerce) are recorded on our own servers and in PostHog. The chat widget on your website does not load PostHog, and your visitors are not recorded. Email support@superbotapp.ai to have your analytics data deleted.

06

Billing data

Payment details are handled by our payment processors (Lemon Squeezy and PartnerStack). We store subscription identifiers, billing status, plan information, and transaction metadata needed to manage free and paid access.

07

How we use data

We use data to run the product, authenticate users, deliver AI support workflows, route conversations, provide analytics, respond to support requests, improve reliability, and protect the service from abuse.

08

AI processing

SuperBot uses configured knowledge and conversation context to generate answers for the customer workspace. Customer workspace content is not sold and is not used to train public foundation models.

09

Sharing and vendors

We do not sell personal data. We share data only with infrastructure, analytics, security, billing, email, support, and AI subprocessors needed to operate the service — under contractual safeguards.

• Cloud infrastructure for hosting and storage
• AI inference providers under data-processing agreements
• Email and notification senders for transactional messages
• Analytics for product improvement (no third-party ad networks)

10

Retention

We keep account, conversation, analytics, and billing records as long as needed to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and support customer operations.

11

Deletion requests

Customers can request deletion of account-level data, subject to security, fraud-prevention, legal, billing, backup, and contractual retention requirements. Email support@superbotapp.ai.

12

Security controls

We use HTTPS/TLS, encrypted stored integration credentials, scoped workspace queries, secure cookies, rate limits, operational monitoring, and role-based access controls to reduce risk. Workspaces are isolated at the application and data-query layers.

13

Webflow App data

The SuperBot Webflow App has two parts: a connection service that installs the chat widget through Webflow's Custom Code API, and a Designer extension that can import page text. The connection service requests four permissions and uses each for one purpose: sites:read to identify the sites you authorize and read their name and published domain; custom_code:read and custom_code:write to add, update and remove SuperBot's own widget script without changing other code on your site; and authorized_user:read to read the installing user's name and email so your SuperBot workspace can be created or matched. It does not read or import your Webflow CMS collections, form submissions, customers, orders or assets.

• At installation: SuperBot receives each authorized site's id, name, Webflow workspace id and published domain, plus the installing user's name and email. The site id, name, domain, email and name are used to create or match your SuperBot workspace. The connection service stores the site id, site name, Webflow workspace id, published domain, the granted permissions, the installing user's email, your SuperBot workspace id, the id, version and status of the script it applied, and the Webflow access token
• Webflow access token: encrypted at rest with AES-256-GCM, stored only on SuperBot's servers, and used only for server-to-server calls to Webflow. It is never sent to your browser, to the Designer extension or to the widget. It is deleted when you choose Disconnect (which also revokes it with Webflow) and when Webflow stops accepting it after you uninstall the App or revoke access. Webflow does not notify apps of an uninstall, so SuperBot checks each stored token about once an hour and deletes it as soon as Webflow rejects it
• Designer extension, when opened: reads your site's id and name through the Webflow Designer API and asks Webflow for a short-lived identity token, then sends the site id and that token to SuperBot to confirm you are the user who connected the site and to show its connection status. The identity token is checked with Webflow and is not stored
• Designer page import: only when you choose Read current page does the extension read the current page's static text through the Designer API; this preview stays in the extension. Only when you choose Save page text does SuperBot receive that text (up to 50,000 characters), the page name, the page id and the site id. Dynamic CMS content, embeds and text in images are not read. SuperBot does not crawl your published site and never changes or publishes your pages
• Imported page text is stored in your SuperBot workspace as a knowledge document used to answer your visitors' questions. Saving the same page again replaces it. It is kept until you delete it from Knowledge in your SuperBot dashboard or your SuperBot account is deleted. Disconnecting or uninstalling the App does not delete imported page text, your workspace or its conversations
• Disconnect and uninstall: Disconnect removes SuperBot's script from your site's custom code, revokes the App's Webflow access, deletes the stored token and deletes the installing user's email from the install record. Uninstalling the App in Webflow ends SuperBot's access immediately; the stored token and email are then deleted by the check described above. In both cases the widget stays on your live site until you publish the site. A minimal record (site id, site name, domain, SuperBot workspace id, script status and dates) is kept so that reconnecting links the site to the same workspace; it is deleted when your account is deleted or when you ask us to delete it
• Account deletion: email support@superbotapp.ai. Deleting your SuperBot account deletes your workspace, including imported Webflow page text, knowledge, conversations and the site-to-workspace link, and we also delete the App's install record for your sites, subject to the backup and legal retention described above
• The widget: the App applies one versioned script hosted on superbotapp.ai, registered with a Subresource Integrity hash so browsers refuse any altered copy, and the script loads one versioned stylesheet protected the same way. Each new widget version is a new file. Visitor messages and the other data the widget handles are covered by the Customer conversations, Usage data and AI processing sections. The widget sets first-party cookies on your site to recognise returning visitors: on Webflow sites these hold only a random visitor id and a flag that the visitor already rated a chat, and last one year. A name, email address or phone number a visitor types into the widget is kept in that page’s memory only, never in a cookie or browser storage, and is sent to SuperBot only with the form the visitor submits it in (for a pre-chat form, with the visitor’s next message). Images in the widget load only from superbotapp.ai, your own site and Webflow’s asset hosts. Depending on the features you enable, the widget depending on the features you enable it may show a Cloudflare Turnstile spam check in a SuperBot-hosted frame, send an order number and email to the order-tracking endpoint you configure, open a video or voice call in a new tab on a meeting service (Jitsi Meet by default), or use the visitor's browser speech recognition for voice input

14

Your choices

You can update account details, manage workspace settings, configure notification preferences, remove training sources, export relevant records, and request support for any privacy question.