What we collect, and what we keepWhat we collect, and what we keep

Your account

Your email address and name, through sign-in, which WorkOS runs for us. A password you sign in with is passed to WorkOS and not stored by us.

What you publish

The files of every artifact your agent publishes, every version of them, and who you have shared each one with.

What visitors submit to your artifacts

Answers, entries and anything else a visitor types into an artifact you published. We hold it for you, the artifact’s owner, and use it for nothing else.

Comments

Comments left on artifacts, and any screenshot attached to one.

Billing

Stripe takes your card and bills it. We never see your card number; we keep your plan and whether it is paid.

Messages to us

What you send through the contact form or to a support address: your name, your email and the message. The team reads them in an email inbox and in Slack.

Product analytics

Through PostHog: the pages you view and what you click on superartifacts.app, how fast pages load, and a recording of some sessions with everything you type masked. When you are signed in, these are tied to your account id, email and name.

Visits to artifacts

The edge counts views of each artifact for its owner. A visitor’s IP address is turned into a one-way digest for that count and is not stored.

We do not sell anybody’s data. Nothing on this platform runs a model over your artifacts or what they collect: every byte of an artifact comes from your own agent.

A short list of companies runs parts of the service for us: the database, hosting, sign-in, billing, email and analytics. Subprocessors names each one, what it does for us and what of yours it sees.

Your account, and everything in it, for as long as the account exists. An artifact and what it collected until you delete it. Messages to us until you ask us to delete them; nothing removes them on a schedule yet.

Request logs expire within days. Database backups roll off within about a week. Stripe keeps invoices for six years, because tax law asks for them.

You can delete any artifact yourself, now, from the dashboard. That removes every version and file and empties everything visitors submitted to it at once; the empty record that a submission existed is removed within 30 days.

Deleting a whole account is not a button yet. Email privacy@superartifacts.app from the address you sign in with and we do it by hand, within 30 days. Deleting a workspace closes it, but nothing purges a deleted workspace’s data on a schedule yet, so ask us for that too.

What we cannot fully delete:

Stripe invoices

Kept for six years for tax.

Request logs

Expire on their own within days.

Database backups

Roll off within about a week.

Cached copies of public artifacts

A version that was public may sit in a cache or a search engine for a while.

Copies other people made

Anything someone saved or copied from a public artifact is theirs.

Slack messages already posted

A contact message or alert that reached the team’s Slack stays there.

Email privacy@superartifacts.app to ask for a copy of what we hold about you, to correct it, or to delete it. We answer within 30 days.

It is written to be true, in plain words, and has not been reviewed by a lawyer. When it changes, the date at the top changes with it. Questions go to privacy@superartifacts.app.