# Privacy

> What we collect, which companies handle it for us, how long it is kept, and how to get a copy or have it deleted. Plain words, not reviewed by a lawyer.

What we collect, who handles it, how long we keep it, and how to get a copy or have it deleted. This page has not been reviewed by a lawyer. Last updated 21 October 2026.

## What we collect

- **Your account.** Your email address and name, through sign-in, which WorkOS runs for us. A password you sign in with is passed to WorkOS and not stored by us.
- **What you publish.** The files of every artifact your agent publishes, every version of them, and who you have shared each one with.
- **What visitors submit to your artifacts.** Answers, entries and anything else a visitor types into an artifact you published. We hold it for you, the artifact's owner, and use it for nothing else.
- **Comments.** Comments left on artifacts, and any screenshot attached to one.
- **Billing.** Stripe takes your card and bills it. We never see your card number; we keep your plan and whether it is paid.
- **Messages to us.** What you send through the contact form or to a support address: your name, your email and the message. The team reads them in an email inbox and in Slack.
- **Product analytics.** Through PostHog: the pages you view and what you click on superartifacts.app, how fast pages load, and a recording of some sessions with everything you type masked. When you are signed in, these are tied to your account id, email and name.
- **Visits to artifacts.** The edge counts views of each artifact for its owner. A visitor's IP address is turned into a one-way digest for that count and is not stored.

## What we do not do

We do not sell anybody's data. Nothing on this platform runs a model over your artifacts or what they collect: every byte of an artifact comes from your own agent.

## Who handles it

A short list of companies runs parts of the service for us: the database, hosting, sign-in, billing, email and analytics. [Subprocessors](https://pr-1478-stg.superartifacts.app/subprocessors.md) names each one, what it does for us and what of yours it sees.

## How long we keep it

Your account, and everything in it, for as long as the account exists. An artifact and what it collected until you delete it. Messages to us until you ask us to delete them; nothing removes them on a schedule yet.

Request logs expire within days. Database backups roll off within about a week. Stripe keeps invoices for six years, because tax law asks for them.

## Deleting things

You can delete any artifact yourself, now, from the dashboard. That removes every version and file and empties everything visitors submitted to it at once; the empty record that a submission existed is removed within 30 days.

Deleting a whole account is not a button yet. Email [privacy@superartifacts.app](mailto:privacy@superartifacts.app) from the address you sign in with and we do it by hand, within 30 days. Deleting a workspace closes it, but nothing purges a deleted workspace's data on a schedule yet, so ask us for that too.

What we cannot fully delete:

- **Stripe invoices.** Kept for six years for tax.
- **Request logs.** Expire on their own within days.
- **Database backups.** Roll off within about a week.
- **Cached copies of public artifacts.** A version that was public may sit in a cache or a search engine for a while.
- **Copies other people made.** Anything someone saved or copied from a public artifact is theirs.
- **Slack messages already posted.** A contact message or alert that reached the team's Slack stays there.

## Your rights

Email [privacy@superartifacts.app](mailto:privacy@superartifacts.app) to ask for a copy of what we hold about you, to correct it, or to delete it. We answer within 30 days.

## About this page

It is written to be true, in plain words, and has not been reviewed by a lawyer. When it changes, the date at the top changes with it. Questions go to [privacy@superartifacts.app](mailto:privacy@superartifacts.app).