Privacy Policy

We process personal information only for the following purposes:

1. Account management: confirming sign-ups, identifying and authenticating users, preventing abuse, and sending notices
2. Providing the Service: creating and running surveys, generating reports, and managing team members and permissions
3. Paid plans: managing plans and subscriptions, confirming payments, recording consent before a free trial converts to paid, processing refunds, and sending billing notices (free-trial ending reminders and cancellation confirmations)
4. Usage limits: counting each team’s reports
5. Support: reviewing and answering inquiries
6. Reliability and security: diagnosing errors and responding to security threats
7. Improving the Service: analyzing how the Service is used

We do not use the materials you upload to train AI models.

For users in the EEA and the UK, our lawful bases are: performance of our contract with you (account, team, survey and usage data; for paid plans, sending the payer’s email to Polar and sending billing notices); our legitimate interests in keeping the Service secure and letting teams invite colleagues (security records and invitee email addresses); our legitimate interest in understanding how the Service is used (usage analytics, for which we set no analytics cookies in the EEA, the UK or Switzerland); your consent (inquiries sent through the contact form), which you may withdraw at any time; and our legal obligations (payment and refund records).

We collect the following information:

1. Account
   • Email sign-up: email address, password, name, company name
   • Google sign-in: email address, Google account ID, name, company name
   • A password set in account settings (including members who signed up with Google or a sign-in link): password (optional)
2. Team invitations: the invitee’s email address
3. Paid plans: the email address of the team owner who pays, the plan and billing cycle, subscription and order identifiers and status, the billing period, payment and refund dates, amounts and currency, records of billing notifications received from Polar (notification identifier and type), records of consent before a free trial converts (who consented, when, and the notice shown), records of acceptance of the Terms and refund rules (who accepted, when, the terms version and the screen language), and refund request records (who requested it and how the amount was calculated). Polar collects your card and other payment details directly on its checkout page. We do not receive your card or other payment method details. Billing notices are sent to the team owners’ email addresses we already hold from sign-up.
4. Inquiries
   • Contact form (collected with your consent): email address, inquiry type and message; name (optional)
   • Email sent to a supersona.space address: sender’s email address and name, subject and body

When you use the Service, we may automatically collect your IP address, access times, device and browser information, cookies, usage records (pages visited and interactions, surveys and reports created, report counts) and error logs. We load fonts from the jsDelivr CDN, which receives your browser’s IP address.

Images and text you add to a survey are processed only to provide the Service. Please do not include other people’s personal or sensitive information in them.

We do not collect government identification numbers or sensitive information, and we do not knowingly collect personal information from children under 14.

We keep personal information for the following periods:

1. Account information: until you close your account, or until any legal investigation involving it has ended
2. Surveys, uploaded images and reports: until the team is deleted or you close your account
3. Team invitations: 14 days from sending, or until accepted
4. Inquiries: one year from our reply (one year from receipt if unanswered)
5. Usage records: as long as needed to calculate usage limits and confirm billing
6. Payment and refund records, records of billing notifications received from Polar, records of acceptance of the Terms and refund rules, refund request records, and free-trial conversion consents: 5 years (Article 6 of Korea’s Act on the Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree)
7. Audit records: kept with email addresses masked for as long as the Service operates, including after you close your account, to prevent abuse and resolve disputes
8. Usage analytics: up to 14 months from collection

When information is no longer needed, we delete it without delay using methods that prevent recovery. If another law requires us to keep it, we store it separately for the required period.

We do not sell or share your personal information with third parties, except with your consent or where required by law.

When you pay for a paid plan, you enter your payment details directly on Polar’s checkout page, and Polar handles them under its own privacy policy.

We use the following service providers to run the Service:

• Vercel Inc.: web hosting
• Supabase Inc.: authentication and data storage
• OpenAI, L.L.C. / Anthropic, PBC: generating AI persona responses and report analysis
• Google LLC: Google sign-in and usage analytics (Google Analytics)
• Microsoft Corporation: usage analytics (Microsoft Clarity)
• Plus Five Five, Inc. (Resend): sending and receiving email
• Polar Software, Inc.: payment processing, tax calculation and remittance, and receipts for paid plans

Our agreements with these providers restrict their use of personal information to the services they provide to us and require appropriate safeguards.

We transfer personal information outside Korea as follows, as necessary to provide the Service.

You may object to these transfers by contacting us (Section 11). Because the Service cannot run without them, objecting means you will not be able to use the Service. You can opt out of the usage analytics transfers as described in Section 10 and keep using the Service.

You may ask to access, correct or delete your personal information, or to stop its processing, at any time by emailing us. We will act within 10 days of receiving your request and may need to verify your identity first. You may also act through an authorized representative.

These rights may be limited where the law requires us to keep the information. If you have further rights under the law where you live, such as data portability, you can exercise them the same way.

We limit who can access personal information, store passwords with one-way encryption, encrypt data in transit, separate data by team, keep uploaded files private, and protect audit records against tampering. Our infrastructure runs in data centers of certified cloud providers.

We use cookies to keep you signed in, remember your team and language, and understand how the Service is used (Google Analytics and Microsoft Clarity).

We do not use advertising cookies, and we do not collect behavioral information for targeted advertising.

You can block or delete cookies in your browser settings. If you block them, you will not be able to sign in. You can opt out of usage analytics by turning on Global Privacy Control in your browser or installing the Google Analytics opt-out add-on, and still use the Service.

For questions, complaints or requests about your personal information, contact our privacy officer:

• Privacy officer: Jiwon Choi
• Email: privacy@supersona.space
• Contact form: supersona.space/en/contact

When you sign up with email, we automatically check whether your address uses a personal or disposable email domain, and if so we decline the sign-up. Only the domain is checked. You may ask for an explanation or a human review by contacting us (Section 11).

You can contact the following Korean organizations for advice or dispute resolution:

• Personal Information Dispute Mediation Committee: 1833-6972 within Korea (www.kopico.go.kr)
• Privacy Infringement Report Center (KISA): 118 within Korea (privacy.kisa.or.kr)

If you live in the EEA or the UK, you may also lodge a complaint with your local data protection authority.

This policy is effective as of November 4, 2026. We will post changes on the Service at least 7 days before they take effect, or 30 days before for significant changes to your rights.

Previous versions: version effective October 2, 2026 (Korean) · version effective September 27, 2026 (Korean)