Privacy policy

SuperCampaign operates the website at supercampaign.ai and the SuperCampaign application at app.supercampaign.ai. This policy covers both. It also explains how we handle information about the people our customers contact through the application, which we process on our customers' behalf.

Questions about anything here go to hello@supercampaign.ai.

This website sets no cookies of its own. Here is what it does collect, and where each piece goes.

• Demo-call form. If you enter your phone number to request a demo call, we collect the number, an optional first name, and the campaign tags in the page's address (UTM parameters). We send these to the SuperCampaign application, which creates a contact record and places one automated call from our AI agent. Your IP address is used for about an hour, in memory only, to limit repeated requests; it is not stored.
• Demo booking. The calendar on our demo page is provided by Calendly. Anything you enter there is collected by Calendly under Calendly's privacy policy and shared with us so we can hold the meeting.
• Analytics. We use Vercel Web Analytics, which does not use cookies and does not identify you. It records page views, the referring site, country, device type and browser, in aggregate.
• Email. If you email us, we keep the correspondence for as long as we need it to reply and to keep a record of the conversation.

When you create a SuperCampaign account and run campaigns, the application processes the following.

• Account data: your name, email address, a hashed password or Google sign-in identifier, and the organization you belong to.
• Contacts you add: names, phone numbers, email addresses, companies, tags, list membership, and the activity history for each contact, including every call, text and email sent to them and its outcome.
• Call content: transcripts and outcome data returned by your voice provider after each AI call. Whether a recording exists depends on how your voice provider account is configured; we store what it returns to us.
• Message content: the text of SMS and email messages you configure and send.
• Provider credentials: API keys and tokens for the accounts you connect, such as Vapi, Twilio, Calendly, Google, iClosed, SendGrid and Resend. These are encrypted at rest and can only be changed by users with the appropriate role in your organization.
• Operational logs: workflow runs, step results and errors, which we use to run and support the service.

• To provide the service: run your campaigns, place calls and send messages through the providers you connected, and show you what happened.
• To place the demo call you asked for, and to follow up on it.
• To respond when you contact us.
• To keep the service secure, detect abuse, and debug problems.
• To understand how the website is used, in aggregate, so we can improve it.

We do not sell personal information, and we do not use customer contact data for our own marketing.

If you received a call, text or email from a SuperCampaign customer, that customer decided to contact you and is responsible for having a lawful basis to do so. We process your details on their behalf.

If you tell the AI agent on a call that you do not want to be contacted, the application marks you as do-not-call for that customer automatically. You can also reply STOP to a text where the customer's messaging provider supports it, or contact the customer directly.

If you cannot reach the customer, email hello@supercampaign.ai with the number that was called and we will help.

We use a small number of providers to run the website and the application. They process data only on our instructions.

• Vercel hosts this website and provides its analytics.
• Calendly provides demo scheduling.
• Cloud infrastructure providers host the application, its database and its job queue.

Separately, the application connects to accounts that you own and control: your voice provider, your telephony provider, your calendars and your email providers. Data sent to those providers is governed by your agreements with them, not by this policy. You choose which to connect and can disconnect them at any time.

Account and campaign data is kept while your account is active and for a short period after it closes, so you can recover it if you change your mind, after which it is deleted.

Demo-call details are kept so we can follow up. Email us if you would like them removed sooner.

Aggregate analytics contain no personal data and are retained by Vercel under its terms.

You can ask us to show you the personal data we hold about you, correct it, or delete it. Email hello@supercampaign.ai and we will respond within a reasonable time. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA; we will honour them.

If you are a customer, most account and contact data can be edited or deleted directly in the application.

Data travels over TLS. Provider credentials are encrypted at rest. Access inside the application is controlled by organization roles. Webhooks from providers are signature-checked, and every step in a campaign carries an idempotency key so a retry never sends a message twice.

No system is perfectly secure. If you believe you have found a vulnerability, email us and we will take it seriously.

The website and the application are for businesses and are not directed at anyone under 18. We do not knowingly collect data from children.

When we change this policy we update the date at the top. If a change materially affects how we handle your data, we will tell customers by email.

SuperCampaign, hello@supercampaign.ai.