Privacy Policy

Thank you for taking the time to read our privacy policy (the “Privacy Policy”). At Superset Labs PBC (“Superset,” “we,” “our,” or “us”), your privacy is of the utmost importance. We want you to be fully informed about the information we collect, use, share, and protect personal information, as well as understand your privacy choices.

Superset operates an online service designed to help our customers (“Customers”) manage their privacy practices with respect to end consumers (“Consumers”), including but not limited to managing their privacy inbox, process DSRs including via California’s DROP, register as a data brokers, and more (collectively, the “Services”).

This privacy policy sets out how we collect, use, process, store, and disclose personal information on https://trustsuperset.com or any website of ours that links to this Privacy Policy (the “Website”) and in providing the Services.

TABLE OF CONTENTS

1. WHEN WE COLLECT INFORMATION
2. CATEGORIES OF PERSONAL INFORMATION WE COLLECT
3. BUSINESS PURPOSES FOR COLLECTING PERSONAL INFORMATION
4. HOW WE DISCLOSE PERSONAL INFORMATION
5. ARTIFICIAL INTELLIGENCE DISCLOSURE
6. PRIVACY CHOICES
7. COOKIES AND OTHER TRACKING TECHNOLOGIES
8. SECURITY
9. RETENTION
10. U.S. STATE-SPECIFIC NOTICE
11. UK/EEA RESIDENTS NOTICE
12. CHILDREN’S PRIVACY
13. THIRD-PARTY LINKS
14. CHANGES TO THIS PRIVACY POLICY
15. CONTACT US

1. WHEN WE COLLECT INFORMATION

We may collect personal information that you provide when you:

• Visit our Website;
• Register and/or login through our Website;
• Use our Services;
• Sign up for our email newsletter or other communications;
• Engage with us in other related ways, including any sales, marketing, or events; and
• Contact us.

2. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

Customer Information:

In order to serve our Customers, we will collect various information from, or about, our Customers, including:

• Professional contact information including your name, job title, company email, mailing address, company name, company website URL.
• Contact preferences and correspondence information, which may include any personal information provided during an email correspondence or Customer service engagement.
• Billing and administrative finance information.
• Automated information, including metadata and analytics for your use of our Website and Services, including cookie IDs, IP address, device information, date/time of visits, new or returning visits, products viewed, page response times, URL clickstreams, how long you stay on our pages, what you do on those pages. Learn more about our cookie use below. In addition, we may derive your coarse location from your IP address.

Consumer Information:

When our Customers use our Website and Services, they may enable us to process various types of personal information on Consumers. Below, we provide a list of the commonly processed personal information of Consumers. Please note, the below list is not exhaustive of all personal information, and is intended to serve as a sample set.

• Consumer information made available to us to help our Customers process requests via California’s DROP mechanism such as name, email, date of birth, phone number, zip code, mobile advertising ID, and Connected TV ID.
• Information about Consumers submitted in a data subject request such as name, physical address, email address.
• Information Consumers provide when they reach out to us in our capacity as our Customer’s EU and/or UK representative.

We do not intend to collect or process Consumer sensitive personal information, however, we may obtain sensitive personal information or special category data provided by Consumers when a Consumer submits in a data subject request.

3. BUSINESS PURPOSES FOR COLLECTING PERSONAL INFORMATION

We may use personal information for the following business purposes:

• To provide and improve our Website and Services.
• To communicate with you.
• To process payments securely.
• For customer support, including email, phone, and chat.
• To send our Customers marketing and promotional communications in accordance with individual marketing preferences.
• To authenticate, verify or otherwise ensure compliance with Customer written instructions or to mitigate the risk of fraud.

For any legal purpose necessary, including intellectual property protection, or if we are required to process information as a result of a court order or other legal or regulatory proceeding.

We may otherwise use personal information with your consent.

We may also use aggregated and/or anonymous information for any purpose.

4. HOW WE DISCLOSE PERSONAL INFORMATION

We utilize various service providers to operate our Website and Services, which may include sharing Customer and/or Consumer personal information. Some of the types of service providers include:

• Communications providers, including Google Workspace and beehiiv for email communications.
• Banking and payment processing providers.
• Artificial intelligence providers to support our Services. See below for more information.
• Service providers that help manage and optimize our Website and Services (see ‘Cookies and Other Tracking Technologies’ below).

In addition, we may share personal information in order to:

• Protect the legal rights of our Customers, our company, our employees, our agents, and our affiliates.
• Protect the safety and security of those who access and use our Website and Services.
• Detect and protect against fraud.
• Comply with law or legal process.
• Conduct due diligence or complete a legal transaction related to the sale of our business or any assets.

We may disclose de-identified, aggregate, or anonymous information for any purpose. This means that the information does not identify specific individuals.

5. ARTIFICIAL INTELLIGENCE DISCLOSURE

Superset uses various third-party artificial intelligence tools to enable and improve our Services, including:

• Use of third-party service providers. Superset uses OpenAI to assist with enabling and improving our Services. Our commercial terms with OpenAI limit the scope of their personal information processing activities to exclusively support our Services, and they are commercially restricted from using the content of our Customers’ User chats for their own product improvement purposes. For more information, visit OpenAI’s terms of use.
• Aggregated and anonymous insights. Superset may use artificial intelligence tools to create aggregated insights or engage in other market research activities that benefits our Customers, potential advertisers, or other relevant parties. Any such processing activities will maintain strict confidentiality for User personal information.

6. PRIVACY CHOICES

You may have the following privacy rights:

• Access the personal information we maintain about you.
• Delete the personal information we maintain about you. Please note we may be required by law to retain certain information in compliance with accounting, tax or other legal obligations.
• Correct inaccurate personal information we maintain about you
• Opt out of certain uses of your personal information, notably to opt out of marketing e-mail communications, you may click the ‘unsubscribe’ link in the marketing emails.

You can exercise these rights by contacting us at [email protected].

If you are a Consumer or current or former employee of one of our Customers, and you would like to exercise your rights with respect to the personal information we maintain about you on behalf of that Customer, we encourage you to exercise these rights by reviewing the Customer’s privacy policy to determine the correct contact method for that Customer. Alternatively, if you email us at [email protected] and identify the Customer that is utilizing our Services, we can forward your request to the appropriate contact.

7. COOKIES AND OTHER TRACKING TECHNOLOGIES

Like many companies, we use cookies, pixels, and other tracking technologies to collect information about your interactions with our Website. We currently do not enable the use of third-party pixel tags or cookies for advertising purposes, but may do so in the future. Please check back periodically if you would like to review and/or opt out of these future uses.

Opt-Out Preference Signals. Some browsers and browser extensions transmit opt-out preference signals, such as the Global Privacy Control (“GPC”), that communicate your choice to opt out of the sale or sharing of your personal information. We recognize and honor the GPC signal on our Website. When your browser transmits a GPC signal, we record that signal along with the page you were visiting at the time, so that we can give effect to your choice. As described in the ‘U.S. State-Specific Notice’ section below, we do not sell or share your personal information for monetary benefit or for cross-context behavioral advertising.

8. SECURITY

We maintain reasonable safeguards to protect against unauthorized access, use, modification, and disclosure of personal information in our custody and control. Despite our efforts, we cannot guarantee that unauthorized access or use will never occur. It is important that you take steps to keep your information safe and secure. Choose an account password that is hard for others to guess and don’t reveal it to third parties. If you use a shared public computer, do not opt to have your login ID or password remembered and be sure to log out of your account when you finish.

9. RETENTION

We will retain personal information for the duration of the agreement with our Customer(s) or otherwise as described in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

10. U.S. STATE-SPECIFIC NOTICE

Some U.S. states have enacted comprehensive privacy laws. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act or “CPRA” (collectively, the “CCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Oregon Consumer Privacy Act (“OCPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Montana Consumer Data Privacy Act (“MTCDPA”), the Iowa Consumer Data Protection Act (“IADPA”), the Delaware Personal Data Privacy Act (“DEPDPA”), the Nebraska Data Privacy Act (“NEDPA”), the New Hampshire Privacy Act (“NHPA”), the New Jersey Data Privacy Act (“NJDPA”), the Tennessee Information Protection Act (“TNIPA”), the Minnesota Consumer Data Privacy Act (“MNCDPA”), the Maryland Online Data Privacy Act (“MDODPA”), the Indiana Consumer Data Protection Act (“INCDPA”), the Kentucky Consumer Data Protection Act (“KYCDPA”), the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”), the Oklahoma Consumer Data Privacy Act (“OCDPA”), the Louisiana Data Privacy Act (“LDPA”), the Alabama Personal Data Protection Act (“APDPA”), and the Vermont Data Privacy and Online Surveillance Act (“VDPOSA”) create additional privacy obligations for businesses and provide their residents with additional privacy rights.

Additional Privacy Rights:

In addition to the rights granted in ‘Privacy Choices’ above, if you are a resident of the above states, you may have the right to:

• Opt out of the ‘sale’ or ‘share’ of your personal information for cross-context behavioral or targeted advertising. We do not ‘sell’ or ‘share’ your personal information for monetary benefit. We honor opt-out preference signals, including Global Privacy Control (GPC), as described in ‘Cookies and Other Tracking Technologies’ above.
• Sensitive personal information. We do not intend to collect or process Consumer sensitive personal information, however, we may obtain sensitive personal information provided by Consumers when submitting in a data subject request.

You can exercise these rights by contacting us at [email protected].

Appeal:

You may exercise any privacy request in the ‘Privacy Choices’ section above. If we deny your privacy request, you may appeal that decision by emailing us at [email protected]. We will respond to your appeal within a reasonable period of time and as required by law. If, after we have processed your appeal, you are still unsatisfied with our response, you may have the right to file a complaint with your state attorney general.

Authorized Agent:

If you are an authorized agent submitting a request on behalf of another person, you must provide a copy of a lawful power of attorney or written authorization signed by the consumer. If you make a request as an authorized agent, you may receive additional instructions. Depending on the type of request, we may contact you or the consumer as permitted by law.

Right to Non-Discrimination:

We do not discriminate against customers who exercise their privacy rights.

Controller/Business and Processor/Service Provider Designation:

We operate as a Controller (and a ‘Business’ under the CCPA) with respect to all Customer information and as a ‘Processor’ (and a ‘Service Provider’ under the CCPA) with respect to all Consumer information.

11. UK/EEA RESIDENTS NOTICE

Residents of the (“UK”) and European Economic Area (“EEA”) are provided certain privacy rights under the UK and EU General Data Protection Regulations (“GDPR”).

Legal Basis:

Under the GDPR, we process Personal Data under the following legal basis.

| Processing Activity | Legal Basis under GDPR |

| :---- | :---- |

| Providing the Website and Services | Contract Fulfillment, Legitimate Interest |

| Improving our Website and Services | Contract Fulfillment, Legitimate Interest |

| Interaction with our chatbot | Contract Fulfillment, Legitimate Interest |

| Service-related communications | Contract Fulfillment |

| Payment processing | Contract Fulfillment |

| Customer Support | Contract Fulfillment |

| Ensure compliance with written instructions and mitigate risk of fraud | Contract Fulfillment, Legitimate Interest, Legal Obligations |

| Marketing and promotional communications | Legitimate Interest |

Controller and Processor Designation:

Under the GDPR, we are designated as a Controller with respect to all Customer information. With respect to all User information, we operate as a Processor under the GDPR.

Cross-Border Data Transfers:

We may transfer to, and store the data we collect about you, in countries other than the country in which the data was originally collected, including the United States, Canada or other destinations outside the EEA and the UK. Those countries may not have equivalent data protection laws as the country in which you provided the data. When we transfer your data to other countries, we will protect the data as described in this Privacy Policy and applicable supplemental product privacy policy and comply with applicable legal requirements providing adequate protection for the transfer of data to countries outside the EEA or UK.

Superset complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Superset has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

If you communicate with Superset, we may collect personally identifiable information from you and about you, including the e-mail addresses of those who communicate with us via e-mail, information volunteered by you, such as survey information and/or site registrations, name, address, and email address. Any such transfer and processing by us will be in accordance with our Privacy Policy and the DPF Principles.

EU and UK individuals have rights to access personal data about them and to limit use and disclosure of their personal data. With our DPF certification, Superset has committed to respect those rights. If you would like to request that we not continue to use information we collect about you for the marketing purposes described herein, please contact us at [email protected].

To the extent that Superset acts solely as a data processor when processing personal data on behalf of its business customers (EU or UK data controllers) Superset acts only on the instructions of such controllers and does not control or share such personal data without direction from the relevant data controller. In those instances, and to the extent provided for by applicable law, Superset may rely on its data controllers to satisfy the notice and consent principles under relevant and applicable data protection law, and will only act on the instructions of that controller.

Superset uses a limited number of third party service providers to assist us in providing services to our customers such as, helping with certain technical operations, transmission of data, and data storage services. These third parties may process or store personal data in the course of providing their services. Superset maintains contracts with these third parties restricting their access, use, and disclosure of personal data in compliance with our DPF obligations. To the extent provided by the DPF principles, Superset remains responsible and liable under the DPF if a third party that Superset engages to process personal information on its behalf does so in a manner inconsistent with the DPF Principles, unless Superset proves it is not responsible for the matter giving rise to the damage.

Superset handles EU and UK citizens' personal data with appropriate care and safeguards. Superset has security measures in place to help protect personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction.

In addition, any data processing will be carried out with reasonable and appropriate security measures specified in the processing agreement between Superset and its customers. Superset will not disclose to third parties the personal data processed, except as permitted or required by the agreement between Superset and the third party, the EU DPF (and UK Extension), or other applicable data protection law.

Superset may be required to disclose personal information collected at its website site or processed for Superset business purposes in response to legal process, for example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement or other government agency's request, or where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our terms of use, to comply with legal requirements, or as otherwise required by or law.

In addition, we may share information in the event of a bankruptcy, or a merger, acquisition, joint venture, or other business combination involving us.

The U.S. Federal Trade Commission has jurisdiction over Superset's compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.

Superset makes a specific commitment to remedy any problems that may arise from an alleged failure of compliance with the above Principles and to resolve complaints about our collection of or use of your personal information. EU and/or UK individuals with inquiries or complaints regarding Superset compliance with the EU-U.S. DPF and/or the UK Extension to the EU-U.S. DPF Principles or this policy should first contact our company Data Protection Officer by mail or email at:

Superset Labs PBC

431 E 20th St

Unit 9A

New York, NY 10010

[email protected]

Superset will respond within 45 days. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed such complaint to your satisfaction, you may, under certain conditions, invoke binding arbitration. You may contact JAMS, an independent third-party dispute resolution body based in the United States. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Superset commits to refer to JAMS any unresolved complaints concerning our handling of personal data received in reliance on the DPF. You may visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. JAMS has committed to provide recourse services at no cost to you.

Superset Adheres to Data Privacy Framework Principles, including:

• Notice;
• Choice;
• Accountability for Onward Transfers;
• Security;
• Data Integrity and Purpose Limitation;
• Access; and
• Recourse and Enforcement.

Data Protection Officer:

We have appointed a Data Privacy Officer to oversee compliance with this Privacy Policy. If you have any questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer by mail or email at:

Superset Labs PBC

431 E 20th St

Unit 9A

New York, NY 10010

[email protected]

Legal representative:

We have also appointed a Superset representative in the European Union for data protection matters, pursuant to Article 27 of the General Data Protection Regulation. If you are in the European Economic Area, Superset can be contacted in addition to [email protected] on matters related to the processing of personal data. To make an inquiry, please contact Superset using this email address: [email protected] or by mail at the following address:

Superset Representatives SASU

39 Rue des Belles Feuilles

75016 Paris

France

Complaints:

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

12. CHILDREN’S PRIVACY

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at [email protected].

13. THIRD-PARTY LINKS

The Website and Services may contain links to other websites or services. We do not exercise control over the information you provide, or is collected by these third-party websites. We encourage you to read the privacy policies or statements of the other websites you visit.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time as we update or expand our Website and Services. If we make material changes, we will post the updated Privacy Policy on this page with a ‘Last Updated’ effective date of the revisions. We encourage you to look for updates and changes to this Privacy Policy by checking this page when you access our Website and Services.

15. CONTACT US

If you have any questions about our privacy or security practices, or if you would like to submit a privacy request, you can contact us by email at [email protected] or at:

Superset Labs PBC

431 E 20th St

Unit 9A

New York, NY 10010

United States