Updated 7 October 2026
What Superposition OS keeps about the people who use it, why, where, and who to ask.
Who we are
Superposition OS is run by Superposition (Pty) Ltd., a South African company. We’re the responsible party, under the Protection of Personal Information Act (POPIA), for the personal information on this page.
Questions and requests: privacy@thesuperposition.agency
Information Officer: Rhys Miles Downard, rhys@thesuperposition.agency
What we keep
Your account: your email address, the brands you’re on and your licence on each. Your organisation or our studio adds you, or you make one by signing in with Google.
If you sign in with Google: the name, email address, profile picture and account ID it shares with us.
If you sign in with Google and aren’t on a brand yet: which brands we asked to give you access, and when.
Sign-ins: when you signed in, and the IP address and browser you used, to keep accounts secure.
What you do here: the changes you make to a brand, what you send for approval, approve or ask changes on, the files you upload, and the AI tools you connect and what they ask for. A brand’s history shows who did what.
Cookies: one keeps you signed in, and a few short-lived ones see you through signing in. There are no advertising or analytics cookies.
If you write to us through the contact form: your name, email address, organisation, phone number if you give it, the tier you ask about and your message. They reach us as an email. Your IP address is held for an hour, to stop the form being misused, and isn’t stored.
What we use it for
To sign you in and show you the brands you’re on, as your licence allows.
To record who changed and approved what: a brand’s approvals depend on it.
To email you sign-in links.
If you sign in with Google and aren’t on a brand yet, to ask for you: we email your name and address to the brand champions of the brands whose people share your email address’s domain (never a public one, such as gmail.com), so they can add you. With nobody to ask, the contact form starts with your name and address.
To answer you, if you write to us through the contact form.
To keep Superposition OS secure and working, and to meet the law.
We don’t sell your personal information, use it for advertising, or use it to train AI models.
Who else handles it
These providers run Superposition OS for us:
Supabase: the database, sign-in and file storage, in Ireland.
Google Cloud: the servers Superposition OS runs on, in London.
Google Workspace: sends our emails, and holds the enquiries you send us.
And these, depending on what you use:
Google, if you sign in with it. Your account there is Google’s, under its privacy policy.
Adobe Fonts and Google Fonts, which serve the fonts on some pages: your browser asks them for the fonts, which tells them your IP address and browser.
The AI tools you connect, such as Claude: they get the brand content they ask for, under their own terms.
We share personal information with anyone else only when the law requires it.
Where it’s kept
In Ireland and the United Kingdom, outside South Africa. Both have data protection laws comparable to POPIA (the GDPR and the UK GDPR).
How long we keep it
We keep your account while you have access to a brand, and delete it when you ask. A brand’s history (who changed or approved what) stays with that brand while it’s on Superposition OS. Sign-in records and server logs are kept only as long as we need them to keep Superposition OS secure. We keep an enquiry for as long as we need it to answer you and for our business records, and delete it when you ask.
How we protect it
Every connection is encrypted. Each person reaches only the brands they’re on, and the database itself enforces that. There are no passwords to steal: you sign in with a link we email you, or with Google.
Signing in with Google
When you sign in with Google, we receive your name, email address, profile picture and Google account ID. We use them to sign you in and to show who you are; if you aren’t on a brand yet, to ask your organisation’s brand champions to add you (they get your name and email address) or to fill in the contact form for you. We don’t see your email, files or anything else in your Google account, and we share Google user data with nobody else but the providers above that run Superposition OS.
Your rights
You can ask what personal information we hold about you, and ask us to correct it, delete it or stop using it. Email privacy@thesuperposition.agency and we’ll answer within 30 days. If you’re not satisfied, you can complain to South Africa’s Information Regulator at inforegulator.org.za.
Changes
When this changes, we’ll update this page and its date.