Skip to content
Sign inStart a project

Updated 5 October 2026

Privacy

What Superposition OS keeps about the people who use it, why, where, and who to ask.

Who we are

Superposition OS is run by Superposition (Pty) Ltd., a South African company. We're the responsible party, under the Protection of Personal Information Act (POPIA), for the personal information on this page.

What we keep

  • Your account: your email address, the brands you're on and your licence on each. Nobody signs up: your organisation or our studio adds you.
  • If you sign in with Google or Microsoft: the name, email address, profile picture and account ID they share with us.
  • Sign-ins: when you signed in, and the IP address and browser you used, to keep accounts secure.
  • What you do here: the changes you make to a brand, what you send for approval, approve or ask changes on, the files you upload, and the AI tools you connect and what they ask for. A brand's history shows who did what.
  • Cookies: one keeps you signed in, and a few short-lived ones see you through signing in. There are no advertising or analytics cookies.

What we use it for

  • To sign you in and show you the brands you're on, as your licence allows.
  • To record who changed and approved what: a brand's approvals depend on it.
  • To email you sign-in links.
  • To keep Superposition OS secure and working, and to meet the law.

We don't sell your personal information, use it for advertising, or use it to train AI models.

Who else handles it

These providers run Superposition OS for us:

  • Supabase: the database, sign-in and file storage, in Ireland.
  • Google Cloud: the servers Superposition OS runs on, in London.
  • Google Workspace: sends our emails.

And these, depending on what you use:

  • Google or Microsoft, if you sign in with them. Your account there is theirs, under their privacy policies.
  • Adobe Fonts and Google Fonts, which serve the fonts on some pages: your browser asks them for the fonts, which tells them your IP address and browser.
  • The AI tools you connect, such as Claude: they get the brand content they ask for, under their own terms.

We share personal information with anyone else only when the law requires it.

Where it's kept

In Ireland and the United Kingdom, outside South Africa. Both have data protection laws comparable to POPIA (the GDPR and the UK GDPR).

How long we keep it

We keep your account while you have access to a brand, and delete it when you ask. A brand's history (who changed or approved what) stays with that brand while it's on Superposition OS. Sign-in records and server logs are kept only as long as we need them to keep Superposition OS secure.

How we protect it

Every connection is encrypted. Each person reaches only the brands they're on, and the database itself enforces that. There are no passwords to steal: you sign in with a link we email you, or with Google or Microsoft.

Signing in with Google

When you sign in with Google, we receive your name, email address, profile picture and Google account ID. We use them only to sign you in and to show who you are. We don't see your email, files or anything else in your Google account, and we share Google user data only with the providers above that run Superposition OS.

Your rights

You can ask what personal information we hold about you, and ask us to correct it, delete it or stop using it. Email privacy@thesuperposition.agency and we'll answer within 30 days. If you're not satisfied, you can complain to South Africa's Information Regulator at inforegulator.org.za.

Changes

When this changes, we'll update this page and its date.