Privacy

1. What this covers

This policy covers supersquared.ai, the free consultation, the dashboard at app.supersquared.ai, and the hub your assistant connects to. Super Squared is run by Greg Fielding. Questions go to hello@supersquared.ai.

2. Visiting the website

• We use Google Analytics to see which pages are read and which buttons and links are clicked. Google sets cookies for this and receives your IP address, browser, device, and approximate location. We never send Google your name or email, and we do not use it for advertising or retargeting.
• We advertise on Google Search. If you arrive from one of our ads, Google Ads sets a cookie that remembers the click and is told if you finish the consultation form, so we know which ads lead to calls. We do not send Google anything you type into the form, and we do not use this to show you ads on other sites.
• We use Apollo.io to see which companies visit the website. Apollo receives your IP address and the pages you view, and matches the address to a business where it can. We use this to understand which businesses are interested, not for advertising.
• If we emailed you a link to the website, that link carries a short code unique to you. When you open it, your browser remembers the code and the hub records which pages you view on this and later visits, so we know you had a look. Clearing your browser's site data removes the code.
• The consultation form saves your draft in your own browser so you can come back to it. The draft is removed when you finish the form.
• If you switch between light and dark mode, a cookie remembers the choice so the website and the dashboard match. It holds the word "light" or "dark" and nothing about you.
• You can block analytics and ad measurement with a browser setting or extension. The site works the same without it.

3. The consultation form

• What we collect: your industry, business name, your name, phone, and email, the priorities and tools you pick, and anything you write in your own words.
• What we do with it: prepare for and follow up on your call. We may call, text, or email you about it. It is never added to a mailing list and it is never sold.
• How long we keep it: if you become a client, it becomes part of your client record. If you do not, we delete it within 12 months, or as soon as you ask.

4. Your client account

• Sign-in is handled by Firebase Authentication, a Google Cloud service, using Google sign-in or an email and password. We hold your name, email, and business. We never see your password.
• The dashboard records which pages you open and when, so we can see whether it is being used and make it better. That record stays inside the hub and is never shared.
• If you give front-desk staff access, the same applies to them.

5. What your assistant sends us

Your assistant, Claude on your own subscription, connects to our hub and publishes on a schedule. What we hold:

• Your Growth Plan: priorities, what success looks like, the numbers we track, rules, and action items.
• Aggregate business numbers by day, week, or month: revenue, expenses, receivables, bookings, review counts, ad spend, and similar totals and counts from the systems you connected.
• Small summary tables such as top customers by revenue, expense categories, and where new customers came from. Business customer names can appear in the top-customers table for non-medical businesses. For medical and wellness practices there are no names anywhere, only counts and dollars.
• One-line summaries of work your assistant did, without customer names or contact details.
• Ideas, friction, and questions your assistant sends us in your words, and our replies.

What it never sends us, and what we never hold: your conversations with your assistant; your customers' or patients' names, phone numbers, emails, addresses, purchases, treatments, or photos (beyond the business customer names above); and your card or bank details, which Stripe holds. The instructions installed in your assistant on setup day say so, and the hub rejects anything outside the agreed formats.

6. Systems you connect directly

Some systems, such as Google Analytics, Google Business Profile, and Mailchimp, connect to our hub directly rather than through your assistant. For those we hold the access token or API key you grant, encrypted at rest with AES-256-GCM, and use it only to read the same aggregate numbers on a weekly schedule. We do not write to those systems. The token is deleted when you disconnect the system or leave.

7. Billing

Stripe processes payments. Card and bank details go to Stripe and never touch our systems. We hold your Stripe customer ID, your plan, and the status and history of your invoices. Stripe sends receipts and failed-payment notices on our behalf, and Stripe's own privacy policy covers what it holds.

8. How we use what we hold

• To deliver the service: the dashboard, the weekly measurement, the monthly review, and the briefs for your call.
• To improve your playbooks and rules. Our own Claude reads what your assistant sends us to draft briefs, triage items, and write reviews. It runs on Anthropic's service under Anthropic's commercial terms, which do not allow Anthropic to train on that data.
• Cross-client learning: patterns across the businesses we serve improve playbooks and rules for everyone. Your numbers, names, and specifics are never shared with another client and never appear in another client's plan.
• Billing, support, and keeping the records the law requires.
• We do not sell personal information and we do not share it for advertising.

9. Who else sees it

We use a small number of service providers. Each is bound by its own terms and our agreement with it.

• Google Cloud hosts the hub and the dashboard (Cloud Run, Firestore, Firebase Authentication) in the United States, and provides Google Analytics and Google Ads measurement for the website.
• Anthropic runs the Claude we use on our side. Your own assistant runs on your subscription under your agreement with Anthropic.
• Stripe handles billing.
• Apollo.io identifies which companies visit the website, and sends our outreach email.
• Google Workspace provides our email and calendar, including the booking page for your consultation.
• The vendors of systems you connect directly. We call their APIs with the access you grant.

We share with no one else, except where the law requires it or to protect the service from abuse.

10. How long we keep it

• Consultation details: up to 12 months if you do not become a client, or sooner on request.
• Client data: for as long as you are a client. When you leave, you get an export of your plan, numbers, and log. We remove your access, revoke platform grants, and delete stored tokens right away. We delete your plan, numbers, activity, and messages 90 days after you leave, or sooner if you ask. Patterns already folded into shared playbooks stay, with nothing that identifies you.
• Billing records: as long as tax law requires, typically seven years.
• Website analytics: Google Analytics keeps event data for up to 14 months.

11. Security

Everything moves over HTTPS. Access tokens are encrypted at rest. The hub, dashboard, and data live in Google Cloud, with access limited to Greg and the automated jobs that run the service. Your assistant identifies itself to the hub with a signed login, not a shared key. No system is perfectly secure. If we learn of a breach affecting your data, we will tell you promptly.

12. Your choices

• Ask for a copy, a correction, or deletion of anything we hold by emailing hello@supersquared.ai. We answer within 30 days.
• Ask for an export of your plan, numbers, and log at any time. You get one automatically when you leave.
• Disconnect any directly connected system at any time. Its token is deleted.
• Block analytics cookies in your browser.
• California residents have the right to know what we hold, to delete it, to correct it, and not to be treated differently for exercising those rights. We do not sell or share personal information as California law defines those terms. Email us to exercise these rights.

13. Children

The service is for businesses. It is not for anyone under 18, and we do not knowingly collect information from them.

14. Changes

We will email clients at least 30 days before a change that reduces your rights or changes what we hold. The effective date at the top always shows the current version.

15. Contact

Super Squared · hello@supersquared.ai