Privacy policy

01Who we are

SupaNav is made by A Mad Office, a business registered in the Netherlands. For your account, for this website and for the early access requests, we are the party responsible for your data. For what you put in your own workspace (your projects, files, team, clients and their comments) your studio decides what goes in and who sees it, and we process it on your behalf. A data processing agreement is available on request.

02What we store

• Your account. Your name, email address, a hashed password, your avatar and job title, and your preferences such as language and theme. If you sign in with Google, the name, email address and avatar that Google gives us.
• Your workspace. The name and details of your organisation, projects, clients and contacts, tasks, notes, canvases, comments, chat messages, hours, the files you upload, and the meeting recordings you upload or record.
• Guests. When a client opens a review link, a shared canvas or a file link, we store the name they type, their comments and approvals, and how often the link was opened. Guests do not need an account.
• Early access requests. The name, studio and email address you leave on this website.
• Finance. The figures you enter in the Finance section are tied to your account alone. Your PIN is stored as a hash.
• Technical. Server logs with IP address and browser type, kept briefly to keep the service safe and to fix problems. We do not run analytics or advertising trackers on the website or in the app.

03What we use it for

To run the service: show your projects to the people in them, keep everyone in sync, and send the emails you ask for, such as invitations, password resets and notifications. To keep the service safe. To answer you when you write to us. We do not sell data, and we do not use your content to train AI models.

04Who helps us

These companies process data for us, each only for its own task:

• Supabase runs the database, sign-in and file storage. Servers in the European Union (Ireland).
• Vercel hosts the website and the app. Servers in the European Union (Dublin).
• Resend delivers our emails.
• Google for sign-in with Google and, if you connect it, Google Calendar. See article 5.
• OpenAI when you use Meeting notes: the audio of a recording goes to OpenAI to be transcribed and summarised. Under its API terms OpenAI does not train on this data.
• Model providers in SupaStudio (fal.ai, kie.ai and Higgsfield): the prompts and reference images you send when you generate go to the provider you choose, under their terms. The results are stored in your workspace.

Some of these companies are in the United States. Where data leaves the European Union, the transfer is covered by the EU standard contractual clauses or an adequacy decision such as the EU-US Data Privacy Framework.

05Google Calendar

If you connect Google Calendar, we store an encrypted token so SupaNav can read and write events in the calendars you select. Events are fetched from Google when you open your agenda and are not copied into our database, apart from the id of an event when you book hours from it. You can disconnect at any time under Settings, Connections, or at myaccount.google.com. SupaNav's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

06Cookies

Only what the service needs: a session cookie so you stay signed in, and a cookie with your language choice. Your theme and a few view preferences are kept in your browser. There are no tracking cookies, so there is no cookie banner.

07How long we keep it

• Your account and workspace: as long as your account exists. What you delete goes to the Bin and can be restored until you empty it.
• When you close your account we delete your data, and the files in your workspace with it, within 30 days. Our hosting providers keep backups for a limited period after that.
• Comments of guests stay with the project they belong to.
• Server logs: a few weeks.
• Early access requests: until we have answered you and the early access period is over.

08Security

Data is encrypted in transit and at rest. Every query to the database is checked against who you are, with access rules on each table, so a member of one project cannot read another. Links to files are signed and expire. Secret keys never reach the browser. If a breach affects your data we tell you, and where the law requires it the Dutch Data Protection Authority, without undue delay.

09Your rights

You can ask us to see, correct or delete your data, to limit what we do with it, to hand it over (you can export your hours and download your files yourself), and you can object to how we use it. Write to hello@supanav.com and we answer within a month. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

10Children

SupaNav is made for professionals and is not meant for anyone under 16.

11Changes

When something changes we update this page and the date at the top. For a change that matters to you we email account holders.

12Contact

Questions about your data go to hello@supanav.com. You can also write to A Mad Office, Klokgebouw 210, Eindhoven, The Netherlands.