Privacy Policy
Effective November 15, 2026
This Privacy Policy explains how SuperTrace, Inc. ("Supertrace", "we", "us") collects, uses and shares personal data. It covers personal data from our websites (supertrace.ai and cli.supertrace.ai), the Supertrace platform, the stcli command-line tool, and our sales, support and marketing. We do not sell your personal data, and we do not use your content to train AI models.
1. Our role
1.1 Where we are the controller. We decide how your personal data is used, and this Policy applies, for:
- account and billing data;
- data from our websites and forms;
- Usage Data; and
- content you create when you use stcli as an individual.
1.2 Where we are the processor. When a business customer uses our Services, we process the content it and its users provide on that customer's behalf. That content includes prompts, device output, configurations, tickets and integration data. The customer's agreement with us and our Data Processing Addendum govern that processing. Contact that customer about its privacy practices. We will refer any request we receive about such content to the customer.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and profile | Name, work email, company, role, sign-in identity from Google, GitHub, Microsoft or Okta, organization membership | You or your organization |
| Customer Content | Prompts and agent responses; commands the agent proposes and runs; output from your network devices and Kubernetes workloads; contents of local files the agent reads or edits; local command output; data from tools you connect (such as NetBox, monitoring systems and ticketing tools); uploaded files such as packet captures and audio; saved memories and skills | You, and the systems you connect |
| Device and connection metadata | Device hostnames and addresses, SSH host-key fingerprints, device platform and software version; for stcli, your computer's hostname, operating system, architecture, stcli version and IP address at login | The Services and your systems |
| Usage and billing | Model token counts and costs, approvals and denials, feature usage, credit balance and transactions, payment confirmations (Stripe holds card details) | The Services, Stripe |
| Website chat | Messages you send to the chat on supertrace.ai, your IP address, a session ID created by your browser | You, your browser |
| Forms | Demo requests (name, email, network size); equipment requests (vendor, platform, work email, notes) | You |
| Cookies and device data | Analytics identifiers, browser and device type, IP address, pages viewed, error reports | Your browser (see Section 10) |
| Communications and feedback | Support emails, feedback you submit through /feedback, with your stcli version and operating system | You |
What stcli keeps on your computer. Device passwords you type into stcli are used only on your computer. SSH keys are also used only there, and neither is sent to us. Your stcli sign-in tokens are stored locally in ~/.config/stcli/credentials.json.
We do not ask for your age or date of birth.
3. How we use personal data
| Purpose | Legal basis (EEA and UK) |
|---|---|
| Provide the Services, including running the AI agent, carrying out actions you approve, and keeping session history | Performance of a contract |
| Create and secure accounts; detect fraud and abuse; enforce our terms | Contract; legitimate interests in security |
| Bill for usage and process payments | Contract; legal obligation (tax records) |
| Provide support and monitor service health | Contract; legitimate interests |
| Improve the Services using Usage Data, error reports and staff review of activity in our internal workspace (never to train AI models) | Legitimate interests |
| Answer the website chat, demo requests and equipment requests | Legitimate interests; steps before a contract |
| Learn what website visitors need, using website chat messages, to decide what to build | Legitimate interests |
| Send product and marketing emails | Consent where required; otherwise legitimate interests, with opt-out in every email |
| Comply with law and respond to lawful requests | Legal obligation |
4. AI models and your content
4.1 How models are used. To answer prompts, we send the relevant Customer Content to AI models. Some are hosted by us and some are operated by the model providers listed on our Subprocessors page.
4.2 No training. We do not use Customer Content to train or fine-tune AI models. We use model providers only on terms that prohibit them from training on it.
4.3 Provider retention. Model providers may keep inputs and outputs for a limited period set by their terms, to detect abuse. They then delete them unless the law requires otherwise.
4.4 Automated decisions. The Services do not make decisions about individuals that have legal or similarly significant effects.
5. How we share personal data
We share personal data only as follows:
-
Service providers and subprocessors who help us run the Services and are bound by contract to protect the data. They provide:
- cloud hosting
- AI models
- payments
- error monitoring
- product analytics
- internal support tools
- website form handling
The providers that process Customer Content are listed on our Subprocessors page.
-
Your organization. If your account belongs to a business customer, its administrators can see your account details, sessions and usage.
-
Tools you connect. When you or your organization connect a third-party tool, we send it the data needed for that integration.
-
Legal and safety. We share data to comply with law, to respond to valid legal process, or to protect the rights, property or safety of Supertrace, our users or others.
-
Business transfers. In a merger, acquisition or sale of assets, data may transfer subject to this Policy.
-
With your consent. We share data in other cases only with your consent.
We do not sell personal data. We do not share it for cross-context behavioral advertising.
6. Internal workspace
Our team uses an internal workspace (Slack) to monitor the Services, respond to customers quickly and improve the product. It receives account details and copies of activity, including messages to the website chat, conversations with the agent, commands run, alerts and device information. Access is limited to Supertrace staff who need it.
7. Security
We protect data with:
- encryption in transit (TLS);
- encryption of SSH device keys and most stored integration credentials;
- hashed access tokens;
- access controls and logging; and
- a SOC 2 Type II program, described at trust.supertrace.ai.
No system is perfectly secure. Report security issues to security@supertrace.ai.
8. Retention
| Data | How long we keep it |
|---|---|
| Supertrace platform accounts and Customer Content | For the term of the customer's contract. When it ends, the customer may export its data for 30 days, and we then delete it within 30 days. We delete an individual user's account within 30 days of a request from that user or their organization |
| stcli accounts and Customer Content | Until you delete your account in the stcli dashboard, then deleted within 30 days. You can delete individual sessions at any time. To prevent repeat sign-ups for free credits, we keep a deactivated account record with only a hashed copy of your email address and sign-in identity |
| Usage and billing records | 7 years, for tax and accounting |
| Backups | Expire within 35 days |
| Website chat messages and IP addresses | Until you ask us to delete them |
| Error reports (Sentry) | 90 days |
| Service logs (Datadog) and product analytics (Amplitude) | Until you ask us to delete them |
| Copies of activity in our internal workspace (Slack) | Until you or your organization ask us to delete them, including after your account or contract ends. We delete them within 30 days of a request |
| Demo and equipment requests | 24 months after last contact |
9. International transfers
We are based in the United States. Our platform runs in AWS data centers in the United States (us-east-1). stcli's backend also runs in the United States.
Some providers, including AI model providers, process data in the United States. When we transfer personal data out of the EEA, the UK or Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism.
10. Cookies and similar technologies
| Where | Technology | Purpose |
|---|---|---|
| supertrace.ai | Amplitude cookies | Product analytics: pages and sections viewed, clicks, and when website chat messages are sent (not their text) |
| supertrace.ai | Rate-limit cookie | Lets the website chat apply usage limits |
| Supertrace platform | Browser local storage | Keeps you signed in; remembers theme and display settings |
| Supertrace platform | Amplitude | Product analytics tied to your account (screens viewed, buttons pressed) |
| Platform and cli.supertrace.ai | Sentry | Error reports to fix bugs and detect abuse, including your IP address, browser details and account ID |
| cli.supertrace.ai | Browser local storage | Remembers dismissed notices |
Where the law requires it, we ask for consent before setting analytics cookies. We honor Global Privacy Control signals as an opt-out where applicable.
11. Your rights
11.1 Your rights. Depending on where you live, you may have the right to:
- access, correct or delete your personal data;
- receive a portable copy of it;
- object to or restrict certain processing;
- withdraw consent; and
- opt out of targeted advertising, sale or profiling.
We do not sell personal data or use it for targeted advertising.
11.2 How to make a request. Email privacy@supertrace.ai.
- We will verify your identity using your account email.
- We will respond within one month, or within the period your local law sets.
- An authorized agent may make a request for you with proof of authority.
- If we deny a request, you may appeal by replying to our decision.
- We will not discriminate against you for exercising these rights.
11.3 Complaints. In the EEA or UK, you may also complain to your local data protection authority.
11.4 Requests about business customers' content. If your data is in a business customer's content, we will forward your request to that customer.
12. Children
The Services are for people 18 and older and are not directed to children. If we learn we have collected personal data from a child, we will delete it.
13. Changes
We will post changes here and update the effective date. If changes are material, we will notify you by email or in the Services before they take effect.
14. Contact
SuperTrace, Inc.
115 W 30th St, Rm 500B, New York, NY 10001
privacy@supertrace.ai
If you are in the EEA, the UK or Switzerland, you can contact us at privacy@supertrace.ai with any question about this Policy.