Privacy policy

What this policy covers

Supah, Inc. operates Supah Computer and SupahID. This policy covers the consumer websites, account services, web and iPhone applications, and your personal cloud Computer. Features may be limited to eligible accounts and supported releases. Connecting an external account requires your permission.

Your account and identity

We process your account details, verified email, password verifier, public passkey metadata, enrolled-device records, sessions, consent choices and security records to operate and protect your account. Security records can include IP address, browser information, timing and outcomes. Private passkey keys and device biometric templates stay with your authenticator.

New identity-document verification is not part of registration. For historical Stripe Identity verification, Supah retains only the provider, session reference, result and time, not identity-document images, selfies, document fields or biometric data.

Public Persona

Your Persona starts private. Information you choose to publish becomes publicly available and may be copied by others or indexed by search engines. Private conversations and connected Google content are not automatically added to your Persona. You control publication in your account.

Google accounts and connected services

When you connect Google, we receive a verified account identifier and email address, along with the access credentials needed to use the connection. The services you select determine the permissions requested during Google sign-in:

• Gmail: read and search messages and attachments, prepare drafts, and perform supported message and label actions.
• Calendar: read calendars and events and perform supported calendar and event changes.
• Drive: find, read, create, copy, change and delete files the connected account can access.
• Docs and Sheets: read, create and edit documents and spreadsheets. The current native integration also requires you to select Drive access for file discovery and operations.
• Contacts: find, create, update and delete contacts.

We use this information to carry out your requests through your personal Computer. Google displays the requested account permissions before you authorize them. Those permissions may cover an entire selected service. Preferred calendars, folders, account labels and defaults guide your Computer; they do not restrict the permission granted by Google.

Other supported connections access the account information needed for their displayed functions under the permissions you grant. Connections are off until you authorize them. Connecting an account does not itself authorize channels or unattended background work.

How your Computer and AI process information

Your personal Supah Computer runs in the cloud. OpenClaw operates on that Computer and uses connected services for your tasks. Relevant messages, selected Google or other connected content, conversation context and tool results may be sent to OpenAI through Supah Intelligence to produce answers and actions. You review processing permission and connection permission in the product.

Supah's shared execution services process this content transiently rather than storing prompts, responses or provider content in shared databases or operational logs. Your personal Computer stores your conversations and files separately. Supah retains content-free authorization, usage, security and outcome records.

OpenAI processing is governed by the terms applicable to Supah's API service, including retention for abuse monitoring where applicable. Disabling stored API responses is not a promise of zero retention by every processor. Read OpenAI's API data-use information for its published policies.

Storage and recovery

Your connected account credentials and authenticated profiles are stored encrypted on your personal Computer. Supah's shared application service holds the application's own OAuth secret and handles exchanges transiently. The web and iPhone applications do not persist your Google access or refresh tokens.

Personal Computer conversations, files and memory remain on your Computer until deleted. They can contain information obtained from connected services or derived from it. Encrypted recovery copies expire within seven days. Conversation deletion removes access to older recovery copies as part of the deletion process. Credentials and connection withdrawal records have a separate recovery lifecycle, so restoring content does not restore permission you have withdrawn.

The older iPhone-only chat stores encrypted history on the phone, excludes it from device backup, and expires messages after 30 days. That limit does not apply to personal Computer history. Importing older phone history into your Computer requires your explicit choice.

Disconnecting and deleting information

Disconnect an account in Connections to stop future Supah access. You can also revoke access in your provider's settings, including Google Account connections. Disconnecting does not erase information already shared in a conversation, saved in a file or retained as memory. Use the separate deletion controls for that content. Changes made in Google or another provider remain there until you change or delete them at that provider.

You can turn off personal Computer processing while retaining access to supported reading, export and deletion controls. Account deletion is available through the account security controls. Supah may retain limited security and legal records where necessary. Contact us if you need help locating, correcting, exporting or deleting your information.

Limits on Google data use

Our use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy and the Google Workspace user-data policy, including their Limited Use requirements.

Google data and derived content are not sold, used for advertising, supplied to data brokers or used to develop, train or improve general-purpose AI models. Data is shared with service providers only for consented product functions or other narrow purposes permitted by those policies, such as security and legal obligations. Human access is limited to support with your specific permission and permitted security or legal needs. These restrictions also apply to processors and contractors.

Website analytics

With your permission, our public websites use separate Google Analytics tags to understand visits, traffic sources, approximate location and browser or device information. Analytics cookies load only after you allow them. Advertising personalization and Google Signals are disabled. You can decline or change your choice using Privacy choices.

Public-site analytics is separate from authenticated account and Computer application pages and does not receive connected account content. On public Persona pages, aliases, names and query strings are omitted or replaced in analytics page and referrer fields. Learn how Google uses information from sites that use its services.

Contact and requests

For privacy, access, correction or deletion requests, email [email protected]. For help with your Computer, email [email protected]. You can manage account and Persona settings at account.supah.id.