Privacy policy

Introduction

Welcome to The Next Door AI Private Limited ("Supersei," "we," "us," or "our"). We operate the marketing website at supersei.ai, the tenant portal and product at supersei.com (including tenant subdomains), and the Supersei Growth Engine, an AI-powered SaaS platform designed to help businesses automate and scale their marketing, sales, and customer engagement workflows.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, create an account, or use our services. It also describes your rights regarding your personal data and how you can exercise them.

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.

This policy applies to all users of supersei.ai, supersei.com (including tenant subdomains), and the Supersei Growth Engine platform globally, including users in the European Union, the United Kingdom, California, and India. Where local law imposes additional obligations, we comply with those requirements.

Information we collect

We collect information in several ways: directly from you, automatically through your use of our services, and from third-party integrations you connect to our platform.

Personal information you provide

When you register for an account, subscribe to a plan, or contact us, we may collect:

• Full name and job title
• Business email address and personal email address
• Phone number and WhatsApp number
• Company name, industry, and company size
• Billing address and payment information (processed by our payment processors)
• Login credentials (passwords are stored in hashed form)
• Profile photo or avatar if provided
• Any other information you voluntarily submit via forms, surveys, or support requests

Usage and platform data

When you use the Supersei platform, we automatically collect data about how you interact with our services, including:

• Pages visited, features used, and actions taken within the platform
• Workflow configurations, campaign settings, and automation rules you create
• Frequency, timing, and duration of sessions
• Error logs, crash reports, and performance data
• Search queries and filters applied within the platform

Device and technical information

We collect technical information from the device and browser you use to access our services:

• IP address and approximate geographic location derived from it
• Browser type, version, and language settings
• Operating system and device type
• Screen resolution and viewport size
• Referring URLs and exit pages
• Time zone settings

Cookies and tracking technologies

We use cookies, pixel tags, web beacons, and similar tracking technologies to operate and improve our services, measure the performance of our marketing campaigns, and personalise your experience. For full details, please refer to our Cookie Policy.

Data from third-party integrations

When you connect third-party services to the Supersei platform, we receive data from those services according to the permissions you grant. This may include:

• Meta / Facebook: Ad account data, campaign performance metrics, audience insights, Page and Instagram account information, lead form submissions via Facebook Lead Ads, and messaging data via the WhatsApp Business API. We operate as a Meta Tech Service Provider (TSP) and process this data in accordance with Meta's Platform Terms and Data Policy.
• Google (Gmail, Calendar & Meet, Ads, Analytics): When you connect your Google account, we receive only the data needed for the features you enable: email messages and metadata, used to send sales emails and follow-ups from your Gmail address and match customer replies to the right record; calendar events and Google Meet links, used to schedule meetings and demos; and campaign performance, keyword-level metrics, conversion, audience, and attribution data from Google Ads and Analytics. We process Google user data in accordance with Google's API Services User Data Policy, including the Limited Use requirements, and never use it for advertising or sell it.
• Zoom: When you connect your Zoom account, we receive your Zoom user ID, account ID and email address, and OAuth tokens that let us create, update and delete the Zoom meetings you book through Supersei. We store the meeting ID and join link on the meeting record in your CRM. We do not access your recordings, chats, participants or other meetings. Tokens are encrypted at rest and deleted when you disconnect Zoom in Supersei or remove the app from the Zoom App Marketplace. Setup and removal are documented at supersei.ai/help/zoom.
• WhatsApp Business API: Message logs, template statuses, contact opt-in records, and conversation metadata for the business accounts you manage through our platform. This data is processed under the WhatsApp Business Solution Provider terms.
• CRM and e-commerce integrations: Contact records, deal data, purchase history, and other business data you choose to sync with our platform.
• Other connected apps: Any data you authorise through OAuth or API keys when connecting additional tools to your Supersei workspace.

We do not collect more data from these integrations than is necessary to deliver the features you have enabled, and we use that data solely as described in this policy.

AI assistants connected to your account

Supersei offers a connector that lets you use an AI assistant such as Claude (by Anthropic) with your Supersei account. The connector works only when you, or a user of your organisation, explicitly connect it by signing in with your Supersei email and a one-time code.

• What it does: when you ask the assistant to do something in Supersei, the assistant sends that request to Supersei's API, and Supersei returns the data or performs the action. The assistant acts with the permissions of the signed-in user and nothing more. Actions are recorded in your CRM exactly as they are when taken in the web application.
• What we process: the CRM data your request touches (for example lead records, notes, tasks, messages and reports) and connection metadata (the time of each request, a request identifier, the organisation and user, and the outcome). We use this to fulfil your request, secure the service and audit access. We do not use data passed through the connector to train machine-learning models.
• Sharing: data returned to the assistant is delivered to the AI provider you chose, so that it can respond to you. That provider's own privacy policy and your agreement with them govern how they handle it. We do not share connector data with any other third party except as described elsewhere in this policy.
• Storage and retention: the connector keeps no copies of your CRM data. Credentials issued for the connector are stored in your organisation's API key settings and remain valid until you disconnect, until an administrator revokes them, until your user is deactivated, or for 90 days, whichever comes first. Connection audit records are retained for the life of your organisation's account.
• Your controls: disconnect at any time from the AI assistant, or revoke the connection from Settings → API keys in Supersei. Administrators can see and revoke every connection in their organisation.

Questions about the connector: hello@supersei.ai. Setup and usage are documented at supersei.ai/docs/claude.

Supersei Mobile Apps (Android and iOS)

The Supersei mobile apps let invited members of your organisation work their leads from a phone. Accounts are created by your organisation's administrator; there is no public sign-up. In addition to the information described above, the apps process:

• Precise location: collected only while the app is open, to verify the sign-in session and to record attendance check-ins and field visits when your organisation uses those features. The iOS app does not track location in the background.
• Call information: the number dialled from the app, the call time and duration, and the outcome you record, so the call is logged against the right lead. On Android, if your organisation enables it, the app reads the call log and uploads call recordings made by your phone's dialer for calls to leads. On iOS, the app cannot read the call log or record calls; a recording is uploaded only if you choose to attach an audio file.
• Device information: a random app device identifier, device model, operating system and app version, and a push notification token, used to deliver notifications (for example a request from the web app to call a lead), keep you signed in securely and support the app.
• Diagnostics: recent app logs, sent only when you tap "Send diagnostics". Customer phone numbers are redacted before logging.

The apps do not show advertising and do not track you across other companies' apps or websites. You can turn off location, phone, microphone or notification access at any time in your phone's settings; some features, such as session verification and check-ins, need location to work. To delete your account and its data, ask your organisation's administrator or email privacy@supersei.ai.

How we use your information

We use the information we collect for the following purposes:

Service delivery and account management

• Creating and managing your account and workspace
• Providing access to platform features, dashboards, and reports
• Processing transactions and managing subscriptions
• Authenticating your identity and maintaining account security
• Sending transactional communications such as receipts, password resets, and service alerts

AI processing and automation

• Powering AI-driven insights, recommendations, and content generation features within the platform
• Training and improving our proprietary machine-learning models using aggregated and anonymised data derived from platform usage (we do not use your identifiable customer data to train models shared across accounts without your explicit consent). Data received from Google APIs, including Gmail, is never used for this; see How we handle Google user data.
• Generating automated reports, performance summaries, and predictive analytics
• Operating AI-powered chatbots and conversational flows you configure in your workspace

Analytics and product improvement

• Understanding how users navigate and use our platform in order to improve usability and performance
• Conducting A/B testing and feature experimentation
• Diagnosing bugs, errors, and technical issues
• Generating aggregate, anonymised statistics about our user base and platform usage

Marketing and communications

• Sending newsletters, product updates, and educational content to users who have opted in
• Running targeted advertising campaigns on Meta, Google, and other platforms using hashed email addresses or pixel-based audiences (you may opt out at any time)
• Measuring the effectiveness of our own marketing campaigns through ad attribution data
• Retargeting visitors who have interacted with our website or content

Ad attribution and conversion tracking

We use conversion tracking pixels and server-side event APIs (including Meta Conversions API and Google Ads Conversion Tracking) to measure the performance of advertising campaigns run by us and, where applicable, by our customers using the platform. This enables accurate attribution of leads and sales to advertising activity.

Legal and compliance

• Complying with applicable laws, regulations, and lawful government requests
• Enforcing our Terms of Service and other agreements
• Preventing fraud, abuse, and security incidents
• Protecting the rights, property, and safety of Supersei, our users, and the public

Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data only where we have a valid legal basis to do so. The legal bases we rely upon are:

Consent (Article 6(1)(a) GDPR)

We rely on your freely given, specific, informed, and unambiguous consent for activities such as sending marketing emails and newsletters, placing non-essential cookies on your device, and processing sensitive data categories where applicable. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Contract performance (Article 6(1)(b) GDPR)

We process personal data to the extent necessary to perform the contract we have with you, including creating your account, delivering the Supersei platform features you have subscribed to, processing payments, and providing customer support.

Legitimate interests (Article 6(1)(f) GDPR)

We rely on our legitimate interests (or those of a third party) where those interests are not overridden by your rights and interests. This includes activities such as platform analytics and improvement, fraud prevention, security monitoring, direct marketing to existing business customers, and improving the quality of our AI models using aggregated data. Where we rely on legitimate interests, we have carried out a balancing test to ensure your interests, rights, and freedoms are not overridden.

Legal obligation (Article 6(1)(c) GDPR)

We may process your personal data where necessary to comply with a legal obligation to which we are subject, including tax and accounting obligations, anti-money laundering requirements, and responses to lawful requests from public authorities.

Data sharing and third parties

We do not sell your personal data to third parties. We share personal data only as described below.

Sub-processors and service providers

We engage trusted third-party companies to help us deliver our services. These sub-processors may access personal data only to perform services on our behalf and are contractually required to protect it in accordance with this policy and applicable law. Our key sub-processors include categories such as:

• Cloud infrastructure and hosting providers
• Database and data warehousing services
• Customer support and ticketing platforms
• Email delivery and transactional messaging services
• Error tracking and performance monitoring tools
• Identity verification and authentication services

Meta / Facebook integration

As a Meta Tech Service Provider, we integrate with Meta's Business Tools, Ads APIs, WhatsApp Business API, and Lead Ads products. When you connect your Meta assets to Supersei, we receive and process data in accordance with Meta's Platform Terms. Data shared with Meta (such as hashed email addresses for Custom Audiences or server-side conversion events) is governed by Meta's Data Policy and your agreement with Meta as the data controller for your advertising activities. We act as a data processor in this context on your behalf.

Google integration

We integrate with Google services including Gmail, Google Calendar and Google Meet, Google Ads, Google Analytics, and Google Business Profile. With your permission, Supersei sends and syncs email through your connected Gmail account, creates and updates Google Calendar events (with Google Meet links) for meetings and demos, imports campaign spend, leads and conversion data from Google Ads (and pauses or resumes a campaign when an admin asks it to in Supersei), reads traffic and conversion reports from the Google Analytics property you choose, and brings in your Google Business Profile reviews and profile views and posts review replies you send, or automatic replies if you turn auto-reply on. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising or to train generalised AI models, or allow humans to read it, except as required for security, to comply with the law, or with your explicit consent. Data you share with Google through our platform is subject to Google's Privacy Policy and your agreement with Google.

How we handle Google user data

This section applies to data Supersei receives through Google APIs when you connect a Google account (Gmail, Google Calendar, Google Meet and Google Drive files created by Meet).

Data we access. With your permission we access: your Google account name, email address and profile picture; Gmail messages and their metadata (sender, recipients, subject, date, body and attachments) in your mailbox, and the ability to send email as you; if your workspace turns on Gmail two-way sync, the ability to mark messages read or unread, apply a "Supersei" label, archive threads you archive in Supersei, and save AI replies to your Gmail drafts (we never delete email and never send a draft without you); your Google Calendar events and the ability to create and update events with Google Meet links; Google Meet meeting spaces you create and their conference records (start and end times, participants); and, only if you reconnect your account to enable recordings, the Meet recording and transcript files that Google Meet saved to your Drive. We do not access other Drive files.

How we use it. We use Google user data only to provide the features you use in Supersei: sending emails and follow-ups from your Gmail address; matching customers' replies to the right lead, contact or deal and showing them on its timeline; drafting and improving email replies with AI when you ask for it; scheduling meetings and demos with Google Meet links and sending invitations; recording meeting attendance and timings; and saving a meeting's recording and transcript to your CRM. We do not use Google user data for advertising, to build user profiles for third parties, or to determine credit-worthiness or for lending.

Who we share it with. We do not sell Google user data. We share it only with service providers that process it on our behalf to run these features: Amazon Web Services (hosting, database and file storage in India); Deepgram, which turns meeting recordings into text, with its model-improvement programme switched off for this audio; and the AI model providers that generate email drafts and meeting summaries — Google (Gemini API), OpenAI and Anthropic. These providers process the content only to return a result to you; under our agreements with them they do not use it to train their models. We may also disclose data where required by law or to protect the security of our service, or as part of a merger or acquisition, in which case the same protections continue to apply.

How we protect it. Google data is encrypted in transit (TLS 1.2 or higher) and at rest. Your Google access and refresh tokens are additionally encrypted with an application-level key before they are stored. Access is limited to your own workspace through role-based permissions, and our staff cannot read your email except where you ask us to for support, where needed for security, or where required by law.

Retention and deletion. We keep Google user data while your Google account is connected. When you disconnect it in Supersei (Settings → Email), we revoke our access with Google and delete your tokens immediately. Email synced from your mailbox is deleted within 90 days of disconnection, or sooner if you ask; emails you sent through Supersei stay in your CRM records as part of your customer history until you delete them or close your account. You can also remove Supersei's access at any time at myaccount.google.com/permissions, and ask us to delete your Google data by emailing privacy@supersei.ai.

Limited Use. Supersei's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use Google Workspace user data, raw or aggregated and anonymised, to develop, improve or train generalised AI or machine-learning models, and we do not transfer it to any third party that would use it for that purpose.

Payment processors

Payment card data is processed directly by PCI-DSS-compliant payment processors. We do not store full card numbers on our servers. We receive only limited transaction metadata (such as the last four digits of a card, expiry date, and transaction status) necessary to manage your subscription.

Analytics providers

We use analytics tools to understand how our website and platform are used. These providers may set cookies or receive usage data. You can opt out of analytics tracking through our cookie consent manager or your browser settings.

Business transfers

If The Next Door AI Private Limited is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website if such a transfer occurs and will explain your choices.

Legal requirements

We may disclose personal data if required to do so by law or in good faith belief that such disclosure is necessary to comply with a legal obligation, protect and defend our rights or property, prevent or investigate possible wrongdoing, protect the personal safety of users or the public, or protect against legal liability.

International data transfers

The Next Door AI Private Limited is incorporated in India. We operate globally, and your personal data may be transferred to, stored in, and processed in countries outside your country of residence, including India, the United States, and other countries where our sub-processors are located. These countries may have data protection laws that differ from those in your jurisdiction.

Transfers from the EEA and UK

Where we transfer personal data from the European Economic Area or the United Kingdom to countries that are not subject to an adequacy decision, we rely on appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office, incorporated into our agreements with sub-processors and business partners
• Supplementary technical and organisational measures where required by the applicable transfer impact assessment

You may request a copy of the relevant transfer mechanism by contacting us at privacy@supersei.ai.

Transfers from India

We comply with the Digital Personal Data Protection Act, 2023 (DPDPA) of India and transfer personal data cross-border only as permitted under applicable Indian law and this policy.

Data retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the nature of the data and the purpose of processing.

Our general retention criteria include:

• Account data: Retained for the duration of your active account plus up to 3 years after account closure, unless a longer period is required by law (e.g., for tax or accounting records).
• Transaction and billing records: Retained for 7 years in accordance with financial record-keeping obligations.
• Platform usage and analytics data: Aggregated and anonymised data may be retained indefinitely; identifiable usage logs are typically retained for 12 to 24 months.
• Marketing data: Contact information for marketing purposes is retained until you withdraw consent or opt out, after which it is suppressed (not deleted, to prevent accidental re-contact).
• Integration data (Meta, Google, WhatsApp, Zoom): Data synced from third-party integrations is retained for the duration of the integration connection and up to 90 days after disconnection, unless you request earlier deletion.
• Google connection tokens: Revoked with Google and deleted as soon as you disconnect your Google account in Supersei; see How we handle Google user data.
• Zoom connection tokens: Deleted as soon as you disconnect Zoom or remove the app; meeting records you created stay with your CRM data.
• Support and correspondence records: Retained for up to 3 years from the date of the last interaction.
• Cookie and tracking data: Governed by the cookie lifetimes described in our Cookie Policy.

When personal data is no longer required, we securely delete or anonymise it in accordance with our internal data retention and disposal procedures.

Your rights

Depending on your location, you may have the following rights with respect to your personal data. We will respond to verified requests within the timeframes required by applicable law (generally 30 days under GDPR, 45 days under CCPA).

Rights under GDPR (EEA and UK users)

• Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we use it.
• Right to Rectification: You have the right to request that we correct inaccurate or incomplete personal data without undue delay.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data where there is no compelling reason for its continued processing, subject to certain exceptions (e.g., legal obligations).
• Right to Data Portability: You have the right to receive personal data you have provided to us in a structured, commonly used, machine-readable format and to transmit that data to another controller.
• Right to Restriction of Processing: You have the right to request that we restrict processing of your personal data in certain circumstances, such as while a dispute about accuracy is resolved.
• Right to Object: You have the right to object to processing of your personal data based on our legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you believe we have not complied with applicable data protection law.

Rights under CCPA / CPRA (California residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: We do not sell personal information and do not share personal information for cross-context behavioural advertising purposes as defined by the CPRA. If this practice changes, we will provide a "Do Not Sell or Share My Personal Information" link and honour opt-out requests.
• Right to Limit Use of Sensitive Personal Information: You have the right to direct us to limit our use of sensitive personal information to purposes permitted by the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices, provide a different level of quality, or retaliate against you for submitting a privacy request.

To submit a CCPA request, contact us at privacy@supersei.ai or use the rights request form in your account settings. We may need to verify your identity before processing your request.

How to exercise your rights

To exercise any of the rights described above, please contact us at privacy@supersei.ai with the subject line "Privacy Rights Request." Please include sufficient information to allow us to verify your identity and locate your data. We will not charge a fee for reasonable requests and will respond within the applicable legal timeframe.

Children's privacy

The Supersei platform is a business-to-business (B2B) service intended for use by businesses and professionals. It is not directed at children. We do not knowingly collect personal data from any person under the age of 16 (or the relevant age of digital consent in the applicable jurisdiction).

If you believe that a child under 16 has provided us with personal data without appropriate consent, please contact us immediately at privacy@supersei.ai. Upon verification, we will take steps to delete that information promptly from our systems.

Cookies and tracking technologies

We use cookies and similar tracking technologies on our website and platform to provide core functionality, remember your preferences, analyse usage, and support our marketing activities. These technologies include first-party cookies set by supersei.ai and supersei.com, third-party cookies placed by partners such as Google Analytics, Meta Pixel, and our advertising networks, as well as local storage and session storage.

You can control your cookie preferences at any time through our cookie consent manager, which is presented when you first visit our website. You may also configure your browser to refuse some or all cookies, though this may affect the functionality of our services.

For a complete description of the cookies we use, their purposes, retention periods, and your opt-out options, please read our full Cookie Policy.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable law. When we make changes, we will:

• Update the "Last Updated" date at the top of this page
• Post the revised policy at supersei.ai/privacy
• Send an email notification to registered account holders for material changes
• Where required by applicable law, seek your consent before applying the updated policy to your personal data

We encourage you to review this policy periodically to stay informed about how we protect your information. Your continued use of our services after the effective date of any changes constitutes your acknowledgement of the updated policy, to the extent permitted by law.

Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy team:

• Email: privacy@supersei.ai
• Company: The Next Door AI Private Limited
• Website: supersei.ai

We aim to respond to all legitimate privacy enquiries within 30 days of receipt. If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection authority in your jurisdiction.