Privacy Policy

Superstellar Media Labs Private Limited ("Company", "we", "us", or "our") is committed to protecting your privacy and Personal Data. This Privacy Policy explains how we collect, use, disclose, store, and protect your Personal Data when you access or use our platforms superteams.ai and nextneural.superteams.ai (collectively, the "Platform" or "Services"). This policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, along with other applicable laws of India including the Information Technology Act, 2000.

By using our Services, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your Personal Data as described in this Privacy Policy. This Privacy Policy is available in all 22 languages specified in the Eighth Schedule of the Constitution of India — contact us at the details in Section 19 to request a translation.

1. Key Definitions

• Data Fiduciary — the Company, as we determine the purpose and means of processing your Personal Data.
• Data Principal — you, the individual to whom the Personal Data relates.
• Data Processor — any person who processes Personal Data on behalf of a Data Fiduciary.
• Personal Data — any data about an individual who is identifiable by or in relation to such data, including name, email address, phone number, identification documents, and other identifying information.
• Processing — any operation performed on Personal Data, including collection, recording, storage, use, disclosure, erasure, or destruction.
• Sensitive Personal Data — financial information, health data, biometric data, genetic data, transgender status, caste or tribe, religious or political belief, or any other category notified by the Government.
• Consent — a free, specific, informed, unconditional, and unambiguous indication of your wishes signifying agreement to the Processing of your Personal Data.

2. Data Fiduciary Information

The Company acts as a Data Fiduciary under the DPDP Act in relation to the Personal Data collected and processed through the Platform.

3. Personal Data We Collect

Information you provide to us

• Account registration — name, email address, phone number, password, organization name, job title, business address.
• Profile information — professional details, preferences, settings, profile photo.
• Payment information — billing address, payment method details (processed by third-party payment processors), GST identification number, PAN (if applicable).
• Communication data — support requests, feedback, inquiries, and correspondence when you contact us.
• User content — data, files, code, documents, and other content you upload or create using our Services.
• Survey and research data — responses to surveys or questionnaires you choose to participate in.

Information collected automatically

• Usage information — features accessed, actions taken, time and frequency of use, interaction with content.
• Device information — device type, operating system, browser type and version, unique device identifiers.
• Log data — IP address, access times, pages viewed, links clicked, referring page.
• Cookies and tracking technologies — see Section 12.
• Location data — general geographic location based on IP address (we do not collect precise GPS location).

Information from third parties

We may receive Personal Data from authentication services (Google, LinkedIn, Microsoft), business partners, third-party integrations you connect, publicly available sources, and analytics providers.

We generally do not collect Sensitive Personal Data. Where we do (e.g. financial information for billing), we obtain your explicit consent and implement additional security measures. We do not knowingly collect Personal Data from individuals under 18 without verifiable parental consent.

4. How We Use Your Personal Data

We process your Personal Data only to the extent necessary for the following purposes:

• Service provision — provide, maintain, and improve our AI and ML Services; process requests; manage and authenticate your account.
• Platform functionality — enable team collaboration, project management, API access, and third-party integrations.
• Payment processing — process payments, manage subscriptions, calculate usage-based charges, issue invoices.
• Communication — send service notifications, security alerts, support messages, and respond to inquiries.
• Analytics and improvement — analyse Platform usage, identify trends, develop new features.
• Security and fraud prevention — protect against unauthorized access and illegal activities.
• Legal compliance — comply with applicable laws, regulations, and government requests; enforce our Terms of Service.
• AI model training — train and improve our AI and ML models using anonymized and aggregated data.
• Marketing (with consent) — send promotional materials and newsletters; you may opt out at any time.

We do not sell your Personal Data to third parties. Where we rely on your consent as the legal basis for processing, you may withdraw consent at any time.

5. Legal Basis for Processing

Under the DPDP Act, we process your Personal Data based on the following grounds:

• Consent — you have given clear consent for specific purposes (e.g., marketing communications, certain integrations).
• Contract performance — processing is necessary to perform our contract with you and provide the Services.
• Legal obligation — processing is necessary to comply with legal obligations under Indian law (e.g., tax compliance, law enforcement requests).
• Legitimate interests — processing is necessary for our legitimate business interests (e.g., fraud prevention, service improvement, security), provided such interests do not override your rights.

6. How We Share Your Personal Data

We do not sell your Personal Data. We may share it with:

• Service providers and Data Processors — cloud hosting, payment processing, analytics, customer support, email services, and security vendors. All are contractually obligated to protect your data.
• Third-party integrations — when you choose to connect third-party services, we share necessary data with your explicit consent. You may revoke access through account settings.
• Business partners — companies we partner with for joint services or promotions, with your consent.
• Corporate transactions — in connection with any merger, acquisition, or sale. We will notify you of any such transaction.
• Legal and regulatory authorities — when required by law, legal process, or to enforce our Terms of Service, protect our rights, or prevent fraud.
• Aggregated / anonymized data — data that cannot reasonably be used to identify you may be shared for any purpose.

7. International Data Transfers

Your Personal Data is primarily stored and processed within India. When we transfer Personal Data outside India, we ensure:

• The recipient country is notified by the Central Government as providing adequate protection, or
• Appropriate safeguards such as Standard Contractual Clauses or binding corporate rules are in place, or
• The transfer is necessary for the performance of our contract with you, or you have explicitly consented after being informed of possible risks.

8. Data Security

We implement appropriate technical and organizational security measures including:

• Encryption of data in transit (TLS/SSL) and sensitive data at rest
• Multi-factor authentication and role-based access controls
• Regular security assessments, vulnerability testing, and penetration testing
• Security monitoring, intrusion detection, and incident response procedures
• Employee training on data protection and security best practices
• Vendor security assessments for third-party service providers
• Compliance with ISO 27001 and other security standards

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your Personal Data. You are responsible for maintaining the confidentiality of your account credentials.

9. Data Breach Notification

In accordance with the DPDP Rules, 2025, if we become aware of a data breach likely to cause harm, we will:

• Notify the Data Protection Board of India within 72 hours of becoming aware
• Notify affected Data Principals as soon as reasonably possible, with a description of the breach, categories of data affected, likely consequences, mitigation measures taken, and guidance on protective steps

10. Data Retention

We retain Personal Data only for as long as necessary. Specific retention periods:

• Account data — duration of active account plus 90 days after closure
• Payment and billing data — 7 years (tax and accounting regulations)
• Usage and log data — up to 2 years
• Support communications — 3 years
• Marketing communications — until consent is withdrawn, plus 90 days
• Legal and compliance data — as required by applicable laws or until conclusion of legal proceedings

After the retention period expires, we will securely delete, destroy, or anonymize your Personal Data. Anonymized or aggregated data may be retained indefinitely for analytics and research.

11. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights:

• Right to Access (§11(1)) — obtain confirmation of whether we are processing your Personal Data, a summary of the data and processing activities, and the identity of Data Processors and third parties.
• Right to Correction (§11(2)) — correct, complete, update, or amend inaccurate, incomplete, or outdated Personal Data.
• Right to Erasure / Right to be Forgotten (§11(3)) — request erasure when consent is withdrawn and there is no other legal basis, or when data is no longer necessary. We may retain data if required by law.
• Right to Grievance Redressal (§11(4)) — a readily available means of grievance redressal via our Data Protection Officer.
• Right to Nominate (§11(5)) — nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent (§11(6)) — withdraw consent at any time where processing is consent-based. Withdrawal does not affect the lawfulness of prior processing.
• Right to Complain — file a complaint with the Data Protection Board of India if you believe your rights have been violated.

To exercise any of these rights, email support@superteams.ai with subject line "Data Principal Rights Request", including your full name, email address, a description of your request, and proof of identity. We acknowledge within 7 days and respond within 30 days (extendable for complex cases). We do not charge a fee unless a request is manifestly unfounded or repetitive.

12. Cookies & Tracking Technologies

We use the following types of cookies:

• Essential / strictly necessary — required for the Platform to function. Cannot be disabled.
• Functional — enable enhanced functionality such as remembering your preferences and settings.
• Analytics / performance — help us understand how visitors interact with the Platform (e.g., Google Analytics).
• Advertising / targeting — deliver relevant advertisements (only with your consent).

We also use web beacons, pixels, local storage objects, and session storage. You can manage cookies via our consent banner, your browser settings, or by contacting us. To opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout. Disabling certain cookies may affect Platform functionality.

13. Third-Party Links & Services

Our Platform may contain links to third-party websites or services not operated by us. We are not responsible for their privacy practices. Before providing Personal Data to third-party sites, please review their privacy policies. When you integrate third-party services, we will inform you of what data will be shared, obtain your explicit consent, and allow you to revoke access through account settings at any time.

14. Marketing Communications

With your consent, we may send marketing communications about our Services, new features, promotions, and newsletters. You may opt out at any time by clicking "unsubscribe" in any marketing email, adjusting preferences in your account settings, or emailing support@superteams.ai. Even after opt-out, we may still send non-promotional service-related messages (security alerts, billing notifications, service updates). We do not sell or rent your Personal Data to third parties for their marketing purposes.

15. Children's Privacy

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect Personal Data from children under 18 without verifiable parental or guardian consent as required by the DPDP Act. If you are a parent or guardian and believe your child has provided us with Personal Data without your consent, please contact us immediately at support@superteams.ai and we will promptly delete such information.

16. Retrospective Data Notice (DPDP Compliance)

In accordance with the DPDP Rules, 2025, this Privacy Policy serves as retrospective notice for Personal Data collected before the effective date of the DPDP Act. If you were an existing user before the Act came into effect:

• Your Personal Data collected prior to the Act is now subject to the protections and rights under the DPDP Act.
• You may exercise your Data Principal rights (Section 11) with respect to all Personal Data we hold, regardless of when it was collected.
• If you do not wish us to continue processing your historical Personal Data, you may exercise your right to erasure.

17. Data Protection Board of India

If you have concerns about our data protection practices or believe your rights under the DPDP Act have been violated, you have the right to file a complaint with the Data Protection Board of India. We encourage you to contact us first so we can address your concerns, but you may file a complaint with the Board at any time. The Board has powers to investigate complaints, conduct inquiries, and impose penalties for non-compliance with the DPDP Act.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy with a new "Last Updated" date, sending an email notification, and displaying a prominent notice on the Platform. We will provide at least 30 days' notice before material changes take effect (unless required by law or to address security issues). Your continued use of the Services after the effective date constitutes acceptance. We maintain an archive of previous versions — contact us to request access.

19. Contact Us

For questions, concerns, or Data Principal rights requests regarding this Privacy Policy:

We acknowledge within 7 business days and provide substantive responses within 30 days.