Privacy Policy
Last updated: 2026 · Draft for review
Who we are
Superadditive provides AI-run exercises for work, strategy, and learning. Depending on how you use it, we act as the data controller (when you sign up and use Superadditive directly) or as a data processor (when your organization deploys a branded space and invites you: in that case your organization is the controller and we process data on their instructions). Contact us with any questions.
What we collect
- Account data: your name and email, and account settings.
- Exercise data: what you type or say during exercises (for example a résumé, business details, or your answers) and the reports and artifacts produced from them.
- Conversations: the interactive exchanges during exercises: both your messages and the AI's responses, turn by turn (voice as transcript, never audio), which we record to run the exercise, produce your results, and improve and research the service.
- Organization data: which organizations and cohorts you belong to, and your role.
- Usage data: which exercises you run and when.
- Voice: for spoken exercises, your browser converts speech to text on your device; we store only the transcript, never an audio recording.
How we use it, and our legal basis
- To provide the exercises and produce your results: performance of a contract.
- To keep the service secure and working: legitimate interests.
- To let a facilitator or organization see participation and aggregate insight for a cohort they run: on the organization's legitimate interests or your consent, as applicable.
- To improve the exercises and conduct research on learning and decision-making, and to develop our own models that make the service better: using de-identified data, with your consent.
AI processing
Exercises are run by AI. To generate your interview, feedback, or report, the text of your exercise is sent to our AI providers (see Sub-processors) purely to produce your result. Our providers process it under contract and do not use it to train their models. Our exercises are advisory (a human keeps the judgment), so they are not automated decisions with legal or similarly significant effects.
Sub-processors
We use vetted providers to run the service — hosting, database, AI, and payments. The current list, and what each does, is on our sub-processors page.
Sharing
We share data only with those sub-processors, with the organization that invited you (if any), and where required by law. Reports are private to you unless you explicitly choose to share one via a link.
International transfers
Some providers process data outside your country, including in the United States. Where required, these transfers are covered by Standard Contractual Clauses or equivalent safeguards in our agreements with each provider.
Retention
We keep your data while your account is active. You can delete your account at any time from your profile, which erases your account and its data. Where we act as a processor for an organization, retention follows their instructions.
Your rights
Subject to applicable law (including the GDPR), you can access, correct, export, delete, restrict, or object to the processing of your data, and withdraw consent. From your profile you can export your data and delete your account yourself. For anything else, email contact us. You may also complain to your local data protection authority.
If someone sent you a link
If you were invited to answer an interview, disclosure, or survey via a link (for example a customer interview or a team network survey), your responses are collected on behalf of the organization or person who sent it. They are the controller for that data; this notice explains how the platform handles it.
Cookies
We use only essential cookies needed to sign you in and remember your active organization. We do not use advertising or cross-site tracking cookies. See our cookie notice.
Changes
We'll update this page when our practices change and revise the date above.