Privacy Policy
Version 2026-10-15 · Effective [DATE] · Draft for legal review · Tiếng Việt
Superlytix.ai turns the spreadsheets you upload into Power BI reports. This policy explains what personal data we handle, why, where it goes and what you can do about it. A plain-language walk-through is at How we handle your data. It is written to meet Vietnam's Law on Personal Data Protection and Decree 356.
1. Who we are
Superlytix.ai is run by [COMPANY], [ADDRESS], tax code [TAX CODE]. The person responsible for personal data protection is [DPO], reachable at [email protected].
2. Two kinds of data, two roles
| Data | Examples | Our role |
|---|---|---|
| Your account | Name, email, password (stored only as a salted hash), plan, consent records, sign-in times | Controller: we decide how it is used |
| Your uploaded files | Sales exports, customer lists, staff names inside your spreadsheets | Processor: we process it only to build your report, on your instructions |
For uploaded files, you (or your company) are the controller. You confirm you have the right to upload the data and, where needed, the consent of the people in it. Our Data Processing Agreement sets out exactly how we handle your files and applies automatically; business customers can ask for a countersigned copy.
3. What we use your data for
- Account data: to create and secure your account, keep your projects, apply your plan and limits, and contact you about the service. Legal basis: your consent and the contract with you.
- Uploaded files: to read the columns, check the data, build the model and preview, and generate the Power BI project, Excel report and PDF report you download. Nothing else.
- Survey and feedback answers (optional: your field of work, role, company size, tools and how you found us when you sign up; ratings and comments after a download): to understand who uses Superlytix, decide what to build next and improve our marketing. They are never sold and never shared outside Superlytix, and they never contain your files. The one exception you choose: if you tick "May we show…" in the feedback form, we may show your sentence, star rating and the name you chose on superlytix.ai, word for word, until you ask us to remove it or delete your account. The welcome survey is part of signing up (it comes with a free Single Use credit); feedback is optional. Legal basis: your consent. So that the free credit is given once per inbox, we keep a one-way code made from your email address (not the address itself), also after you delete your account.
- Waitlist (if you joined our waitlist on superlytix.ai): your email address, collected through our form provider Formspree, and the personal discount code we create for it. Used to email you when early access opens, send your code and recognise it when you sign up. Legal basis: your request to join. To be removed, email [email protected].
- Consulting requests (if you use "Book a free intro call" on superlytix.ai): your name, email address and, if you give them, your company and phone number, plus what you tell us about your goals, budget and data. Used only to answer you, prepare a quote and, if we work together, deliver the consulting. We keep the request and email it to our support inbox. Legal basis: your request. Do not put customer records or other personal data from your files in the form.
- We do not publish, sell or disclose your files, do not use them for advertising or any purpose of our own, and do not train AI models on them. No one at Superlytix opens your files unless you ask us to for support, it is needed to investigate a security incident, or the law requires it.
4. What the AI sees
On paid plans, some steps (describing tables, the plan, Check, Adjust logic, visual ideas and the PDF summary) use Anthropic's Claude through its business API. The Free plan sends nothing to the AI. The AI receives:
- column names, types and counts;
- summaries of columns: ranges and averages for numbers, the values of short lists such as regions or statuses;
- your descriptions, questions and requested metrics, and the formulas of your metrics;
- for the PDF report's summary: the report's key figures and the findings computed from them (totals, changes and shares, never rows).
The AI never receives your rows. Columns that look like personal data (names, phone numbers, emails, addresses, tax or ID numbers, dates of birth) are summarised as counts and a pattern only. If one of their values appears anywhere else in a request, for example in a question you typed, a formula or a finding sentence, it is replaced by a placeholder such as «V1» before sending, and put back only on our side. If you switch off value summaries on the Describe step, every value from your data is replaced the same way, so the AI receives only names of tables and columns, types, counts and your wording. Detection is automatic and may miss a column with an unusual name or format; if that matters, remove the column before uploading or switch the summaries off.
Anthropic deletes the data we send within 30 days, except where it must keep it longer to enforce its usage policy (up to 2 years for requests its safety systems flag) or to meet a legal obligation. Under its commercial terms it does not use this data to train its models.
5. Where your data is stored
Your files and projects are stored on Railway (Singapore region), on encrypted disks, with HTTPS on every connection. Daily encrypted backups are kept for 14 days on Cloudflare R2; Cloudflare decides where those copies are physically stored, which may be outside Vietnam and Singapore. AI requests are processed by Anthropic in the United States. Our website is served by Cloudflare's global network. Our hosting provider keeps technical logs (request times, addresses, errors) for up to 30 days; an error message may occasionally include a column name or value. You agree to these transfers outside Vietnam when you accept our Terms, and we cover them in the cross-border transfer impact assessment that Vietnamese law requires.
Payments. Paddle.com Market Limited (United Kingdom) is our Merchant of Record: it takes your payment, issues invoices and handles tax, under its own privacy notice (paddle.com/legal/privacy). Paddle shares with us your name, email address, country, what you bought and the payment status; we never receive your full card details. Transactional emails (sign-in links, password resets, invitations, consulting requests) are sent through Resend (United States). The waitlist form is run by Formspree (United States).
6. How long we keep it
| Data | Kept for |
|---|---|
| Projects and uploaded files, Free plan | 3 days after the project is created |
| Single Use | 3 days after it is unlocked |
| Plus | 30 days |
| Pro | 90 days |
| Enterprise | Until you delete them |
| Your account | Until you delete it |
| Payment records (what was bought, when, amount) | As long as tax and accounting law requires, even after you delete your account |
| Downloaded Power BI, Excel and PDF files | Only on your computer: we do not keep a copy longer than the project |
| Survey answers, ratings and feedback | Until you delete your account |
| Consulting requests | Up to 2 years after our last contact; longer only if we work together and tax or accounting law requires records |
| Technical logs at our host | Up to 30 days |
| What we send to the AI | Deleted by Anthropic within 30 days (longer only for flagged requests or legal obligations, as in section 4) |
Deleting a project or your account removes the files immediately from our servers; backups expire within 14 days.
7. Your rights
You can, at any time and free of charge:
- see and download your data: Account → Download my data;
- correct your name or email;
- delete a project, or your whole account: Account → Delete my account;
- withdraw consent, which means deleting your account;
- object or complain by writing to [email protected]; we confirm we have received your request within 72 hours and complete it within the period the law requires. You can also complain to the Ministry of Public Security, the data protection authority in Vietnam.
8. Security
Passwords are stored as salted PBKDF2 hashes. Sessions use secure, HTTP-only cookies. Each account sees only its own projects. We work to protect your data and keep improving our measures, but no website, server or network can be made completely secure, so we cannot guarantee that your data will never be accessed, lost or disclosed without authorisation. Please upload only the data your report needs and keep your own copies. If a breach affects your personal data, we notify the authority within 72 hours and tell affected users without undue delay.
9. Cookies
We use one necessary cookie to keep you signed in. We use no advertising or tracking cookies.
10. Children
Superlytix.ai is a business tool and is not intended for anyone under 18.
11. Changes
We will tell you by email and in the app before any material change to this policy, and ask you to accept it again. If you do not accept it, you can download your data and close your account.
12. Language
This policy is published in English and Vietnamese (Tiếng Việt). If the versions differ, the Vietnamese version prevails for people in Vietnam where Vietnamese law requires it, and the English version prevails in every other case.