Superbime
Privacy Policy

Effective Date: October 1, 2026

This Enterprise Platform Privacy Policy (hereinafter referred to as this "Privacy Policy") constitutes a formal statement governing the collection, processing, storage, isolation, transmission, and protection of data by Superbime Pvt Ltd and its corporate affiliates (collectively, "Superbime", "we", "us", or "our") in connection with the provision and operation of Superbime’s multi-tenant orchestration system, encompassing real-time messaging, ticketing workflows, organizational analytics, and platform administrative control modules (collectively, the "Services").

This Privacy Policy applies to enterprise organizations and business entities that establish a workspace account with Superbime (hereinafter referred to as the "Customer", "Tenant", or "Employer"), as well as individual personnel, employees, contractors, and agents authorized by the Customer to access or interact with the Services (hereinafter referred to as "Authorized Users").

1. Definition and Scope

For the purposes of this Privacy Policy, "Customer Content" shall mean all electronic data, text, communications, messages, task items, tickets, form submissions, audio-visual files, attachments, system metadata, and operational performance metrics submitted, uploaded, transmitted, or generated within the Services by or on behalf of the Customer or its Authorized Users. "Personal Data" shall have the meaning ascribed to "personal data", "personal information", or "personally identifiable information" under Applicable Data Protection Legislation. "Applicable Data Protection Legislation" refers to all regional and international data protection laws, regulations, and statutory directives applicable to the processing of Personal Data hereunder, including, without limitation, the California Consumer Privacy Act as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"), the General Data Protection Regulation (EU) 2016/679 ("GDPR"), and the UK General Data Protection Regulation ("UK GDPR").

In determining statutory capacities under Applicable Data Protection Legislation, the Customer and Superbime acknowledge that with respect to all Customer Content processed within the Services, the Customer acts as the Data Controller (or "Business"), retaining sole legal responsibility for establishing the lawful basis for processing and directing the scope of processing operations. Superbime acts strictly as a Data Processor (or "Service Provider") processing Customer Content solely on behalf of, and pursuant to the documented instructions of, the Customer as set forth in the underlying Master Services Agreement and Data Processing Addendum. Superbime acts as a Data Controller solely with respect to minimal administrative contact records, billing data, and infrastructure security logs collected directly from Customer representatives and Authorized Users for the limited purposes of account provisioning, contract administration, identity verification, system security, and billing enforcement.

The scope and extent of individual Personal Data collected and processed across the Services are variable, conditional, and determined primarily by the Customer’s specific workspace configurations, active module toggles, identity provider integrations, administrative security choices, and contractual agreements. Superbime is designed to support a privacy-first operational posture that allows privacy-conscious Customers or smaller organizations to operate with an absolute minimal data footprint. However, depending on the administrative features, security protocols, identity configurations, and functional modules enabled or required by the Customer, Superbime may collect and process up to the following categories of individual Personal Data across the platform.

In connection with account administration and identity management, depending on whether the Customer deploys Single Sign-On (SSO) or local authentication, Superbime may process individual identifying details, including the Authorized User’s full legal name, professional work email address, corporate telephone number, job title, organizational department, display name, profile avatar image, Single Sign-On identity provider tokens, Security Assertion Markup Language (SAML) claims, encrypted password hashes for non-SSO accounts, Role-Based Access Control (RBAC) permission maps, and signed JSON Web Token (JWT) session claims. For billing and corporate administration, Superbime processes designated billing representative names, corporate billing email addresses, physical office addresses, tax identification numbers, payment card metadata, transaction histories, and enterprise subscription tier configurations.

In connection with system access, network security, and infrastructure logging, where device tracking, conditional access, or security logging features are explicitly enabled by the Customer administrator, Superbime may automatically collect technical and device telemetry, including unique hardware device identifiers, internet protocol (IP) addresses, operating system types and version builds, browser types and versions, browser user-agent strings, referring and exit page URLs, diagnostic crash reports, login attempt timestamps, interaction timing, and session duration logs. The Customer acknowledges and agrees that opting to disable or restrict these technical logging and device identification features minimizes the workspace data footprint, but may limit, impair, or compromise certain platform functionalities, including automated threat detection, device-level conditional access enforcement, session security auditing, and system diagnostic logs.

Within the operational execution of active functional modules (refer to Section 4), individual data processed as Customer Content may include user task assignments, ticket creation and resolution records, custom form entries, assignment matrices, SLA compliance logs, real-time presence indicators, synchronous and asynchronous message contents, thread interactions, file attachment properties, as well as individually attributed performance metrics compiled by the Statistics module, such as individual ticket resolution velocity, task completion rates, Key Result Area (KRA) monitoring outputs, and individual operational productivity analytics directly tied to the employee or Authorized User’s identity inside the workspace interface.

Where Superbime processes Personal Data in its capacity as a Data Controller (specifically Account and Administrative Data and Security Logs), Superbime relies on the following statutory legal bases under Applicable Data Protection Legislation: (a) Performance of a Contract under Article 6(1)(b) of the GDPR and UK GDPR to provision workspace accounts, administer Customer enterprise subscriptions, verify user identities, execute billing obligations, and provide technical account support; (b) Legitimate Interests under Article 6(1)(f) of the GDPR and UK GDPR to maintain infrastructure security, verify user access authorization, prevent fraudulent or unauthorized platform usage, protect network integrity, conduct internal threat monitoring, and enforce system access controls; and (c) Compliance with Legal Obligations under Article 6(1)(c) of the GDPR and UK GDPR where administrative records, billing details, and transactional data must be maintained to fulfill statutory accounting, tax, regulatory, or corporate recordkeeping mandates.

2. Fundamental Architectural Privacy Commitments

Superbime is engineered pursuant to strict statutory Privacy-by-Design and Privacy-by-Default principles. Superbime covenants that it shall not sell, rent, lease, trade, license, monetize, or otherwise disclose Customer Content or Personal Data to any third party for commercial, promotional, or advertising purposes. Superbime does not deploy third-party behavioral tracking tools, social media tracking pixels, advertising network software development kits, or cross-site fingerprinting technologies anywhere within the Services.

Superbime strictly prohibits unsolicited commercial outreach and shall not conduct marketing telephone calls or transmit promotional email communications to Authorized Users. All customer data processed by the Services is subjected to deterministic tenant isolation enforced at the software execution, network routing, and persistent database layers using explicit tenant identifiers. External infrastructure hosting providers engaged by Superbime operate strictly as encrypted, zero-knowledge storage hosts maintaining zero administrative, analytical, or human access to Customer Content.

3. Territorial Scope & Regional Restrictions

As of the Effective Date of this Privacy Policy, Superbime explicitly discloses that it does not maintain, lease, or operate server infrastructure, data storage facilities, or persistent processing nodes within the European Union (EU) or the European Economic Area (EEA). All data ingested, processed, or persisted by the Services is hosted in secure primary data centers situated outside the EU and EEA.

Because Superbime enforces strict alignment between data residency guarantees and its physical hosting footprint, Superbime does not currently onboard, accept enterprise subscriptions from, or render Services to organizations established or domiciled within the EU or EEA, nor does Superbime intentionally direct its offering to, or monitor the behavior of, data subjects situated inside the EU or EEA.

Superbime’s engineering roadmap includes the deployment of dedicated EU-region sovereign server cells. Native EU-region data residency and formal enterprise onboarding for EU and EEA-domiciled Tenants is scheduled for commercial release in February 2027. Prior to the formal deployment and operational activation of such infrastructure, any enterprise entity requiring local EU data residency must refrain from establishing a Superbime workspace.

4. System Architecture and Data Collection Scope

The Services operate across various integrated core domain modules executing within deterministic multi-tenant isolation boundaries. The modules ingest and process data as follows.

The Identity module governs user identity verification, organization hierarchies, Role-Based Access Control permission maps, single sign-on integration tokens, and signed JSON Web Token session claims. To maintain workspace integrity and enforce conditional access policies, the Identity and Directory Engine may record device identifiers, internet protocol addresses, operating system specifications, and browser user-agent strings within security authentication logs when enabled by the Customer. These system logs are used exclusively for security verification, threat detection, and session audit trails, and are never repurposed for cross-site tracking or user profiling.

The Core module operates as the system of record for task lifecycles, ticketing state machines, service level agreement trackers, form submissions, assignment matrices, and operational approval workflows. All data created or processed within this module is made accessible to authorized personnel inside the Customer’s workspace and is automatically appended to the relevant project group in which such tickets or tasks are raised.

The Messaging module governs synchronous and asynchronous channel communications, direct messages, thread metadata, attachment properties, presence indicators, and interactive ticket card objects embedded within conversation streams. Superbime treats conversational privacy as an unyielding fundamental feature even within an organizational, enterprise, or employment context. Superbime shall not, under any circumstances, including formal administrative demands or requests issued by the Customer or Customer representatives, disclose, extract, or provide the chat logs or conversational data of any employee or Authorized User to the Customer or its management representatives.

Superbime uses a Statistics module that calculates key result area metrics, ticket resolution velocity, and operational productivity analytics by passively ingesting time-series event streams off the system event bus and processing operational metrics. Within the internal Superbime system environment, these statistical and performance metrics are directly attributed and tied to individual employees and Authorized Users rather than utilizing aggregated, anonymized, or proxied data models, thereby enabling precise internal organizational tracking and performance evaluation. We also utilize an Admin module that manages workspace quotas, feature enablement matrices, subscription tiers, billing contacts, global security policy toggles, and system-wide health logs required to operate the enterprise environment. Furthermore, the Admin module provides designated workspace administrators with direct visibility into individual user performance statistics and metrics compiled by the Statistics module within the native Superbime user interface.

The processing of data within these modules is executed solely to calculate and display key organizational and individual metrics to the Customer within the platform interface. Superbime incorporates built-in technical safeguards designed to prevent the public disclosure or inadvertent exposure of individually identifiable metrics resulting from human error or unauthorized access, including strict platform controls that prohibit such statistics from being exported, extracted, or viewed outside the secure application interface. However, the Customer acknowledges and agrees that the ultimate responsibility for safeguarding administrative credentials, managing access permissions, and preventing human error or security lapses that could compromise individually identifiable metrics lies exclusively with the Customer organization. Superbime does not access or grant third parties access to such information, nor is this data accessible to third parties approved or designated by the Customer. Superbime shall not share, export, or transmit these administrative or statistical metrics outside the application to the Customer, Customer representatives, Customer-approved third parties, or any Governmental bodies through any physical or electronic medium, and all such metrics remain strictly confidential, non-exportable, and exclusively viewable inside the native Superbime administrative panel interface.

5. Third-Party Infrastructure, Subprocessors, and Security Commitments

Superbime engages vetted enterprise cloud infrastructure providers, including Amazon Web Services, Google Cloud Platform, and Microsoft Azure, to supply encrypted hosting, physical data center security, virtual infrastructure, and storage systems. These infrastructure vendors act strictly as Subprocessors operating under binding data protection agreements that restrict their operational scope to providing encrypted data hosting. Storing data on third-party cloud infrastructure does not grant the underlying provider technical access, authorization, or legal right to inspect, extract, or analyze Customer Content.

All data transmitted across public networks or between internal system modules is encrypted using TLS 1.3 protocols, and all persistent data at rest is encrypted using AES-256 cryptographic standards. Superbime does not integrate third-party web analytics services, commercial SDKs, or social media tracking mechanisms into the platform interface, nor does Superbime utilize Customer Content to train public or commercial artificial intelligence models.

Superbime maintains an updated list of authorized Subprocessors. Superbime shall provide the Customer with administrative notice at least thirty (30) days prior to engaging any new Subprocessor to host or process Customer Content. The Customer may object to the appointment of a new Subprocessor on reasonable data protection grounds by submitting a written objection to Superbime’s privacy team within fourteen (14) days of receiving such notice.

6. Data Retention, System Offboarding, and Purge Routines

Superbime retains Customer Content for the duration of the active subscription term, subject to the specific data retention schedules, workspace configurations, and deletion instructions established by the Customer’s designated workspace administrator. Upon the formal termination, cancellation, or expiration of the Master Services Agreement, Superbime executes an automated and irreversible system offboarding and data purge protocol. Data destruction and purge are primarily achieved through cryptographic erasure, whereby Superbime permanently revokes, overwrites, and destroys the tenant-specific cryptographic storage keys assigned to the Customer's isolated data payloads. The destruction of these cryptographic keys renders all associated Customer Content, database records, schema entries, and stored assets mathematically undecipherable, completely unrecoverable, and permanently inaccessible across all persistent storage volumes, active databases, and backup archives within fifteen days of contract termination. System security logs, containing device identifiers, internet protocol addresses, and session authentication telemetry, are segregated in isolated logging environments and retained solely for operational security and auditing purposes for a standard rotation cycle ranging between ninety and one hundred eighty days, following which they are permanently overwritten or cryptographically shredded in accordance with Superbime's automated infrastructure lifecycle protocols.

7. Policy Revisions and Administrative Notifications

Superbime reserves the right to update this Privacy Policy periodically to reflect technological modifications, architectural enhancements, or legal developments. In the event that Superbime makes material revisions to this Privacy Policy that alter the handling or protection of Customer Content or Personal Data, Superbime shall provide written notice to the Customer's designated administrative point of contact via electronic mail or through an administrative portal alert at least thirty days prior to the effective date of such changes.

8. Data Subject Rights and Request Routing

Because Superbime processes Customer Content strictly in the capacity of a Data Processor (or Service Provider) on behalf of the Customer, the Customer organization serves as the Data Controller (or Business) and retains sole legal authority, control, and responsibility over the workspace environment and the data processed therein. Consequently, any Authorized User or individual data subject seeking to exercise statutory data protection rights under Applicable Data Protection Legislation, including, without limitation, the rights to request information regarding data processing, access personal data, obtain copies of personal data, rectify inaccuracies, request erasure or deletion, restrict processing operations, object to processing, or request data portability, must direct such requests directly to the Customer’s designated workspace administrator. The Customer manages user accounts, site configurations, and permissions, and is legally responsible for verifying the identity of the requesting individual and evaluating the statutory applicability of any data subject request.

Superbime shall support the Customer in fulfilling its statutory obligations to respond to verified data subject requests. Superbime shall provide reasonable technical and organizational assistance to the Customer, in accordance with the procedures, operational protocols, and response timelines set forth in the governing Data Processing Addendum. In the event that an Authorized User or third-party data subject submits a data subject request directly to Superbime, Superbime shall promptly redirect the requesting individual to the Customer’s designated workspace administrator and notify the Customer of the incoming inquiry. Superbime shall not independently modify, extract, disclose, or delete any Customer Content or Personal Data contained within a Customer workspace in response to a direct data subject request, unless explicitly instructed in writing by the Customer’s authorized administrative representative.

Furthermore, where Superbime is served with a binding judicial court order, search warrant, subpoena, or mandatory statutory directive from a law enforcement or governmental body requiring the production of data, Superbime’s compliance shall be strictly limited to the minimum necessary base operational data, ticket state records, and task metadata processed exclusively by the Core module. Personal communications, direct messages, channel chat logs, and conversation threads transmitted via the Messaging module are treated as immutable, cryptographically protected private assets that are strictly off-limits. Under no circumstances, including the service of a binding court order, legal warrant, or governmental demand, shall Superbime extract, decrypt, access, or disclose any employee chat logs or messaging content to any third party, government authority, judicial body, or Customer management representative.

Certain self-service functionalities, such as updating basic profile credentials, managing individual display preferences, or correcting name and contact information, may be executed directly by Authorized Users within the user interface of the Identity module. However, requests pertaining to workspace content, task tickets, or operational metrics are governed by the Customer’s administrative policies. Furthermore, the Customer acknowledges that certain administrative and statistical metrics compiled within the Statistics or Admin modules are bound by platform security safeguards that render them non-exportable outside the application interface, and that security audit logs containing device identifiers and session telemetry are maintained within isolated environments subject to mandatory security rotation schedules that may exempt such technical logs from immediate erasure requests where retention is required for legal, auditing, or threat prevention purposes.

9. Security Incident and Data Breach Management

Superbime maintains a comprehensive incident response framework and continuous threat monitoring architecture designed to detect, isolate, investigate, and remediate potential security events, system vulnerabilities, or unauthorized access attempts. Superbime deploys enterprise-grade administrative, physical, technical, and organizational safeguards, including end-to-end encryption for data in transit, cryptographic storage isolation at rest, automated intrusion detection, and strict access controls, designed to protect Customer Content and Personal Data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, or access.

In the event that Superbime confirms a security incident resulting in verified unauthorized access, acquisition, exposure, alteration, or destruction of Customer Content or Personal Data residing on Superbime systems or infrastructure ("Security Incident"), Superbime shall notify the affected Customer’s designated primary administrative point of contact and security officer without undue delay and, in any event, no later than seventy-two hours following formal internal confirmation of the Security Incident. Such notification shall be delivered via electronic mail or direct administrative portal communication and shall set forth, to the extent known at the time of notification: a description of the nature and scope of the Security Incident; the categories and approximate volume of affected Customer Content or Personal Data records; the anticipated impact or consequences of the incident; the immediate containment and remediation measures undertaken by Superbime; and the contact details of Superbime’s dedicated security incident lead.

Superbime shall take immediate corrective action to contain, mitigate, and remediate the effects of any confirmed Security Incident. Superbime shall conduct a thorough post-incident forensic investigation and shall provide ongoing, reasonable status updates and supplementary reports to the Customer as additional verified details become available. Superbime shall further cooperate with the Customer to assist in fulfilling its statutory notification obligations to relevant supervisory authorities, government regulators, and affected data subjects under Applicable Data Protection Legislation. The Customer acknowledges and agrees that Superbime’s obligation to report a Security Incident under this section does not constitute an admission of fault or liability by Superbime. Routine, unsuccessful security events, such as unsuccessful ping attempts, port scans, denial-of-service attacks that do not breach perimeter defenses, or failed login attempts that do not compromise account security, shall not constitute a Security Incident triggering formal notification under this Privacy Policy.

10. Commercial Use and Age Restrictions

The Services are designed, marketed, and intended exclusively for enterprise business entities and commercial use by Authorized Users. Superbime enforces a mandatory global minimum age requirement: all Authorized Users must be at least eighteen (18) years of age, or have reached the minimum legal employment age or age of majority in their applicable jurisdiction, whichever is higher. Superbime enforces a strict baseline floor of eighteen (18) years globally; notwithstanding anything to the contrary under local or regional law, even where the legal age of majority, digital consent, or minimum employment age in a given jurisdiction is lower than eighteen (18) years, Superbime does not accept, permit, or onboard any individual under eighteen (18) years of age to access or utilize the Services. Conversely, where applicable local law in an Authorized User's jurisdiction mandates a statutory employment age or age of majority higher than eighteen (18) years, that higher legal age threshold shall automatically serve as the mandatory minimum floor for Authorized Users residing or operating within that jurisdiction.

Superbime does not knowingly collect, process, or solicit Personal Data from any individual who fails to satisfy these applicable age thresholds. If a Customer, employer, parent, or guardian becomes aware that an under-age individual has provided Personal Data or gained access to a Superbime workspace, they shall notify Superbime’s privacy operations team immediately for account remediation. Furthermore, if Superbime discovers, determines, or receives verified notice that a Customer organization has breached these age parameters by onboarding or permitting access to an under-age individual, Superbime reserves the right, in its sole discretion and without prior notice or liability to the Customer, to immediately suspend the workspace and execute an emergency cryptographic purge and permanent deletion of the violating Customer organization's entire database and workspace data. This immediate purge mechanism is maintained as an extraordinary protective safeguard to enforce statutory minor privacy rights, fulfill child data protection mandates, and prevent the persistence of minor Personal Data across Superbime infrastructure.

11. Contact Information and Escalations

Inquiries, formal notices, security audit requests, or data protection queries regarding this Privacy Policy or Superbime’s technical security measures shall be directed to Superbime’s dedicated privacy operations team. To ensure rapid response times, swift administrative action, and dedicated resource allocation, Superbime provisions dedicated privacy contact channels to Customer organizations at a ratio of one dedicated privacy line for every one hundred Authorized Users. The specific dedicated electronic mail addresses assigned to the Customer are communicated directly during the initial workspace onboarding process, displayed within the billing administrative portal, and explicitly set forth at the bottom of all official billing invoices and routine transactional communications transmitted to the Customer.

Formal legal written notices, statutory correspondence, or physical service of process may be delivered to the corporate physical address designated on the Customer's official billing invoice, Master Services Agreement, or enterprise order form corresponding to the Customer's applicable contracting regional entity.