Super Carl Privacy Policy
Last updated: October 13, 2026
At Super Carl, trust and transparency matter.
Super Carl is operated by Super Carl Inc.
This Privacy Policy explains how Super Carl ("Super Carl," "we," "our," or "us") collects, uses, stores, and shares information when you use our website, applications, APIs, integrations, MCP services, and related features (the "Services").
By using Super Carl, you consent to the practices described in this Privacy Policy.
1. Information We Collect
A. Information You Provide
When you create an account or use the Services, we may collect:
- Name
- Username
- Email address
- Phone number
- Profile photo
- Professional information
- Messages and prompts
- Projects and workflows
- Uploaded content
- Support requests
You may update or delete certain information through your settings.
B. User-Provided Data, Imports, Integrations, and Authorized Workflows
You choose what information to provide to Super Carl. This may include information you enter, paste, upload, import, connect, or otherwise authorize us to process from sources, accounts, files, tools, or services that you use or control. Super Carl does not decide what third-party information you are allowed to provide; you are responsible for choosing what to provide and for making sure you have the rights and permissions needed to provide it.
Depending on what you choose to provide or authorize, this may include:
- Profile and professional information
- Contacts or connection information you provide or that is included in an export you provide
- Calendar availability
- Communication content or metadata
- Public activity
- Social or professional interaction signals
- Relationship-path information generated by Super Carl
- Operational or session information needed to complete a user-directed workflow
Super Carl does not own your third-party accounts, contacts, connections, or content. We process this information to provide the Services you request, under your direction, and subject to your settings, consent, disconnection, deletion, and retention controls.
Your use of third-party services remains governed by those services' own terms and policies.
C. Chrome Browser Extension and Connected Website Sessions
The optional Super Carl Chrome extension connects your LinkedIn, X, Instagram, Luma, or Partiful account when you choose that feature. The extension requests site access when you start a connection, and Chrome asks you to approve the website access. For the current connection flows, Super Carl uses the selected provider's HTTPS website. You can turn off session capture in the extension or revoke the website access in Chrome. Those controls stop new session collection and clear cached session payloads; they do not delete information already transferred to Super Carl or kept in a connected provider browser context.
When you choose to share a browser session, the extension reads cookies for the selected provider's website, including cookie names and values, domain, path, expiry, and security settings, and the current provider page URL. Luma and Partiful session capture removes URL query and fragment values; LinkedIn, X, and Instagram session payloads can include them. Where configured, it can also read specifically named local or session storage keys or a bounded record from website storage. The current Partiful connection reads one Firebase authentication record that can contain the provider account UID, app API key, access token, refresh token, and token expiration time. The current Luma connection reads provider cookies and does not configure additional browser-storage keys. LinkedIn, X, and Instagram connections can read all local and session storage entries from the selected provider website; those entries may contain account or website content. Their session payloads may also include browser and device details such as browser/OS version, language, time zone, platform, screen and window size, and device capability; and available profile details such as a display name, handle, profile URL, or avatar.
The extension sends the selected session data to the Super Carl app and its authenticated API. For LinkedIn, X, and Instagram, Super Carl stores browser-session data in encrypted form for those connected features. For Luma and Partiful browser connections, Super Carl relays the session data to Browserbase, which hosts the authenticated browser and receives the provider cookies and, for Partiful, the selected authentication record. A verified Luma or Partiful account can have a reusable Browserbase browser context while it remains connected; Super Carl stores an encrypted reference to that context. The raw cookie and authentication-token values are used to sign in to the selected website and are not included in AI prompts. When needed for a user-directed browser task, bounded visible page text, the page URL, task instructions, and workflow context may be processed by the AI providers listed in Section 4. Screenshots sent to an AI model for a browser action are limited to specific visible controls and are suppressed when a credential form is present. Your own private browser preview can display the page, including its sign-in form.
Our handling of extension-derived information complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. These restrictions apply to raw information and information derived from it, including aggregated or de-identified information, and take precedence over the general use and sharing descriptions elsewhere in this policy. We use this information only to provide and maintain the account, contact, event, or browsing feature you request or enable. Those features may read provider contacts and followers, event details and guest names or profile links you can access, and social message content or interaction metadata when you request or enable the corresponding messaging feature. We transfer it only when necessary to provide or maintain that feature, comply with law, protect against malware, spam, phishing, fraud or abuse, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent. We do not sell it or use or transfer it for personalized advertising, data brokers, unrelated profiling, creditworthiness or lending. Humans may read it only with your explicit consent to read specific data, when needed for security or legal compliance, or when it is aggregated and anonymized and used for internal operations in accordance with applicable law. Browserbase live sessions have a provider timeout of 30 minutes for Luma and Partiful connection flows. A verified account can keep a separate reusable Browserbase context while connected; we do not specify a fixed retention period for that context.
When you disconnect or request deletion of a Luma or Partiful account, Super Carl closes or revokes its Browserbase context and removes the stored reference after Browserbase confirms deletion. Disconnecting or deleting LinkedIn, X, or Instagram removes its saved browser-session data through the applicable account controls. Revoking Chrome website access alone does not delete saved account data from Super Carl or Browserbase. On your device, LinkedIn, X, and Instagram session payloads may be cached in temporary Chrome session storage and are treated as expired when next read after 30 minutes; Luma and Partiful payloads are transferred on demand and are not cached in extension storage. The extension may keep a LinkedIn profile name and avatar snapshot locally and treats it as stale after an hour; that stale check does not automatically delete it. Turning off capture or revoking website access does not delete this local snapshot or diagnostic history; uninstalling the extension removes its local storage. It also keeps up to 80 diagnostic events on your device, such as event names, service names, extension version, timestamps, and limited details; some reportable errors are sent to Super Carl's feedback service. Diagnostic fields with names suggesting cookies, tokens, sessions, passwords, secrets, CSRF, or authentication are filtered out.
2. How We Use Information
We use information to:
- Operate the Services
- Authenticate users
- Carry out user-directed imports, browsing assistance, account-assistance workflows, drafting, outreach, and other actions you request or approve
- Generate AI-powered recommendations
- Draft outreach
- Analyze relationship paths
- Coordinate workflows and projects
- Improve search and ranking systems
- Detect abuse and fraud
- Secure the platform
- Provide support
- Improve product quality and reliability
We may use aggregated, anonymized, or de-identified information to improve our systems and Services.
3. Relationship Intelligence & Inferred Data
Super Carl may generate inferred insights using available signals and interactions, including:
- Relationship strength
- Reachability
- Communication likelihood
- Intro path recommendations
- Intent signals
- Network mappings
These inferences are probabilistic and may not always be accurate.
4. AI Processing Providers
Super Carl uses third-party AI and cloud providers to operate portions of the Services.
Providers may include:
- OpenAI
- Anthropic
- Amazon Web Services
- Google Cloud
- Other infrastructure and AI providers
Depending on the feature, we may share:
- Prompts and project information
- Messages and conversation context
- Workflow information
- Professional context
- Operational metadata
We use these providers to:
- Generate AI-powered responses
- Improve search and ranking
- Power voice and language features
- Detect abuse and maintain safety
- Operate infrastructure and hosting
We seek to minimize direct personal identifiers where practical.
We do not sell personal information.
We do not sell your contacts, connections, or relationship data, and we do not provide them as a standalone data product.
We do not use personal information for targeted advertising.
For current AI providers and processing details, visit:
https://supercarl.ai/ai-processors
5. How We Share Information
We may share information:
- With other users when necessary for networking, introductions, messaging, collaboration, or shared projects
- With service providers operating on our behalf
- With AI and infrastructure providers
- During mergers, financing, or acquisitions
- To comply with legal obligations
- To protect rights, safety, and security
We do not sell personal information to advertisers or data brokers.
Mobile Messaging Data and Consent
When you message Super Carl by SMS, MMS, or RCS, we process your mobile number, message content, delivery information, messaging preferences, and account-linking evidence to respond to your requests, verify account links you initiate, provide support, and operate message delivery and opt-out controls.
We do not sell your mobile number or messaging opt-in data and consent, or share them with third parties or affiliates for marketing or promotional purposes.
The sharing categories above exclude messaging opt-in data and consent. We do not share that information with third parties or affiliates, except with aggregators and messaging service providers acting on our behalf solely to operate and deliver this messaging service. It is not shared for their own marketing or promotional use.
6. Usage Data & Analytics
We automatically collect certain technical and usage information, including:
- Device and browser information
- IP address
- Session activity
- Feature usage
- Crash logs
- Performance metrics
- Approximate location
We use cookies and similar technologies to operate and improve the Services.
7. Data Retention
We retain information:
- As long as necessary to provide the Services
- To comply with legal obligations
- For fraud prevention and security
- For legitimate business purposes
You may request deletion of your account at any time.
Certain information may remain in backups or de-identified systems for security, compliance, and operational purposes.
8. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information, including:
- Encryption in transit
- Access controls
- Authentication protections
- Infrastructure monitoring
No system can guarantee absolute security.
9. Your Rights & Controls
Depending on your location, you may have rights to:
- Access information
- Correct information
- Delete information
- Export information
- Disconnect integrations
You may manage integrations and account settings directly through the platform.
Privacy-related requests may be sent to:
legal@supercarl.ai
10. International Data Transfers
Your information may be processed and stored in countries other than your own.
By using Super Carl, you consent to international data transfers where permitted by law.
11. Children's Privacy
Super Carl is not intended for users under 13.
If we learn we have collected information from a child under 13, we will take reasonable steps to delete it.
12. Third-Party Services
Super Carl may integrate with or link to third-party services.
We are not responsible for the privacy practices or content of third-party platforms.
Your use of third-party services is governed by their own terms and policies.
13. Changes to This Privacy Policy
We may update this Privacy Policy periodically.
If material changes are made, we may notify users through:
- Email
- In-app notices
- Website updates
Continued use of Super Carl after updates means you accept the revised Privacy Policy.
14. Contact
Questions regarding privacy or data protection may be sent to:
legal@supercarl.ai