Who we are
Stable Labs Corporation (“Superagent”, “we”) operates the Superagent service at thesuperagent.co. We are the data controller for the information described here. You can reach us at hello@withsuperpay.com.
Where you use Superagent to process information about your own customers, suppliers and counterparties, you are the controller of that information and we process it on your instructions.
What we collect
Account information
Your name, email address, phone number, and the company details you enter — importer or exporter identity, IEC, GSTIN, AD code, and the contacts you record against a trade.
Documents and messages you send us
Purchase orders, invoices, packing lists, bills of lading, certificates, bank statements, spreadsheets, photographs of documents, and the text of messages you send over WhatsApp or paste into the application. We keep the original file, the text we read from it, and the facts we extracted, so that every answer can be traced back to its source.
Connected mailboxes and calendars
If you connect an email account, we read messages in order to find trade documents. We store the message’s sender, subject, date, text, and any attachments we judged relevant. If you connect a calendar, we write deadline events to it.
Usage information
Sign-in times, actions taken in the application, and an append-only log of every change made to a trade — including changes made by the agent on your behalf. This log exists so that you can always see who did what, and it is deliberately not editable.
Google user data
Superagent’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect a Google account, we request only these permissions:
| Scope | What it allows | Why we ask |
|---|---|---|
gmail.readonly | Read messages and attachments. It does not allow us to send, delete or modify anything. | To find the trade documents that already arrive in your inbox, so nobody has to forward them by hand. |
calendar.events | Create and update calendar events. | To put document and payment deadlines in the calendar you already look at. |
We do not read your whole mailbox indiscriminately. Before anything is stored, each message is filtered: bulk mail, newsletters, automated senders, calendar invites and signature images are discarded without being processed further. A message is kept only when it carries a readable document or is clearly about a trade.
Google user data is never sold, never used for advertising, never used to train any general-purpose AI model, and never transferred to anyone except the service providers listed below acting on our instructions to operate the product for you. Human beings atStable Labs Corporation do not read your mail except where you explicitly ask us to investigate a problem, where it is necessary for security, or where the law requires it.
How we use it
- To read documents and turn them into structured facts about a trade.
- To reconcile those facts against each other and flag what is missing or contradictory.
- To answer your questions about a trade, and to draft messages that you send.
- To operate, secure and support the service, and to meet our legal obligations.
We may use aggregated statistics that identify neither you nor your counterparties — for example, how often a document type appears — to improve accuracy.
Automated processing and AI
We use large language models to read documents and draft text. Document contents are sent to our model providers for processing and are returned as structured data. Our providers act as processors under contract and, under the terms we use, do not retain your content to train their models.
Extraction is a proposal, not a decision. Values read from a document are recorded with their source, and consequential ones are held for a human to confirm. The agent never sends a message, submits a form, files anything with a government portal, or moves money. It drafts, and a person approves.
Who else processes your data
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and encrypted document storage |
| Vercel | Application hosting |
| Anthropic, OpenAI | Reading documents and drafting text |
| Meta, Twilio | Delivering and receiving WhatsApp messages |
| Google, Microsoft | Where you have connected a mailbox or calendar |
We do not sell personal information, and we do not share it for advertising. We may disclose information where the law requires it, or to protect our rights or someone’s safety.
Security
- Mailbox credentials and access tokens are encrypted with AES-256-GCM before they are stored. The key is held outside the database, so a copy of the database alone does not yield a usable credential.
- Documents are kept in private storage and reachable only through short-lived, signed links.
- Each workspace’s data is isolated at the database level, not only in application code.
- Access to production systems is limited to people who need it.
No system is perfectly secure. If a breach affects your information we will tell you without undue delay.
Where it is kept, and for how long
Our providers operate in several countries, so your information may be processed outside the country it was collected in. Where that happens we rely on the contractual protections our providers offer, including standard contractual clauses where they apply.
We keep trade records for as long as your account is active, because a trade is a record you may need years later for a customs, tax or banking query. When you delete a workspace we delete its documents and extracted data within 30 days, other than anything we must keep by law. Disconnecting a mailbox destroys the stored credential immediately.
Your choices
- Disconnect at any time. Remove a connected account from Connections in the application, or revoke our access from your Google or Microsoft account settings. Reading stops at once.
- Access and correction. Every fact we hold shows its source, and you can correct or reject any of them in the application.
- Export. A trade can be exported in full as structured data.
- Deletion. Write to hello@withsuperpay.com and we will delete your workspace.
Depending on where you live you may also have rights to object to or restrict processing, or to complain to a data protection authority.
Children
Superagent is a business tool and is not directed at anyone under 18.
Changes
If we change this policy in a way that materially affects you, we will tell you before it takes effect. The date at the top of this page always reflects the current version.
Contact
hello@withsuperpay.com — Stable Labs Corporation.