©2025
GLOBAL PRIVACY POLICY
(The "Privacy Policy")
INFINITY CONSTELLATION INC. D/B/A SUPERNAL
Last Reviewed: August 4, 2025
Thank you for visiting [https://www.getsupernal.ai/] and our other related digital platforms (the “Websites”). At Infinity Constellations Inc. (d/b/a Supernal), a U.S.-based AI agent service provider ("Company," "we," "us," or "our"), we take your privacy seriously. This Global Privacy Policy outlines how we handle your Personal Information when you interact with us through our Websites, our managed artificial intelligence services or any other of our services (the “Services”), or any public-facing activities.
By accessing or using our Websites or Services, you acknowledge that you have read and understood this Policy, and that you consent to the collection, use, and disclosure of your Personal Information as described herein.
By “Personal Information” we mean any information that can be used to identify a specific person, either on its own or when combined with other details. This includes obvious things like your name, email address, phone number, or home address, but also covers less obvious details like your IP address.
As part of our commitment to continuous improvement, we may update this Policy periodically. We will notify you of material changes by posting an update on our website, or, if available, by email.Continued use of our Services after any posted changes signifies your agreement to those changes.
Please refer to the sections below titled “Your Rights in the United Kingdom, Switzerland, EU and EEA,” and “Your Rights in California” for details on how to exercise your rights under certain region-specific applicable data protection laws.
This Global Privacy Policy ("Policy") explains how the Company collects, uses, discloses, process, stores, and protects Personal Information of individuals who interact with us, including but not limited to:
This Policy applies globally and strives to comply with applicable data protection and privacy laws, including but not limited to the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act and California Privacy Rights Act ("CCPA/CPRA"), and other national or regional data protection frameworks.
This Privacy Policy also describes your rights with respect to personal information, and how to exercise them.
This Policy does not apply where we process Personal Information solely on behalf of our business customers, acting as a data processor or service provider. For example, this may include circumstances where your employer has provided you access to one of our AI products, or you are interacting with an application or service that is powered by our AI technology in the background.
In all cases where a third-party like an employer or service provider provides us with your Personal Information, we process your Personal Information on the basis of our agreement with the corresponding third party providing us with your Personal Information. The corresponding third party is the controller of your Personal Information, and their privacy policy will apply. We encourage you to consult the privacy policy of the corresponding company with whom you have a direct business relationship for information about how your data is handled in those situations. If you have questions regarding their data handling practices or their sharing of information with us, please contact the relevant organization directly.
This Policy does not apply to our current or former employees, nor to any person who engages in a specific contractual relationship with us and agrees to a particular privacy policy that differs from the present Privacy Policy. If you are in such a case, please refer to your agreed and applicable policy.
To help you understand the foundation of this Policy and how we handle Personal Information, here are some important highlights:
We collect different categories of Personal Information in a variety of contexts and for diverse purposes. These include data you voluntarily provide, data we automatically collect based on your use of our Websites and Services, and data we gather or receive to support and improve our Websites and Services.
Each data collection situation is described in detail, including the types of data collected, how the data is used, the lawful basis relied upon for such processing, and any third parties with whom the data may be shared.
For your convenience and transparency, see below a comprehensive table, outlining our standard data collection and process activities, including :
This framework ensures a detailed, lawful, and transparent approach to data collection, consistent with our obligations under global privacy regulations.
We may need to use any of your Personal Information to comply with legal requirements and exercise or defend legal claims.
To ensure the data we hold is up-to-date we may periodically ask you to confirm this information or we may supplement this information with additional data we collect from other sources.
We may aggregate and anonymise Personal Information such that it is no longer Personal Information for the purposes of enhancing our services and business practices.
Where we process your personal information, we do so in accordance with applicable privacy laws. The most common legal bases we rely on are:
While we primarily rely on the legal bases outlined above, there may be limited circumstances in which other legal grounds apply to the Processing of your Personal Information. These may include:
Our websites and applications may contain links to websites or platforms operated by third parties. We do not control, and are not responsible for, the privacy practices, content, or security of such third-party websites. The presence of a link to a third-party site does not imply endorsement by us. We strongly encourage you to review the privacy policies and data protection practices of any third-party platform or website before providing your Personal Information to them.
We use cookies and similar technologies to provide functionality, enhance your browsing experience, deliver personalized content and advertisements, and analyze usage patterns. Our websites and applications deploy cookies that are essential for their technical operation, as well as non-essential cookies for analytics, marketing, and customization.
Where required by applicable law—such as the GDPR, UK GDPR, and Quebec’s Law 25—we obtain your prior consent before placing any non-essential cookies on your device. This ensures that only strictly necessary cookies are active by default unless and until you consent otherwise.
We honor browser-based “Do Not Track” signals and Global Privacy Control settings where legally required. You have the right to manage your cookie preferences and withdraw consent at any time by accessing our cookie management platform, which is available via the “Cookie Settings” link located in the footer of our website.
Through this platform, you can:
Your preferences will be stored using a browser cookie, so please note that if you delete your cookies or use a different browser or device, you will need to set your preferences again.
When we share your personal information, we do so in accordance with applicable data protection laws. This includes implementing appropriate safeguards such as transferring data only to jurisdictions with adequate protection, using standard contractual clauses approved by regulatory authorities, or binding intercompany agreements.
As a global organization, we may share Personal Information among our affiliated entities, subsidiaries, and global offices. All such transfers are governed by intercompany agreements aligned with international data transfer standards (see the section below on “Where Is Your Personal Information Stored?”).
We may work with resellers, distributors, or strategic partners to deliver our services. If needed to fulfill obligations, we may share Personal Information with these partners, especially when they assist in customer support, onboarding, or provisioning of services.
We may rely on trusted third-party vendors and services providers to support our operations and help us in our duties towards you. When doing so, such vendors and service providers may access your Personal Information in the following situations:
We engage third-party vendors and service providers under legally binding agreements that govern their access to and processing of Personal Information. These agreements require such third parties to implement appropriate safeguards and adhere to our instructions regarding the protection and use of Personal Information.
Where applicable, these arrangements may include compliance with recognized international data transfer frameworks, such as the Data Privacy Framework (DPF), including any relevant extensions or equivalents.
We remain responsible and accountable under applicable data protection laws for the actions of our third-party agents who process Personal Information on our behalf, except where we can demonstrate that we are not responsible for the event giving rise to the non-compliance.
We use service providers and sub-processors to help us deliver our Services. We strive to ensure that all sub-processors adhere to data protection obligations consistent with this policy. We maintain and publish an up-to-date list of sub-processors, accessible at: https://www.getsupernal.ai/legal/subprocessors
We may also use and disclose personal information, as we believe to be necessary, appropriate, or required for Legal and Regulatory compliance.
That situation includes the following disclosures :
Our group, including our related entities may at times be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements and shall do so in compliance with applicable laws and regulations.
We implement robust technical and organizational measures to safeguard Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These security measures are tailored to the nature, scope, context, and purposes of the data processing, as well as the risks posed to individuals.
Specifically, we apply industry-standard security practices where relevant. For example, we may leverage measures such as encryption at rest and in transit, strict access controls and authentication protocols, continuous monitoring, vulnerability management, and regular audits.
All personnel with access to Personal Information are trained in privacy and security best practices and are bound by confidentiality obligations.
If you suspect or become aware of any security vulnerabilities, incidents, or unauthorized access involving your Personal Information or our systems, please notify us immediately by contacting us at Legal@getsupernal.ai. We take such notifications seriously and will respond promptly in accordance with our incident response protocols.
We operate from the United States, and the majority of the Personal Information we collect is processed and stored within infrastructure located in the United States . In accordance with the global nature of our business, we may transfer your Personal Information to our affiliated companies, trusted partners, and service providers located in countries outside of your own jurisdiction, including outside the United States, European Economic Area (EEA), Asia-Pacific (APAC) region, Brazil, and other territories.
These transfers are made for the purposes described in this Global Privacy Policy, including to provide our services, improve functionality, and support global operations. The primary jurisdictions to which we transfer data include the USA and countries within the EEA, where business needs or technical infrastructure require such processing. Prior to initiating such transfers, we conduct appropriate assessments when required by applicable law to evaluate potential risks and ensure adequate protection measures are in place.
To protect your Personal Information in cross-border transfers, we implement one or more legally recognized safeguards, such as:
All intra-group transfers are governed by binding intercompany agreements reflecting internationally recognized privacy standards, ensuring your Personal Information remains protected regardless of where it is processed.
We retain Personal Information for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Global Privacy Policy, and in accordance with applicable data protection laws and regulatory obligations.
Our retention periods vary by data category, based on the type of information we process. In order to provide a general idea of our data retention practices, we reproduce our main guidelines below.
We apply secure deletion and de-identification procedures when data is no longer needed. You may contact us to request additional information about retention practices specific to your Personal Information.
If you have a question, complaint or any feedback about how your Personal Information is processed or this Global Privacy Policy, please contact us here legal@getsupernal.ai . To help us efficiently process your request, we utilize a third-party privacy management platform.
Where required by law, our entities have appointed Data Protection Officers (DPOs). Please refer to the jurisdiction-specific section of this Global Privacy Policy for DPO contact information relevant to your region.
If we are unable to resolve your concern to your satisfaction, you have the right to lodge a complaint with the competent regulatory authority in your jurisdiction.
If you are in United Kingdom (“UK“), Switzerland, the European Union (“EU“) or European Economic Area (“EEA“), you may have the following rights under applicable data protection laws:
We apply these rights consistently, regardless of your location, where required by applicable law.
As stated above, to exercise any of your rights, please contact us here legal@getsupernal.ai.
We will typically be able to respond within one month. If your request is complex, we may need longer and will inform you accordingly.
We may need to verify your identity and ask for more information before processing your request. We may use a trusted third-party vendor to collect the information in the contact us form.
If you have a complaint which has not been resolved to your satisfaction or its specifically appointed country representatives, please refer the section “How to Contact Us” or the country-specific sections that follow.
If you are in California, the following section on your rights in Personal Information also applies.
If you are a California resident, please review this section below as it is applicable to your Personal Information (“California Personal Information“). Unless otherwise expressly stated, all terms in this California Global Privacy Policy have the same meaning as defined in our Global Privacy Policy or as otherwise defined in the CCPA.
This section supplements the information contained in our Global Privacy Policy and applies solely to individual residents of California. This California Global Privacy Policy provides additional information about how we collect, use, disclose and otherwise process Personal Information of consumers, either offline or online, within the scope of the California Consumer Privacy Act (“CCPA”), as amended by the California Consumer Rights Act (“CPRA) (collectively, “California Privacy Law”).
Subject to certain exceptions and limits, if you are a California resident, you may also have the following rights :
If the exercise of the rights described above limits our ability to process your California Personal Information(such as in the case of a deletion request), we may no longer be able to provide you our products or services or engage with you in the same manner.
When submitting your request, please include the specific nature of your request, referencing “Your California Privacy Rights,” as well as your first and last name, email address, and zip code or mailing address.
As stated above, to exercise any of your rights, please contact us here legal@getsupernal.ai].
Alternatively, you may contact our California-specific contacts as detailed under the section “How to Contact Us” or the state-specific sections that follow. We will typically be able to respond within one month. In some circumstances, for example if your request is complex, we may need longer. We will inform you if this is the case.
We may need to ask for additional information to verify your request and action your request. This helps us to protect Personal Information against fraudulent requests. If you do not provide sufficient information initially and do not respond to our request for additional information, we may be unable to action your request. We may ask you to complete our standard form in order to ensure your request is processed in accordance with applicable privacy laws. We may use a trusted third-party vendor to collect the information in the contact us form.
If you have a complaint which has not been resolved to your satisfaction or its specifically appointed country representatives, please refer the section “How to Contact Us” or the country-specific sections that follow.
We may apply any exceptions or other conditions available under law when responding to correction, deletion, or other requests.
If you are a California resident and have any questions about this California Consumer Protection Act Global Privacy Policy addendum you can also contact our state-specific contacts:
Our Company complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework ("Swiss-U.S. DPF"), as set forth by the U.S. Department of Commerce.
We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. DPF Principles with regard to the processing of Personal Information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have also certified that we adhere to the Swiss-U.S. DPF Principles with regard to the processing of Personal Information received from Switzerland in reliance on the Swiss-U.S. DPF. We refer to the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles collectively as the "DPF Principles."
If there is any conflict between the terms in this Global Privacy Policy and the DPF Principles of this Section, the applicable DPF Principles shall govern.
To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/. The U.S. Federal Trade Commission has jurisdiction over our compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
For sake of clarity, we confirm that we comply with the following.
We adhere to the DPF Principles with regard to Personal Information received from the EU, United Kingdom (and Gibraltar), and/or Switzerland.
The types of Personal Information collected are those identified in the "What information do we collect and hold, and what do we use this for?" section of this Global Privacy Policy.
The purposes for which we collect and process Personal Information are described in the same section of the Global Privacy Policy.
We use third-party service providers to provide business support services. The types and identity of third parties to whom we disclose Personal Information are described in the “Who might we share your Personal Information with?” section of this Global Privacy Policy. We remain responsible under the DPF Principles if third-party agents that we engage to process Personal Information on our behalf do so in a manner inconsistent with the DPF Principles unless we prove we are not responsible for the event giving rise to the non-compliance.
Where we have collected Personal Information about you which is transferred to the United States for processing under the DPF Principles, you have the right to request access to your Personal Information, request a correction, or request deletion of your Personal Information by completing our contact form or emailing us at legal@getsupernal.ai.
We cannot action certain requests, such as access, deletion, or limitation of use requests, where we are not the controller of the Personal Information because we have been appointed as a “processor” or “service provider” to a data controller based in the EU, UK, or Switzerland. You should make such requests directly to that data controller. If you make the request directly to us, we may assist in redirecting you to the appropriate data controller.
Where we wish to use Personal Information collected under this Global Privacy Policy for a new or different purpose which is materially different from the purpose for which it was originally collected, we will provide you with an opportunity to agree to or opt out of that new or different purpose.
In addition to the rights described in response to item 6 above, you may at any time request that we cease using your Personal Information by completing our contact form or emailing us at legal@getsupernal.ai]. We will respond within 45 days.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, we commit to resolve DPF Principles-related complaints about our collection and use of your personal information. Individuals from the EU, UK, and Switzerland with inquiries or complaints regarding our handling of Personal Information received in reliance on the DPF should first contact us using our contact form or email legal@getsupernal.ai. We will respond within 45 days.
We are also committed to cost-free independent resolution where you cannot resolve a dispute directly with us. We will inform you about those options in further detail if we are unable to amicably resolve a dispute. We commit to cooperate and comply with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) regarding unresolved complaints.
As further explained in the DPF Principles, binding arbitration is available to address residual complaints not resolved by other means in accordance with Annex I of the DPF Principles.
We may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, in compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
The U.S. Federal Trade Commission has jurisdiction over our compliance with the DPF.
