Superdesk Privacy Policy

Superdesk is a software product operated by Badem Enerji Üretim Limited Şirketi (referred to as "Superdesk", "we", or "us"), a company registered in Türkiye. We provide online tools and services via our website at https://superdesk.com for businesses to collect and manage product reviews, display them on their websites, send and manage email campaigns and other marketing activities ("Services"). When you visit our website or subscribe to our Services, you voluntarily provide us with certain personal information that may identify you directly or indirectly. Additionally, when you use our Services, we automatically collect certain information about your devices and usage through cookies and other tracking technologies. This privacy policy outlines how we collect, use, and share your personal and technical information, and explains how you can exercise your privacy rights. If you have any questions about this policy, please contact us at legal@superdesk.com. We use your information to provide and enhance our Services. By using our Services, you agree to the collection and use of information as described in this policy and in accordance with the Superdesk Terms of Service, which can be found at https://superdesk.com/terms-of-service.

Trade name: Superdesk Legal operator: Badem Enerji Üretim Limited Şirketi Registered address: Altunkalem Mah. 28611. Sk. No: 16 İç Kapı No: 3, Akşehir, Konya, Türkiye MERSİS No: 0129038634000017 VKN: 1290386340 Contact: legal@superdesk.com

By setting up an account and using our Services, or submitting your personal information, you consent to our processing and use of your data as outlined in this Privacy Policy. We collect information that you provide directly to us as well as the information provided to us by your ecommerce platform. This might include your name, your business name, email address, address, telephone number, and any other information you intentionally provide to us, information about your relationship to your ecommerce platform, including your business' ecommerce platform identifier, information about your financial transactions, including account and authentication information, as well as billing, shipping and contact details. Information provided to us by your ecommerce platform may include information about your business, including the name of the owner of your business, your full business address, your business email address, your business phone number, your business' internet domain name and the time zone in which your business operates, details of your service plan with ecommerce platform, information about the goods and services you provide, your full product catalogue and order history, your customers, including full name, postal code, email address, telephone number, transaction currency, user identifiers, order numbers, products they have purchased from you, status of any incentives or rewards they have received, their spendings for your business and other descriptions such as customer tags. These information can be used to identify or contact you. This policy applies to all personal information we collect, maintain, or use. We may use your personal information to contact you with newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or the instructions provided in any email we send. To use certain features in the Services such as sending email campaigns through your account, you will provide a list of contact names and email addresses of individuals whom you want to send these campaigns to and have given you consent to use their personal information. You can create your list of contacts by importing them through a .csv or directly from your email interface. We act as a processor of this information to provide the Services in accordance with our Terms of Service. You are solely responsible for obtaining consent from the individuals and contacts that you send email to and for maintaining appropriate privacy and security practices regarding your contact list. We do not sell your personal information or your contact list. We may also collect information on how the Services are accessed and used. This usage data may include information such as: Your computer Internet Protocol address (IP address), browser type, browser version, the pages of our Services that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data such as email sending performance, cookies and other similar identifiers, which we send to your computer's browser for session identification purposes. We use these information mainly to provide, maintain and improve the Services. To notify you about changes to the Services. To allow you to participate in interactive features of the Services when you choose to do so. To provide customer support. To gather analysis or other data so we can improve the Services. To monitor the usage of our Services. To detect and address technical issues. To provide you with news, offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about (unless you have opted not to receive such information). To comply with legal requirements and to enforce compliance with our Terms of Service. Data Collected from Meta (Facebook and Instagram) If you choose to connect your Instagram Business Account to our Services, we collect and process information via Meta APIs. This may include your Instagram profile information, media, captions, comments, tags, mentions, hashtag-related media, media identifiers, usernames, timestamps, permalinks, thumbnails, and related metadata. We use this "Platform Data" strictly to provide our user-generated content (UGC) curation features, allowing you to request usage rights and display this media on your storefront. We do not use Meta Platform Data for independent marketing or advertising.

Superdesk will retain your personal information only for as long as is necessary for the purposes set out in this privacy policy. When we no longer need to use your personal information and there is no need for us to keep it to comply with our legal or regulatory obligations, we will either remove it from our systems or depersonalize it so that we can't identify you. Records of changes made through connected AI agents are kept for 90 days, and connection records for up to 30 days, as described in "Connected AI Agents".

When you apply to the Superdesk Partner Program, we collect the contact, company, website, service, client-profile, and partnership information you choose to submit. We use this information to assess program fit, contact you about the application, administer an approved partner relationship, prevent misuse, and maintain program records. Submitting an application does not create a partner account. We do not sell partner application information.

You can connect an AI assistant, such as Claude or ChatGPT, to your Superdesk account through the Superdesk connector at mcp.superdesk.com. When you connect one, you sign in with your Superdesk account, choose which of your stores the assistant may use, and choose whether it may only read settings or also change them, and whether it may read, moderate, reply to or import reviews. We then issue the assistant an access token for those stores only, and we notify the store owner by email. The assistant does not receive your Superdesk or Shopify credentials.

What an assistant can read: a store's Superdesk setup, meaning the store logo, review-request timing, email templates, review form and widget settings, language and notification settings, plus the store's name and language. Some settings can include text written by shoppers, such as a review shown in a widget. If you allowed it, an assistant can also read your reviews: their rating, title, text, status, photos and videos, the product, and the reviewer's name as it appears on your storefront. An assistant cannot read your shopper lists, orders, customer or reviewer email addresses, or payment information through the connector.

What an assistant can change, only if you allowed changes: those same settings, including copying settings between stores you connected together, the store logo (taken from your Shopify store), and test emails sent only to the email address you signed in with. If you allowed it, an assistant can also approve, reject or feature reviews and hide their photos or videos; reply to reviews and, when asked to, email the reply to the reviewer; and import reviews from a file you provide, such as an export from another reviews app. Imported files are processed like imports you start in Superdesk, including any reviewer names and email addresses they contain, and an assistant can undo only imports it started. An assistant cannot email anyone else, delete reviews or other data, change billing, or uninstall Superdesk.

Information the connector returns is sent to the assistant you connected and is then handled under that provider's own terms and privacy policy, for example Anthropic for Claude or OpenAI for ChatGPT. Only connect assistants you trust with your store's setup.

For every change or test email made through the connector, we record the time, the store, the assistant's name, the person who connected it, which settings or reviews changed and whether it succeeded. We do not keep the values sent; we keep a one-way hash of them. These records are visible in Superdesk under Settings, Connected agents, and are deleted automatically after 90 days. Connection records (which stores and permissions you granted) expire 30 days after you connect and are then deleted. Our servers also keep operational logs for up to 180 days.

You can disconnect an assistant at any time in Superdesk under Settings, Connected agents; its access to that store ends immediately. Access also ends automatically 30 days after you connected, or when Superdesk is uninstalled from the store or its subscription ends. You can also remove the connector in the assistant's own settings. We use connector data only to provide the connector. We do not sell it, and we do not use it to train AI models.

Superdesk may share your information in following cases:

We protect your personal information by restricting internal and external access to your personal information, maintaining our technology systems to prevent unauthorised computer access, securely destroying your personal information when your personal information is no longer needed. We use industry standard encryption technology to transmit and encrypt all information in our possession. The security of your information is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. We use reasonable and appropriate physical, technical and administrative safeguards to protect personal information from loss, misuse, unauthorized access and destruction.

If you are a resident of the European Economic Area, Switzerland, or the United Kingdom, under the General Data Protection Regulation (GDPR), Superdesk's legal basis for processing and using personal information as described in this privacy policy derives from: Performing our Services contract with you, you have given us permission to do so, the processing is in our legitimate interest in making the Services safe and improving its function and to comply with the law

You have the right to request the complete deletion of your personal data, including any Platform Data collected from Meta or your ecommerce platform. To request data deletion, or to revoke our access to your Meta account data, please email us at legal@superdesk.com or see our dedicated instructions at https://superdesk.com/data-deletion. We will process your deletion request within 30 days.