Legal

Privacy Policy

Last updated September 30, 2026

Superhero Technologies builds and maintains websites. This policy covers superherotech.ai — what we collect when you visit it, who else processes that data, and what control you have. We've tried to write it in plain language rather than legal boilerplate.

What we collect

When you contact us. The name, email address and message you type into our contact form, or send us by email. We use it to reply to you and to keep a record of the conversation. Nothing more.
When you ask for an SEO audit. The website address, email address and, if you give one, phone number you type into the audit form. To make the report we fetch the public pages of that website, and we keep the report for 180 days. We use your email and phone only as you consented: the report goes to your email either way, and we email you tips and offers, or text you, only if you ticked those boxes.
When you buy a plan. Your email address and billing details go to Stripe, our payment processor. We receive confirmation of the payment and your email address; we never see or store your card number.
Server logs. Our host, Cloudflare, records requests to the site including IP addresses, for security and reliability. This happens for any website and is not something we can switch off.
Analytics, unless you opt out. Google Analytics records anonymous usage — pages viewed, which links get clicked, how far down a page people scroll — so we can see which parts of the site are working. European visitors are asked first; everyone else can decline on the banner at any time. See the cookies section below.

Cookies and analytics

This site uses Google Analytics, loaded through Google Tag Manager. Which rules apply depends on where you appear to be:

If you appear to be in the EEA, the UK or Switzerland, nothing is requested from Google and no analytics cookies are set until you click Accept. That's deliberate — even loading Google's script would send your IP address to Google, so we don't load it at all. Decline, or ignore the banner, and nothing loads.
Everywhere else, analytics start on your first page view and the banner invites you to opt out. If you click Decline, we stop analytics, switch Google Analytics off for this site, and delete the analytics cookies already set. One page view will have been counted before you clicked; nothing after it is.
We work out which applies from your browser's own time-zone setting. It's a rough guess — a VPN or a trip abroad will fool it. We deliberately don't use the Geolocation API (which would prompt you) or an IP lookup, and if the time zone can't be read we apply the stricter, consent-first rules.
We remember your choice in your browser's local storage so you aren't asked on every page. That is the only thing we store without asking, and it stays on your device.
No advertising cookies. We don't run ads, we don't use advertising or cross-site tracking cookies, and we don't sell or share your data with anyone for advertising. Ad-related consent stays denied even when you accept analytics.

You can change your mind at any time — use Cookie settings here or in the footer of any page. If you accept and later decline, we downgrade the consent signal and clear the analytics cookies.

Promotional codes. If you arrive on a link carrying a discount code, we remember that code in your browser for 90 days so it is still applied when you reach checkout. It holds nothing but the code itself, it is not used to track you, and clearing your browser's cookies removes it.

Where you came from. If you arrive from a search ad, a campaign link or another website, we remember the campaign name and the site you came from in your browser for 90 days, so that if you buy a plan or send us a message we know which of our efforts reached you. It records the first such visit only, holds nothing you typed and nothing that identifies you, is read only by our own checkout and contact forms, and clearing your browser's cookies removes it.

Your favorites. If you save elements, features, styles, flavors, colors or typefaces with the heart, we remember the list in your browser for 180 days so it can travel with you to checkout and into your portal. It holds only the names of what you saved, nothing about you, and clearing your browser's cookies removes it.

The Site Rescue look. If you ask us to look at your website on the Site Rescue page, what we found — the address, what it runs on, where it is hosted and who carries its email — is kept in your browser for one day so it can travel with you to checkout. It is signed so it cannot be altered, it holds nothing about you personally, and clearing your browser's cookies removes it.

Who else processes your data

We keep this list short on purpose. Each of these has its own privacy policy.

Cloudflare, Inc. — Website hosting and content delivery. Processes your IP address to serve the site and to protect it from abuse.
Stripe, Inc. — Payment processing. If you buy a plan, Stripe collects and holds your payment details — we never see or store your card number.
Compass (forms.compass.st) — Our own contact-form service, which receives what you type into the contact form and passes it to us.
StackHound — Our own website-scanning service. If you use the free look on the Site Rescue page, the address you type is checked by StackHound, which fetches the public pages of that site and reads its DNS. It receives the address and nothing about you.
PostHog, Inc. — Product analytics and session replay for the client portal only (see “The client portal” below). Receives what happens in the portal, tied to your account number, never your email; typed inputs are masked before anything leaves your browser.
Calendly LLC — Optional call scheduling, if you choose to book a kickoff call. Only used when you follow that link.
Google LLC — Website traffic analytics (Google Analytics via Google Tag Manager), subject to the cookie choices described in this policy.

What we don't do

We don't sell your data, or share it for anyone else's advertising.
We don't run advertising or cross-site tracking on this site.
We don't email you marketing you didn't ask for.
We don't ask for more information than we need to do the work.

How long we keep things

Inquiries and project correspondence are kept while you're a customer and for a reasonable period afterwards, so we can pick up where we left off. Payment records are kept as long as tax and accounting rules require. Analytics data is retained on Google's default schedule; portal screen replays for 30 days.

Your rights

You can ask us what data we hold about you, ask for it to be corrected, or ask us to delete it. Email hello@superherotech.ai and we'll deal with it — no forms or hoops. If you're in the UK or EU, you also have the right to complain to your data protection authority.

The client portal

If you are a client, you sign in to a portal we run at portal.superherotech.ai. To find the places where the portal is slow, confusing or broken, we record how it is used with PostHog: which pages are opened, what is clicked, and a replay of the screen as you saw it. A few things are deliberate:

It is tied to your account, not to you. The record carries your account number and your business's name — the same things our own staff console shows — and never your email address, your name or your phone number.
Everything you type is masked before it leaves your browser, and so is every place the portal prints an email address. A replay shows the shape of the page and where you went, not what you wrote.
It sets no cookie. The portal keeps a short identifier in your browser's local storage; it stays on your device and is not shared with any other site.
Your browser only ever talks to us. The recording travels through our own address and is forwarded to PostHog from there, so no third-party script or domain is loaded into the portal.

Screen replays are kept for 30 days and the rest for as long as you are a client. Ask us at hello@superherotech.ai if you want your portal usage deleted or would rather not be recorded at all, and we will turn it off for your account.

When our support staff open your portal. To help you, a member of our support staff may open your portal and see it as you do. While they are in it, they cannot accept an agreement for you, make a payment, or change how you sign in. We record each of these visits with who opened your portal and why, and the Settings page in your portal shows the date of every visit.

Client websites

This policy covers our own site. The websites we build for clients are the client's own properties with their own privacy policies. If we've added analytics to a client's site, we do it the same way we do it here — consent first.

Changes

If we change what we collect or who processes it, we update this page and the date at the top. Meaningful changes are made in the same release as the change itself, so this page never describes a version of the site that isn't live.

Questions about any of this? Email hello@superherotech.ai and a person will answer.