Super Duper — Privacy Policy

1. Who we are and what this covers

Super Duper ("Super Duper," "we," "us," or "our") is a reporting tool for businesses that use Ontraport as their CRM and marketing platform. It generates a Weekly Snapshot of your Ontraport account's key metrics. Super Duper is operated by Ryan Andersen Consulting, LLC, a California limited liability company based in San Francisco, California.

This Privacy Policy explains what we collect, how we use it, who we share it with, and your choices. It applies to our website, our application, and the reports and dashboards we provide (the "Service"). By using the Service you agree to this Policy.

2. Two different roles — please read this first

Super Duper handles two kinds of data, and our legal role differs for each:

(a) Your account data — we are the "controller." When you sign up, log in, and use Super Duper, we decide how that information is handled.

(b) Your Ontraport data, including your contacts' personal information — we are the "processor." When you connect your Ontraport account, we access and process that data on your behalf and under your instructions. It belongs to you (or to your contacts), not to us. You are the controller of it; we only process it to provide you the Service. Section 9 explains what this means for the rights of the people in your CRM.

3. Information we collect

3.1 Account information

• Your email address and password. Your password is stored in hashed form by our authentication provider (Supabase Auth); we never see or store it in plain text. (A name is optional at signup.)
• Payment information — none. Super Duper does not collect or process any payment or credit-card information, and we do not use a payment processor. If we introduce paid plans, we will update this Policy and use a payment processor that handles card details directly.
• Your Ontraport connection credentials. You provide your Ontraport App ID and API key so we can connect to your account. These are encrypted at rest (AES-256-GCM). We also keep a short, non-secret hint (the last four characters of your App ID) in readable form so you can identify the connection.

3.2 Ontraport data (we process this on your behalf)

When you connect your Ontraport account, Super Duper reads your data live at the moment your Weekly Snapshot is generated and stores only the computed snapshot. The snapshot is mostly aggregated metrics. It also includes a limited set of specific contacts' names and email addresses where a feature surfaces them — for example your top leads by score, your most-active contacts, contacts on payment plans, and the contacts who purchased or were invoiced during that week.

These are limited, period-scoped lists — never a copy of your full contact database. Each stored contact entry includes only the contact's name and email address (plus non-identifying figures such as amount spent, activity dates, and lead grade). We do not store your contacts' phone numbers, IP addresses, birthdays, postal addresses, or social profiles. Payment-card data is never accessed or stored.

3.3 Cookies and tracking

Website. We use only essential first-party cookies for authentication and keeping you logged in, plus one first-party cookie used for internal administrative debugging. We also store a random per-browser identifier in your browser's local storage to roughly de-duplicate views of a publicly shared dashboard — it is not linked to your identity. We do not use any third-party analytics, advertising, tracking pixels, or session-recording tools on our website.

Email. The reports and emails we send include standard open- and click-tracking (via our email provider, Resend) so we can measure delivery, opens, and clicks and improve the reports. This is email-engagement measurement, not website tracking.

3.4 Usage and engagement data

These are first-party records, stored in our own database and never shared with any third-party analytics service:

• Usage analytics: a log of how the Service is used — which dashboards and tabs are viewed, and when — to understand and improve the product. For logged-out views of a shared dashboard we record only a random per-browser identifier, not a name or IP address.
• Email-engagement log: we record delivery, opens, clicks, bounces, and unsubscribes for the emails we send, including the recipient's email address and any link clicked.
• Suppression list: if a recipient unsubscribes from a report email, we store their email address so we stop sending to them.
• Team notes: where your team adds notes or highlights inside a shared report, we store those notes along with the author's name.
• Feedback you submit: if you use the in-dashboard feedback tool (which does not require a login), we store what you typed — including any name you enter — the item it relates to, and a snapshot of the on-screen context at that moment, and email it to us.
• AI activity log: we keep a record of AI summary runs (the inputs sent and results returned) to debug and improve the feature. It is internal and never shared with any third-party analytics service.

3.5 The free Weekly Digest (separate signup)

Our free Weekly Digest is a separate signup where you provide your own Ontraport App ID and API key directly in a public form (no account required) so we can email you your digest. Those credentials are stored encrypted, the same way as elsewhere in the Service, and are used only to generate your digest.

4. Access and security

• Access is behind a login by default. Your reports, dashboards, and data are accessible only after you authenticate. The one exception is optional sharing: you may choose to turn on a public link for a specific dashboard (or grant a team member permission to do so), and anyone with that link can then view that dashboard without logging in. Public sharing is off by default, is entirely your choice, and you are responsible for what you choose to share this way (including any contact personal data a shared view may contain).
• We only read; we never change your Ontraport account. The application contains no data-writing or data-deleting Ontraport calls — it is structurally read-only.
• Team access is read-only for members. Account owners can invite team members, who receive their own login with read-only access to the owner's data; owners retain administrative control.
• Encryption and infrastructure. Connection credentials are encrypted with AES-256-GCM; we rely on the reputable infrastructure providers listed in Section 6. No system is perfectly secure, and we cannot guarantee absolute security.
• Backups. We keep automatic daily backups of our database (retained about 7 days on a rolling basis) and a nightly off-site backup to a private, access-restricted repository. Both our database provider and the off-site repository encrypt data at rest. Backups exclude your Ontraport credentials. See Section 8 for backup retention and deletion.
• Stopping access. You can revoke Super Duper's access at any time by removing or revoking the API key in your Ontraport account, which immediately ends our ability to read your data. Revoking access stops future reading but does not, by itself, delete data we have already stored — see Section 8.

5. How we use information

We use account data to run your account, authenticate you, provide support, and communicate with you. Our communications include: (a) the Weekly Snapshot and account/service messages, which are part of the Service you signed up for; and (b) occasional promotional emails about Super Duper features and about Ryan Andersen Consulting's related services and offers. You can unsubscribe from the promotional emails at any time using the link in those emails. We use your Ontraport data to provide the Service to you — to build your Weekly Snapshot and the AI-written summaries in it.

Our access to your account. To run and improve the Service, our personnel may access your account and see what you see — your dashboards, your reports, and the email and contact data shown in them — to (a) check that your reports are accurate and working and to provide support, and (b) understand how Super Duper is used so we can improve it.

Research, benchmarking, and storytelling. We do not sell your data or your contacts' data. We may use aggregated and de-identified information drawn from Super Duper accounts — information that cannot reasonably identify you, your business, or any individual contact — to operate, benchmark, and improve the Service, to inform our product development, and to share general insights and stories about how Ontraport users use their accounts (for example, in articles, marketing, or talks). We will not identify you, your business, or any individual contact in anything we publish without your permission.

6. Service providers (sub-processors)

We use the following third parties, each processing data only as needed to perform its function:

We do not use a payment processor; no payments are processed through the Service.

7. AI features

Super Duper uses AI (provided by Anthropic, via their commercial API, model Claude Sonnet) to write the plain-language summaries you see on your dashboard and in your emailed Weekly Snapshot. Anthropic's commercial API terms state that data submitted through the API is not used to train their models.

What we send is limited by design: the AI receives only aggregated, pre-computed figures and standouts. No contact names, email addresses, or phone numbers reach the AI provider on any path — a server-side filter removes contact names and emails from the data before it is sent, and the short email summaries are generated only from already-aggregated text, never from raw contact records.

8. Data retention and deletion

• We keep account data for as long as your account is active and as needed for legal and accounting purposes.
• The stored Weekly Snapshot data is retained while your account is active.
• Deletion on request. To have your data deleted, email us at ryan@ryanandersenconsulting.com. We remove an account and its associated data (its stored snapshots, team notes, feedback, organization, member logins, and your encrypted Ontraport credentials) from our live systems within 30 days of a verified request (in practice usually much sooner).
• Backups. Our daily database backups age out on a rolling ~7-day basis. Our nightly off-site backup keeps prior versions in its history; when you delete your account, we purge it from that backup history within 30 days. In short: your data is deleted from our active systems promptly and from our backups within 30 days, except for residual copies our infrastructure providers may retain for a limited period under their own retention practices.
• Engagement and usage records. When you delete your account, we remove or de-identify the usage and email-engagement records associated with it (snapshot opens, clicks, and dashboard activity) so they no longer identify you. We may retain de-identified, aggregate statistics that cannot be tied back to you.
• When an account owner removes a team member, that person's Super Duper login is permanently deleted and they are dropped from the weekly email roster.

9. Your rights — and your contacts' rights

Your rights (as our customer). Depending on where you live, you may have rights to access, correct, delete, or port your account data, and to object to or restrict certain processing. Contact ryan@ryanandersenconsulting.com to exercise them.

Your contacts' rights. Because we process your CRM data as your processor, requests from the people in your Ontraport account about their personal data are directed to and handled by you, as the controller. We act on your instructions and will assist you as required. You are responsible for having a lawful basis to collect and process your contacts' data and for your own privacy obligations to them.

California (CCPA/CPRA) and EU/UK (GDPR). We support the rights these laws provide and we do not sell personal information. If you require a Data Processing Addendum for your own compliance, contact us.

10. International data transfers

Your data is stored and processed in the United States. If you or your contacts are located outside the United States, your data is transferred to and processed in the United States.

11. Children

The Service is a business tool, not directed to children, and we do not knowingly collect personal information from anyone under 16.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with an updated "Last updated" date.

13. Contact

Questions about this Policy or your data: ryan@ryanandersenconsulting.com — Ryan Andersen Consulting, LLC, 524 29th Ave., San Francisco, CA 94121.