Privacy Policy
This notice explains how KORO INTERACTIVE PRIVATE LIMITED (Singapore UEN 202525340Z), operator of SuperClassify, handles personal data under Singapore’s Personal Data Protection Act 2012 (PDPA). Effective 23 September 2026.
1. Scope and contact
This Policy covers our website, accounts, API, Classifier publishing, evaluations and support. We are responsible for personal data we handle for our own account administration, billing, security and service purposes. When an organisation supplies personal data for processing on its behalf, it remains responsible for its purposes, notices and permissions; we process that content to deliver its requested service.
For data-protection questions, access or correction requests, withdrawal of consent or complaints, contact our data-protection contact at contact@superclassify.com, with “Data protection” in the subject. Do not include passwords, API keys or unnecessary sensitive records.
2. What we collect and why
Account and workspace information: email address, authentication identifiers, profile details you provide, workspace membership and permissions. We use these to create and secure accounts, authenticate you, provide team access and send necessary service messages. If you choose Google or GitHub sign-in, we receive the identity information made available for that sign-in; those providers also process information under their own policies.
Content you save: Classifier definitions and versions, AI Agent Instructions, examples, profile information, stars, evaluation datasets and evaluation reports. We store these to provide the authoring, discovery and evaluation features you choose. Workspace permissions and publication settings determine who can access them.
Usage and security metadata: request identifiers, Classifier/version references, timestamps, status and error codes, token quantities, charges, key identifiers, rate-limit information and security or deduplication fingerprints. Network providers may process IP addresses, browser/device information and request metadata. These support metering, limits, fraud prevention, troubleshooting and reliable retries; they are not a saved transcript of ordinary inference content.
Payment information: purchase amount and currency, order and Stripe payment identifiers, payment status, refunds and disputes. Stripe collects payment and billing information directly. We do not collect or store your full card number or card security code in our application. We retain records necessary to reconcile payments and comply with accounting requirements.
Support correspondence: information you choose to send us, used to respond, investigate and resolve your request. Please share request identifiers rather than confidential input text wherever possible.
3. Inference and Jev
To run a Classifier, we transmit its evaluation instructions and the input and context required for execution to TypeSafe AI, Inc., which operates Jev. The returned answer is sent to your browser or application. SuperClassify does not persist ordinary inference input or output as request history. Short-lived processing in memory and transport is necessary to fulfil the request.
This does not mean every provider offers zero retention. TypeSafe’s applicable service agreement permits processing for service delivery, billing, telemetry, abuse prevention and legal compliance. Its published agreement says customer data is not used to train model weights without prior consent. We do not use your ordinary inference content to train our own model or opt you into provider model training. TypeSafe’s separate contractual processing and retention rules still apply.
Inputs you deliberately save as examples or upload as evaluation datasets are stored features, not ordinary unsaved API runs. Evaluation reports can also remain in your workspace. Classifier creators do not receive callers’ submitted input or output merely because they authored the Classifier. Your own application, browser, extensions or connected agents may retain information independently of us.
4. Public and private content
Public Classifier pages and creator profiles may be indexed, copied or read by people, search engines and AI agents. Public fields include descriptions, examples, AI Agent Instructions and output contracts. The Shown/Hidden setting controls public visibility of evaluation instructions; it does not hide them from the infrastructure and model providers needed to execute the Classifier.
Only publish information you intend to make public. Private workspace content remains subject to member permissions and necessary service access. We cannot remove copies independently retained by other people or search engines, although we will respond to valid removal requests concerning our own service.
5. Purposes, consent and choices
We collect, use and disclose personal data for the purposes described here, with consent where required or where an exception or other basis is available under the PDPA. We do not sell personal data or use inference content for advertising. We will notify you and obtain additional consent where required before using data for a materially different purpose.
You may withdraw consent by contacting us. We will explain the likely consequences and act on the withdrawal within a reasonable time. If particular processing is necessary for your requested feature, withdrawal may mean we cannot continue that feature. Withdrawal does not make earlier lawful processing invalid or prevent retention required by law.
6. Providers and other disclosures
We use Cloudflare for hosting, network delivery, security and email delivery; Supabase for account authentication, database and file storage; TypeSafe/Jev for inference; and Stripe for payments, refunds and payment risk. Google and GitHub provide optional sign-in. Support messages sent to our Gmail address are processed by Google. Providers receive information needed for their role and may use subprocessors.
We may disclose relevant information to authorised workspace administrators, professional advisers, or authorities when reasonably necessary to comply with law, protect rights, investigate abuse or resolve a dispute. If the business is reorganised or transferred, personal data may be transferred subject to appropriate safeguards and notification where required. We do not give all providers access to all data.
7. Processing outside Singapore
Our providers operate internationally, so information may be processed outside Singapore, including in the United States and other locations used by their infrastructure and subprocessors. We do not offer Singapore-only residency through the standard service.
For transfers subject to the PDPA, we take steps to provide protection comparable to the PDPA, including applicable contractual obligations and service-provider data-protection terms. Contact us before submitting data if you require a particular location, processing agreement or retention commitment.
8. Retention and deletion
Ordinary inference content is not saved as API history by SuperClassify. Account information and intentionally saved content are retained while needed to operate your account and chosen features. Financial records are retained for the period required by applicable accounting and tax law. Security, dispute and audit metadata may remain as long as needed for the relevant investigation, legal obligation or legitimate business purpose.
We stop retaining identifiable data, or remove its association with individuals, when its purpose is no longer served and retention is no longer required for legal or business purposes. Backups and provider copies may take additional time to age out under their retention processes; deletion from the live application does not instantly erase every backup.
You can remove supported datasets and request account deletion in Settings. Pending payments, unused paid credits, refunds, active evaluations or shared-workspace ownership may need to be resolved first. Contact us if the self-service process cannot complete. Deletion does not automatically remove records we must retain, content controlled by another workspace, or public copies already obtained by others.
9. Security and incidents
We use access controls, workspace separation, encrypted transport, server-side credential handling and restricted service roles to protect data. Access is limited to authorised purposes. No online service can guarantee absolute security. Protect your credentials, restrict API keys and avoid submitting unnecessary personal data.
We assess suspected data breaches and notify the PDPC and affected individuals when required by the PDPA. If you suspect a security incident, contact us promptly without sending secrets or exposing other users’ information.
11. Access, correction and complaints
Subject to PDPA exceptions, you may request access to personal data we hold about you and information about its use or disclosure, and request correction of errors or omissions. We may ask for proportionate identity verification and sufficient details to locate records. We will explain any refusal or applicable fee where the law permits or requires it.
We aim to respond as soon as reasonably possible. If we cannot complete an access request within 30 days, we will inform you when we expect to respond. For data held on behalf of a workspace organisation, we may direct or assist your request through that organisation. Contact our data-protection contact to raise a complaint; you may also contact Singapore’s Personal Data Protection Commission.
12. Age limits and updates
The service is intended for people aged 18 or older. Do not open an account for a child or submit children’s personal information without an appropriate legal basis and safeguards. Contact us if you believe information was collected improperly.
We will update this Policy when our practices or legal requirements change, show the effective date and provide notice of material changes through the service or account contact where appropriate. We will seek fresh consent where required. This Policy does not override mandatory rights under applicable law.