Skip to content
See what it does

Updated 2 November 2026

Privacy

What Superposition OS keeps about the people who use it, why, where, and who to ask.

Who we are

Superposition OS is run by MEDIA ROCKET STUDIO (PTY) LTD t/a Superposition (registration 2015/043823/07), a South African company. We're the responsible party, under the Protection of Personal Information Act (POPIA), for the personal information on this page.

What we keep

  • Your account: your email address, your name if you give it when you set a password, the brands you're on and your licence on each, the organisations you own and, if you work for an agency, that you're one of its people. Your organisation or our studio adds you, or you make one by signing in with Google or with a password on an address you've confirmed.
  • Your sign-in, with our sign-in service: your password, if you set one, and if you sign in with Google, the name, email address, profile picture and account ID it shares.
  • If you sign in and aren't on a brand yet: which brands we asked to give you access, and when.
  • If you start a brand space yourself: your organisation's name and its owners, the brand space's name and address, the area you picked, when its trial started and ends, and, if an agency's link brought you, which link. Each person and each organisation has one trial, so we keep that you had it after the trial's brand space is gone.
  • If you pay for a brand space: its plan, its subscription's status and dates, the billing provider's references for it, its invoices' amounts, which Super Admin started each checkout, the discount code it was bought with, and the web domain you prove is the brand's. Until payments go live, a stand-in takes the place of the billing provider: it takes no card and charges nothing. This notice names the provider before payments go live.
  • If you report a brand space: what you tell us, and your email address if you give it. It reaches our staff as an email. Your IP address is held for an hour, to stop the form being misused, and isn't stored.
  • Sign-ins: when you signed in, and the IP address and browser you used, to keep accounts secure. Signing in and connecting AI tools are limited by IP address, so your address is held for up to an hour for that, and isn't stored.
  • What you do here: the changes you make to a brand, what you send for approval, approve or ask changes on, the files you upload, and the AI tools you connect and what they ask for. A brand's history shows who did what.
  • A record of changes to who can do what: who added or removed whom, changed a licence, a seat or a group, asked for access, made or revoked a data key, changed a brand's plan, settings or agency, or an organisation's owners, and what our staff did. It names the people a change was about by an account ID, and whoever made the change by their account ID and email address, with when, and the AI tool if one did it.
  • Cookies: one keeps you signed in. Signing in with Google keeps a short note in your browser for the trip there and back. There are no advertising or analytics cookies.
  • If you write to us through the contact form: your name, email address, organisation, phone number if you give it, the tier you ask about and your message. They reach us as an email. Your IP address is held for an hour, to stop the form being misused, and isn't stored.

What we use it for

  • To sign you in and show you the brands you're on, as your licence allows.
  • To record who changed and approved what: a brand's approvals depend on it.
  • To email you codes: to confirm your email address, and to reset your password.
  • To email you when someone adds you to a brand: who added you, the brand, your licence and a link to sign in. Whoever added you can send it again.
  • If you run a brand space on a trial, to email you before its trial ends, once it has ended, and before it's deleted.
  • If you run a brand space that stops being paid for, or own its organisation, to email you that it's read-only, before it's archived and before it's deleted.
  • To email you when work waits for you on a brand: changes sent for you to approve, what was decided on changes you sent, a seat you were given and, for the agency, a seat someone took from it. Each says who did it, by their name and email address.
  • If you sign in and aren't on a brand yet, to ask for you: we email your address to the brand champions of the brands whose people share your email address's domain (never a public one, such as gmail.com), or to the agency's people on a brand that has no brand champions yet, so they can add you. With nobody to ask, the contact form starts with your address.
  • To answer you, if you write to us through the contact form.
  • To show who had access to a brand and who changed it, so a change can be checked or put right and misuse found.
  • To keep Superposition OS secure and working, and to meet the law.

We don't sell your personal information, use it for advertising, or use it to train AI models.

Who else handles it

These providers run Superposition OS for us:

  • Code Capsules: the servers, database and file storage Superposition OS runs on, and its sign-in service (Appstrax), in Cape Town.
  • Google Workspace: sends our emails, and holds the enquiries you send us.

And these, depending on what you use:

  • Google, if you sign in with it. Your account there is Google's, under its privacy policy.
  • Cloudflare Turnstile, on the forms that start a brand space and the landing page's contact form: it checks the form isn't filled in by a bot, which tells Cloudflare your IP address and browser, under Cloudflare's privacy policy.
  • Cloudflare, which serves our landing page at superposition.id and thesuperposition.agency: your browser's requests for it tell Cloudflare your IP address and browser.
  • The AI tools you connect, such as Claude: they get the brand content they ask for, under their own terms.

We share personal information with anyone else only when the law requires it.

Where it's kept

In South Africa: Superposition OS and its sign-in service run in Cape Town. The emails we send, and the enquiries you send us, are with Google Workspace, under Google's data processing terms.

How long we keep it

We keep your account while you have access to a brand, and delete it when you ask. A brand's history (who changed or approved what) stays with that brand while it's on Superposition OS. The record of changes to who can do what stays after an account or a brand is gone, for as long as we need it to keep Superposition OS secure and to meet the law; when you ask us to delete your account, we take your email address out of it too, and what's left names you only by an account ID that no longer leads to anyone. Sign-in records and server logs are kept only as long as we need them to keep Superposition OS secure. We keep an enquiry for as long as we need it to answer you and for our business records, and delete it when you ask. A brand space started on a trial is deleted, with everything in it, 30 days after its trial ends unless it's paid for; we email its Super Admins before. A brand space that stops being paid for is read-only at once, archived 30 days later (its organisation's owners can still download its export) and deleted, with everything in it, 90 days after that; we email its Super Admins before each step, and its organisation's owners too before it's deleted. What the billing provider tells us about a payment (the buyer's name and email address with it, but not the card's details or its links to the buyer's billing pages, which we don't keep) is kept for 30 days.

How we protect it

Every connection is encrypted. Each person reaches only the brands they're on: every request is checked against their licence. Your password goes from your browser straight to our sign-in service, which keeps it; Superposition OS's own servers never see it. You can sign in with Google instead.

Signing in with Google

When you sign in with Google, our sign-in service receives your name, email address, profile picture and Google account ID, and Superposition OS keeps your email address. We use them to sign you in; if you aren't on a brand yet, to ask your organisation's brand champions or agency to add you (they get your email address) or to fill in the contact form for you. We don't see your email, files or anything else in your Google account, and we share Google user data with nobody else but the providers above that run Superposition OS.

Your rights

You can ask what personal information we hold about you, and ask us to correct it, delete it or stop using it. Email ops@mediarocket.co.za and we'll answer within 30 days. If you're not satisfied, you can complain to South Africa's Information Regulator at inforegulator.org.za.

Changes

When this changes, we'll update this page and its date.