Privacy Policy

Who we are

SuperMae.ai is operated by Graceful Tomorrow Lda., a company incorporated in Portugal under NIPC 519376528, with registered office at Rua das Torres, n.º 9, 2.º Dto., 2610-175 Alfragide, Portugal. The service is currently in early access and is provided free of charge during this phase.

Graceful Tomorrow Lda. is the data controller for the personal data processed through SuperMae. For privacy questions or to exercise your rights under the GDPR, contact privacy@supermae.ai.

Artificial Intelligence

SuperMae is an AI virtual assistant, not a person. All responses you receive on WhatsApp are generated by artificial intelligence — no human writes them or steps into your conversations. Authorised members of our team may access your data only where necessary to operate, secure, debug, and improve the service, under strict confidentiality and access controls. We never sell your data, and it is not used to train AI models.

• Tone adaptation: SuperMae adapts its communication style (warmer, more efficient, or more playful) based on your messages. This preference is stored in your profile and never shared.
• No automated decisions: SuperMae suggests and organises — it never makes binding decisions on your behalf. You always remain in full control.

Personalisation — what SuperMae learns from your conversations

SuperMae's job is to lighten your mental load — and it can only do that by remembering what you tell it. When you share a lasting fact about your family in conversation, SuperMae stores it in your private family profile so that meal ideas, reminders, summaries and suggestions fit your family without you having to repeat yourself. This covers:

• Food & meals: dietary choices (e.g. vegetarian, gluten-free) and what you tell us you have in your pantry.
• Routines & schedule: standing weekly patterns you mention (“swimming on Wednesdays at 5pm”).
• Kids' preferences: food likes and dislikes, interests, and how they like to take part.
• How you like things done: standing preferences such as batch-cooking on Sundays or quick weeknight meals.

Legal basis. This processing is necessary to provide the personalised assistance the service exists to deliver (GDPR Article 6(1)(b) and our legitimate interest in making the service genuinely useful), and is transparently disclosed here.

What SuperMae does NOT learn this way. Health and medical information (conditions, allergies, medication) and facts revealing religious practice are special categories of data under GDPR Article 9. SuperMae does not capture them through this background learning — they are only ever processed with your explicit consent, through dedicated features.

Retention and your rights. Raw conversation history is retained for 180 days (see Data retention). The remembered facts persist so the personalisation lasts — and they stay yours to control: correct a fact by simply telling SuperMae (“we're not vegetarian any more”) and the old fact is replaced, never stacked; ask what is stored, or have it deleted, at any time — on WhatsApp or via privacy@supermae.ai. This information is never sold and never used to train AI models.

What we collect

We only store the data you share with us — either directly in chat with the assistant, or by connecting an optional channel like Gmail. The categories below describe everything that can end up in your family profile.

• Family basics: parents' names and relationships, your preferred language, and your WhatsApp number (used to identify your account).
• Kids' details: first name, age (or year of birth), school name + campus, grade or year level, and teacher names — each captured only when you share it. See the dedicated "Children's data" section below.
• Family routines and logistics: pickup and dropoff schedules, recurring commitments, and who does what when.
• Extracurricular activities: sports, music, lessons — what each kid does, when, and where.
• Birthdays: month and day for parents, kids, and optionally people in your extended network — captured when you share them.
• Extended family and support network: grandparents, nannies, babysitters, carpool contacts and co-parents who haven't joined SuperMae yet. We store their name, their role (e.g. "grandma", "nanny"), their phone number if you share it, and any availability or notes you add about how they help. When you add a third party you confirm you have informed them and have their consent — see "Extended family and support network" below.
• Communication preferences: preferred digest time, language, notification style, assistant voice and tone.
• WhatsApp messages you send to SuperMae, including text, photos, PDFs, and voice messages. We process these to extract school events and answer your questions.
• Voice messages: when you send a voice note, it is transcribed by our voice provider and the transcription is stored alongside the message.
• Gmail data (optional): If you connect your Gmail, SuperMae uses AI Smart Scan to automatically analyse your emails and identify communications related to your children, school, and activities. Only the subject, sender, and a brief body preview are sent to our AI for classification. Non-relevant emails are immediately discarded — never stored or processed. You can disable AI Smart Scan and use a manual sender list instead in your settings. We never send emails on your behalf.
• Health and medical data (only if you choose to share it): allergies, medical conditions, medication reminders. This is a special category of data under GDPR Article 9 — see the dedicated section below.

Legal basis

Under GDPR, every category of data we process needs a legal basis. Here is the breakdown:

How we use it

• Extract dates, events, and tasks from school communications
• Send you daily summaries and real-time alerts on WhatsApp
• Answer your questions about the family schedule
• Improve our AI to better understand school communications

Where we store data

All data is stored on secure servers in the European Union (Belgium), fully GDPR-compliant. Gmail OAuth tokens are encrypted with hardware-managed keys before storage.

What we don't do

• We never sell your data to third parties
• We never share your data with advertisers
• We never send emails or messages from your accounts on your behalf
• We never store or process emails that our AI classifies as not relevant to your family

Third-party services (sub-processors)

SuperMae relies on a small set of carefully chosen sub-processors to run and improve the service — including AI / language-model processing, secure EU-based cloud hosting, voice transcription, and message and email delivery. Where a sub-processor is located outside the EU, transfers are protected by Standard Contractual Clauses. We never sell your data, and it is not used to train AI models.

A complete named sub-processor list — each provider's role, jurisdiction, retention, and safeguards — is available on request at privacy@supermae.ai and in our Data Processing Agreement. Any sub-processor change is governed by GDPR Article 28, and we keep this notice up to date whenever our sub-processors change.

Extended family and support network

When you add a person to your family graph who is not a SuperMae user themselves — a grandparent, a nanny, a co-parent who hasn't joined, a carpool contact — you confirm at the moment of adding them that:

• you have informed them (or will inform them) that their name, contact details, and any context you add about how they help are stored in your SuperMae family
• you have their permission to do so
• they can ask you to remove their details at any time, and you can remove them from your family graph in the SuperMae app immediately

Until they themselves join SuperMae and provide their own consent, you are the controller of their data within your family. We process it on your behalf to make pickup coordination, reminders, and family logistics work.

Children's data

By adding your children, you confirm that you have parental authority or legal guardianship and consent to the processing of minors' data within this service (GDPR Article 8).

What we DO collect about minors:

• First name
• Age (or year of birth)
• School name and campus (when shared)
• Grade or year level (when shared)
• Teacher names (when shared)
• Extracurricular activities (when shared)
• Health details (allergies, medical conditions) — only if you voluntarily share them and only with explicit consent at the time. See the dedicated section below.

What we never collect about minors:

• We never ask for home address, financial information, or photos of children
• Your children have the same GDPR rights as you — you can exercise them on their behalf at any time

Health and medical data — special category (GDPR Article 9)

If you choose to share information about your child's allergies, medical conditions, or any other health-related detail, we treat this as special category personal data under GDPR Article 9. We will:

• ask for your explicit consent at the moment you share it (you'll see a clear note from your assistant before the first health detail is stored)
• process it only for the purpose you provided it (e.g., reminding you of medication, alerting the right adult about an allergy at pickup)
• never use it for analytics, marketing, training, or any secondary purpose
• delete it whenever you ask

Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access & Portability (Articles 15 & 20): Ask for a complete copy of all data we hold about your family in a machine-readable JSON format. Just send the message “export my data” or “exporta os meus dados” to SuperMae on WhatsApp; you'll receive a 24-hour signed download link.
• Rectification (Article 16): Tell SuperMae anything that is incorrect and it will update the record.
• Erasure (Article 17): Permanently delete all of your family data. Send the message “delete everything” or “apaga tudo” to SuperMae on WhatsApp. For your protection against accidental or unauthorised deletion: each verified parent on your family receives an email confirmation link valid for 72 hours; ALL parents must confirm. After the last parent confirms, a 24-hour cooling-off period opens during which you can cancel by sending “cancel deletion” on WhatsApp. After cooling-off, deletion runs across primary storage; backup snapshots age out as described under Data retention below. See our Data Deletion page for step-by-step instructions and alternative manual flow.
• Withdraw consent: Disconnect Gmail or Google Calendar at any time; you can stop using the service at any time.
• Lodge a complaint: With the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt if you believe we have processed your data unlawfully.

Data retention

We keep your data while your account is active. Conversation history older than 6 months is automatically aged out; structured records (events, kid profiles, school information) are kept while your account is active and removed on Article 17 erasure or after a 30-day grace period following account cancellation.

Backup retention. Our cloud infrastructure provider manages automated backups of the database where your data lives at rest; those backups age out within 35 days under the provider's standard retention policy. SuperMae does not retain its own backup snapshots beyond the provider's managed lifecycle. When you exercise your right to erasure, your data is removed from primary storage immediately; backup snapshots age out within 35 days, completing the standard SaaS deletion lifecycle.

A complete retention schedule per data type is documented in our DPA, available on request.

Contact

For privacy questions or to exercise your rights, email privacy@supermae.ai.