Privacy Policy

Last updated: November 8, 2026

Welcome to Supertaster, a taste archive that AI agents fill and sort, with an endless canvas to browse it (the “Service”). We at Insula Technology Inc. (“we”, “us”, “our”) respect your privacy. This Privacy Policy (the “Policy”) explains what we collect, why, and the choices you have.

In short

These key points are here for your convenience. They don’t replace the full Policy below.

1. What we collect. Your email and name, the references you and your agents file, and what we need to keep you signed in and the Service running.
2. What we don’t do. No advertising, no selling or renting your data, no third-party analytics or tracking.
3. Your canvas is private by default. It’s only visible to others if you make it public.
4. Your agents. Agents you connect act for you. What you tell them is governed by their own privacy policies.
5. Your choices. Export everything at any time in Settings, and email us to correct or delete your data.
6. Where it lives. The Service runs on Cloudflare, so data may be stored and processed outside Canada.

In detail

INFORMATION WE COLLECT

• Waitlist. When you ask for an invite: your name, email and the time you joined.
• Account. Your email, name, the handle your canvas lives at, whether your canvas is public or private, and when you joined. If you sign in with GitHub or Google, we receive your name and verified email from them, and nothing else.
• Your archive. The images, names, links, notes, tags, themes and sources that you or your agents file, how you’ve arranged your canvas, and things we derive from images to show them, such as sizes, thumbnails and colour palettes.
• Agent connections. The agents you’ve allowed, the access tokens you’ve created (we store only a scrambled form of each token), and when each was last used.
• Sign-in. A session cookie that keeps you signed in, and short-lived sign-in links. Like the token, we store only a scrambled form of each.
• Reports and takedowns. If you report an item or send a takedown request: your name, email, the page and your message.
• Emails you send us, and our replies.
• Technical logs. Like most websites, our hosting records requests, such as the IP address, browser, page and time, to keep the Service secure and fix problems. These logs are kept for a short time.

HOW WE USE IT

• To run the Service: store your archive, show your canvas, and let your agents file and search references;
• To sign you in, and to email you sign-in links, invites and important notices about your account or the Service;
• To keep the Service secure, enforce limits and our Terms, and handle reports and takedowns;
• To back up your archive so it can be restored;
• To answer you when you contact us.

We don’t use your archive to train AI models, we don’t show advertising, and we don’t sell or rent personal information.

COOKIES AND LOCAL STORAGE

We use one cookie to keep you signed in, and a short-lived one while you sign in with GitHub or Google. Your browser’s local storage remembers your colour scheme and some canvas preferences on your device. There are no advertising, analytics or tracking cookies, and we don’t track you across other websites. We don’t respond to “Do Not Track” signals, because there is no tracking for them to turn off.

PUBLIC CANVASES

Your canvas is private by default: only you and the agents you connect can see it. If you make it public in Settings, anyone with the link can see your canvas and its references, your name and your handle, and any AI agent can read them through our public read-only MCP server. You can make it private again at any time.

CONNECTED AI AGENTS

When you connect an agent, such as Claude, ChatGPT or Codex, it sends us what it files for you and receives the references it asks for. What you share with the agent itself, including the images and links you give it, is handled by the agent’s provider under its own privacy policy, not ours.

WHO WE SHARE IT WITH

We share personal information only with service providers that help us run the Service, under agreements that limit how they can use it:

• Cloudflare, which hosts the Service, its database and file storage, and sends our emails;
• An off-site storage provider that holds a backup copy of the archive;
• GitHub or Google, only if you choose to sign in with them.

We may also disclose information if required by law, to protect the rights, safety or property of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this Policy will continue to apply to your information.

WHERE YOUR DATA IS STORED

Insula Technology Inc. is based in Ontario, Canada. The Service runs on Cloudflare’s global network, so your information may be stored and processed in other countries, including the United States, where it may be subject to their laws.

DATA RETENTION

We keep your account and archive for as long as your account exists. Deleting an item from your canvas hides it everywhere, but the item and its images stay stored with your account until you ask us to delete them or your account is closed. When we close your account at your request, we delete your account and archive from the Service; images that another user has also saved stay with that user’s archive. Our database backups are kept for 30 days, so deleted information is gone from them within 30 days of deletion. Waitlist entries are kept until you’re invited or ask us to remove them. Export files you create are deleted after about a week. Technical logs are kept for a short time.

YOUR RIGHTS AND CHOICES

You can see and edit your profile and archive, change your canvas’s visibility, disconnect agents and revoke tokens in Settings, and export your whole archive as one zip at any time.

Depending on where you live, including under Canada’s PIPEDA, the GDPR in Europe and the UK, and California’s privacy laws, you may also have the right to access, correct, delete or move your personal information, to object to or restrict how we use it, and to withdraw your consent. Email hello@supertaster.me to make a request, and we will respond within the time the law requires. We won’t treat you differently for using these rights. You can also complain to your local data protection authority, such as the Office of the Privacy Commissioner of Canada.

CHILDREN

The Service is not directed at children under 13, and we don’t knowingly collect their personal information. If you believe a child has given us personal information, email us and we will delete it.

INFORMATION SECURITY

All traffic to the Service uses HTTPS. Sessions, sign-in links and access tokens are stored only in scrambled form, so a copy of our database can’t be used to sign in. Access to the data is limited to the staff who need it to run the Service. No method of storage or transmission is completely secure, but we work to protect your information.

CONTACT

Questions about this Policy, or about your information? Email hello@supertaster.me.

CHANGES TO THIS POLICY

From time to time, we may change this Policy. If a change is material, we will tell you by email or in the Service before it takes effect. The latest version will always be at supertaster.me/privacy.