Suprahire Privacy Policy

Version: 1.0
Effective Date: 23 August 2026
Last Updated: 23 August 2026
Contact: legal@suprahire.com

Preamble

This Privacy Policy explains what information Suprahire collects, why it collects it, how it is protected, how long it is kept, and what rights you have over it. It applies to suprahire.com, to the Suprahire APIs and Runtime, and to every interaction with the Platform, whether initiated by a person or by an autonomous system.

Suprahire is operated by Muhammad Nabeel, founder, from Karachi, Sindh, Pakistan, together with any successor entity into which the business is incorporated ("Suprahire", "we", "us", "our"). Capitalized terms not defined here have the meaning given in the Terms of Service, which this Policy forms part of.

Suprahire is architected so that the most sensitive data it touches — your model provider credentials and the content you send to and receive from an Agent — is never persisted. Understanding that is the fastest route to understanding this Policy, and Section 3 sets it out in full.

Our role: controller and processor

Data protection law distinguishes between a controller, who decides why and how personal data is processed, and a processor, who processes it on a controller's instructions. Suprahire occupies both roles depending on the data:

Where Suprahire acts as a processor, it processes personal data only on the Consumer's documented instructions — expressed through the act of initiating an Execution against a chosen Agent — and only for as long as that Execution runs.

Publishers as sub-processors. When a Consumer invokes an Agent, that Agent's code processes the Consumer's Payload inside Suprahire's Runtime. In data protection terms the Publisher acts as a sub-processor in respect of that Payload. The Publisher is contractually bound by the Terms of Service to process it only as necessary to perform the function declared in its Manifest, and never to persist, transmit, or repurpose it. Consumers should review a Listing before submitting personal data to an Agent, and should not submit special-category data to an Agent they have not independently assessed.

Section 1 — Information We Collect

We collect only what the Platform needs to operate, settle, and defend itself. We do not buy personal data, and we do not build advertising profiles.

1.1 Publisher and Consumer Account Data

Collected directly from you when you register and maintain an Account:

Payment instrument numbers are collected and stored by our payment processor, not by Suprahire. We hold only a token and the last four digits.

1.2 BYOK Credentials

Credentials you supply for Model Providers or other third-party services. These are collected only because you choose to store them, and are held under the terms in Section 3.

We store: the encrypted credential, a label you assign, the provider it belongs to, the date added, and the date last used. We do not store: the credential in plaintext at rest anywhere, in any log, metric, trace, backup, container image, or Execution Record.

A BYOK Credential is not, in ordinary use, personal data about you. It is treated in this Policy at the highest sensitivity tier regardless, because its compromise would expose your account at a third party.

1.3 Agent and Manifest Data

Collected from Publishers: the suprahire.yaml Manifest, Agent artifacts and container images, version history, declared network allowlists, declared resource requirements, pricing, Listing copy, documentation, and the third-party and open-source component inventory.

Agent source code is confidential to the Publisher and is not disclosed to Consumers or to any third party, save as described in Section 4.

1.4 API Usage and Telemetry

Collected automatically when the Platform is used:

1.5 Signed Execution Records

The central operational record of the Platform. One is generated for every Execution and committed to the Trust Ledger:

An Execution Record contains hashes, not content. The hash lets you prove, later, exactly what was submitted and returned, without Suprahire holding the material itself. Suprahire cannot reconstruct a Payload from its hash.

Where an input Payload contains personal data, the hash is nonetheless treated as personal data where it can be linked to an identifiable person by a party holding the original Payload.

1.6 Support and Correspondence

Messages you send to us, including support tickets, security reports, dispute submissions, intellectual property notices, and their attachments and metadata.

1.7 Website Data

Pages visited, referring URL, and interaction events on suprahire.com, collected in aggregate for product and content decisions. We use privacy-preserving, first-party analytics and do not deploy cross-site advertising trackers. Where cookies beyond those strictly necessary for the service are used, they are set only with your consent, and you may withdraw it at any time.

1.8 What We Do Not Collect

We do not collect government identity documents (except where required for payout compliance), biometric data, precise geolocation, or special-category data as defined by the GDPR. We do not retain Payload content. If you submit such data inside a Payload, it is processed transiently under Section 3 and never persisted by us.

Section 2 — How We Use Information

2.1 Purposes of Processing

2.2 Legal Bases (EEA, UK, and equivalent regimes)

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that the processing is necessary, proportionate, and not overridden by your rights. You may object at any time under Section 5.6, and we will stop unless we can demonstrate compelling legitimate grounds or need the data to establish or defend legal claims.

2.3 Automated Decision-Making

The Platform makes automated decisions in three places: refund classification (Section 3.8 of the Terms), rate limiting and abuse throttling, and Account or Agent suspension where an automated signal indicates a serious threat.

These decisions are based on signed, objective telemetry rather than profiling. Where an automated decision produces a legal or similarly significant effect on you, you may request human review by writing to legal@suprahire.com, and we will provide a reasoned response and the ability to contest the outcome.

We do not use personal data for automated profiling for advertising, credit assessment, or employment purposes.

2.4 What We Never Do

• We do not sell personal data, and we do not "share" it for cross-context behavioural advertising.
• We do not use Payloads, BYOK Credentials, Agent source code, or Manifests to train, fine-tune, or evaluate any model. See Section 3.4.
• We do not disclose a Publisher's source code to Consumers, or a Consumer's identity to a Publisher in connection with a specific Execution, except as necessary to resolve a dispute you have raised.
• We do not read Payloads. The Runtime handles them; no member of Suprahire personnel has an interface through which to view them.

Section 3 — Ephemeral Data Handling and Zero-Retention Commitments

This Section describes the architectural commitments that distinguish Suprahire's handling of sensitive data. These are binding commitments, not aspirations, and they are incorporated into the Terms of Service as material terms.

3.1 The Lifecycle of an Execution

1. Request. You invoke an Agent. The Runtime authenticates the caller, validates the request signature where the caller is a Machine Principal, and checks rate, quota, and balance.
2. Provision. A fresh, single-tenant Ephemeral Worker — a microVM or equivalent — is provisioned for this Execution alone. It is never reused, never shared, and never carries state from a prior Execution.
3. Inject. The BYOK Credential you designated is decrypted from the Credential Vault and injected into the volatile memory of that worker only. It is not written to the worker's filesystem, not passed through a log, and not recorded anywhere in the request path.
4. Execute. The Agent runs, subject to a default-deny egress policy limited to its declared Manifest allowlist, a memory ceiling, a CPU quota, a disk quota, and a wall-clock timeout. It runs without root privileges, on a read-only root filesystem, under a restrictive system-call filter.
5. Record. The Runtime computes cryptographic hashes of the input and output Payloads, assembles the Execution Record, signs it, and commits it to the Trust Ledger.
6. Destroy. The worker is torn down. Its memory, filesystem, and every credential and Payload within it are destroyed unconditionally — on success, on Agent error, on timeout, on cancellation, and on infrastructure failure alike. There is no code path in which a worker's state survives its Execution.

3.2 Zero-Retention Commitment — BYOK Credentials

We commit that BYOK Credentials:

(a) exist in plaintext only in the volatile memory of an Ephemeral Worker, and only for the duration of the Execution you initiated; (b) are destroyed on worker teardown, without exception and without regard to the Execution's outcome; (c) are never written to a container image, an Agent artifact, an Execution Record, a log line, a metric, a trace, an error report, a crash dump, or a backup; (d) are never transmitted to any party other than the Model Provider the credential belongs to, at the Agent's direction, during the Execution; (e) are never accessible to Suprahire personnel in plaintext — no administrative interface, support tool, or database view exposes a decrypted credential; and (f) are never used for any purpose other than performing the Execution you initiated.

At rest in the Credential Vault, credentials are protected by envelope encryption with per-tenant data encryption keys, held under key encryption keys in a managed key service. You may delete a credential at any time; deletion is propagated to backups within the backup cycle stated in Section 5.4.

3.3 Zero-Retention Commitment — Payloads and Execution State

We commit that input and output Payloads:

(a) are not persisted by Suprahire in any durable store; (b) exist only in the memory of the Ephemeral Worker and in the transient request and response path; (c) are reduced to a cryptographic hash for the Execution Record, from which the original content cannot be reconstructed; (d) are not logged — our log pipeline scrubs Payload fields at the point of emission, not after the fact; and (e) are destroyed with the worker, along with all ephemeral filesystem state, temporary files, and memory pages.

Consequence you should understand: because we do not retain Payloads, we cannot recover, re-send, or reproduce the output of a past Execution, and we cannot help you reconstruct what an Agent returned. If you need a durable record of Payload content, you must retain it in your own systems. The Execution Record lets you prove what was submitted and returned; it does not let you retrieve it.

3.4 No Training on Your Data

Suprahire does not use Payloads, BYOK Credentials, Agent source code, or Manifests to train, fine-tune, distil, evaluate, or benchmark any artificial intelligence or machine learning model, whether our own or a third party's, and does not sell, license, or otherwise make them available to any third party for that purpose.

This applies with no exception, no opt-out to be found in settings, and no separate enterprise tier required to obtain it. It is the default and only behaviour of the Platform.

Suprahire does operate internal models for abuse detection and anomaly scoring. These are trained exclusively on Execution Record metadata, request telemetry, and security signals — never on Payload content, credentials, or Agent source code.

Where an Agent transmits your Payload to a Model Provider using your BYOK Credential, that Model Provider's data handling is governed by your agreement with it, not by this Policy. Whether a Model Provider trains on your data is determined by the terms of your account with that provider. Suprahire has no visibility into, and no control over, that relationship.

3.5 Limits of These Commitments

These commitments describe Suprahire's architecture and processes. They are not, and cannot be, a warranty that any system is immune from compromise.

They also do not extend to the conduct of an Agent within its declared network allowlist. An Agent is third-party code. Suprahire constrains what an Agent can reach, meters what it consumes, and prohibits credential exfiltration contractually and technically — but the Publisher, not Suprahire, is responsible for what its code does with a Payload inside those constraints. Assess a Listing before sending sensitive data to it.

Section 4 — Third-Party Sharing and Sub-Processors

We do not sell personal data. We do not share it for advertising. We disclose it only in the circumstances below.

4.1 Categories of Recipient

We impose written obligations on every processor requiring confidentiality, security measures appropriate to the risk, processing only on our instructions, and deletion or return of data on termination. Where required, we execute Article 28 data processing terms.

4.2 Model Provider Calls Directed by Your BYOK Credential

This deserves separate emphasis. When an Agent calls a Model Provider:

• You direct the call, by choosing to invoke that Agent with your credential attached.
• The Payload leaves Suprahire's boundary and is transmitted to the Model Provider by the Agent, over the Agent's declared network allowlist.
• Suprahire is not a party to that transmission's terms. The Model Provider's privacy policy, retention practices, training practices, and geographic processing locations apply.
• Suprahire does not receive, log, or retain the content of that call or its response, beyond the output hash recorded in the Execution Record.

Before invoking an Agent with sensitive data, review both the Agent's Listing — which declares which providers it reaches — and your agreement with the Model Provider concerned.

4.3 Disclosures Between Publishers and Consumers

Publishers receive aggregate statistics about their Agents: execution volume, success rate, latency distribution, revenue. They do not receive Consumer identities, Payload content, or per-Consumer usage patterns.

Where a Consumer raises a dispute under Section 3.9 of the Terms, Suprahire may disclose the relevant Execution Records — metadata and hashes, not Payloads — to both parties, and may disclose the Consumer's Account identifier to the Publisher to the extent necessary to resolve it.

4.4 Legal and Safety Disclosures

We may disclose information where we reasonably believe it necessary to: comply with applicable law, regulation, legal process, or an enforceable governmental request; enforce the Terms, including investigating a potential breach; detect, prevent, or address fraud, security, or technical issues; or protect against harm to the rights, property, or safety of Suprahire, our Users, or the public.

Where we are legally permitted to do so, we will notify you before disclosing your data in response to legal process, and will seek to narrow overbroad requests. We do not provide any government with direct, unfettered, or bulk access to Platform data.

We cannot disclose what we do not hold. A demand for the content of a past Execution cannot be satisfied, because Payloads are not retained.

4.5 Business Transfers

If Suprahire is incorporated, merges, is acquired, or sells substantially all of its assets, personal data may transfer to the successor as part of the transaction, subject to the successor being bound by commitments no less protective than those in this Policy. We will give notice through the Platform and by email before any such transfer takes effect, and you may close your Account and request deletion beforehand.

Section 5 — International Transfers, Security, Retention, and Your Rights

5.1 International Data Transfers

Suprahire is operated from Pakistan and serves users worldwide. Personal data is processed in Pakistan and in the regions where our cloud infrastructure operates, and may be transferred to, stored in, and accessed from countries other than your own — including countries that have not been the subject of an adequacy decision by the European Commission or the UK Government.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on one or more of the following:

We carry out transfer impact assessments where required, and apply supplementary technical measures — principally encryption in transit and at rest, and the zero-retention architecture in Section 3, which means the most sensitive categories are never at rest in any jurisdiction.

A copy of the Standard Contractual Clauses in place may be requested at legal@suprahire.com.

At the date of this Policy, Pakistan does not have comprehensive general data protection legislation in force. Suprahire therefore applies GDPR-aligned standards to all Users globally as its baseline, irrespective of where you are located and irrespective of whether the GDPR applies to you as a matter of law.

5.2 Security Controls

Certifications. Suprahire does not currently hold, and does not represent that it holds, SOC 2, ISO/IEC 27001, or equivalent third-party certification. The controls above are described so that you can assess them on their merits. We will state plainly if and when that position changes.

No absolute guarantee. No system is perfectly secure. We implement measures appropriate to the risk, but we cannot warrant that the Platform will never be compromised.

5.3 Breach Notification

If we become aware of a personal data breach affecting your data, we will:

(a) notify the competent supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals and notification is required; (b) notify affected Users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, or where notification is otherwise required by law; (c) where Suprahire acts as processor, notify the affected Consumer without undue delay so that they can meet their own notification obligations; and (d) describe the nature of the breach, the categories and approximate volume of data concerned, the likely consequences, and the measures taken or proposed.

5.4 Data Retention Schedule

We keep personal data only as long as needed for the purpose it was collected for, or as required by law.

Where we are required to retain data to comply with a legal obligation, resolve a dispute, or enforce our agreements, we retain only the minimum necessary for that purpose and isolate it from active processing.

After a retention period expires, data is deleted or irreversibly anonymized. Anonymized and aggregate statistics — which cannot be linked back to you — may be retained indefinitely.

5.5 Your Rights

Subject to your jurisdiction, you have the following rights. We do not charge for exercising them, and we will not discriminate against you for doing so.

How to exercise them. Use the Platform's privacy controls where available, or write to legal@suprahire.com. We will verify your identity proportionately to the sensitivity of the request — generally by confirming control of the Account email, and for high-risk requests by an additional factor.

Response times. We respond within 30 days, extendable by a further 60 days for complex or numerous requests, with notice to you of the extension and the reason. For California requests, we respond within 45 days, extendable once by a further 45 days.

Authorized agents. You may use an authorized agent to make a request. We will require written proof of authorization and may verify directly with you.

Requests about Payload data. Where you are an individual whose personal data was contained in a Payload submitted by a Consumer, Suprahire is a processor and does not retain that content. Direct your request to the Consumer who submitted it, who is the controller. We will assist that Consumer in responding, and will identify them to you where we lawfully can.

5.6 Jurisdiction-Specific Disclosures

European Economic Area, United Kingdom, and Switzerland. The disclosures in Sections 2.2, 5.1, 5.3, and 5.5 satisfy Articles 13 and 14 of the GDPR and the UK GDPR. Suprahire has not appointed an Article 27 representative; where one becomes required, this Policy will be updated with the representative's details. You may lodge a complaint with your national supervisory authority, with the UK Information Commissioner's Office, or with the Swiss Federal Data Protection and Information Commissioner.

California. Under the CCPA as amended by the CPRA: we collect the categories of personal information identified in Section 1; we use them for the business purposes in Section 2; we disclose them to the categories of recipient in Section 4. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly collect the personal information of anyone under sixteen. You have rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information; we do not use sensitive personal information for purposes requiring a limitation right. We will not discriminate against you for exercising any right.

Other United States states. Residents of states with comprehensive privacy legislation — including Virginia, Colorado, Connecticut, Utah, and Texas — have rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and certain profiling. We honour these through the mechanisms in Section 5.5. We do not conduct targeted advertising or sell personal data.

Pakistan. Suprahire complies with applicable Pakistani law, including the Prevention of Electronic Crimes Act, 2016 and the Electronic Transactions Ordinance, 2002. Should comprehensive data protection legislation come into force in Pakistan, this Policy will be updated and, where it grants rights beyond those described here, those rights will be honoured.

Everyone else. Where your local law grants rights not listed above, we will honour them on request to the extent they apply.

Section 6 — Children

The Platform is not directed at children and is not intended for use by anyone under eighteen (18) years of age. We do not knowingly collect personal data from children. If we learn that we have, we will delete it and close the associated Account. If you believe a child has provided us with personal data, contact legal@suprahire.com.

Section 7 — Changes to This Policy

We may update this Policy to reflect changes to the Platform, to our practices, or to law.

For material changes — including any change to the zero-retention commitments in Section 3, to the categories of recipient in Section 4, or to retention periods in Section 5.4 — we will give at least thirty (30) days' prior notice by email to the address on your Account and by notice on the Platform, before the change takes effect.

Non-material changes take effect on posting. Every version carries a version number and an effective date, and we maintain an archive of prior versions available on request.

We will never apply a materially less protective version retroactively to data already collected.

Contact

Privacy questions, data subject requests, and complaints:

legal@suprahire.com

Suprahire · Karachi, Sindh, Pakistan

We aim to acknowledge every privacy enquiry within five (5) business days.