This Privacy Policy explains how Supermod, Inc., doing business as Convexent ("Convexent," "we," "us," or "our"), collects, uses, shares, and protects information about you when you visit convexent.com (the "Site"), contact us, or use the Convexent application and related services (together, the "Services").
Information we collect
Information you give us
- Contact and demo requests. Your name, work email, company, deal phase, and any message you send.
- Account information. If you use the Services, your name, email address, organization, and login credentials.
- Customer Data. Documents, extracted financial information, prompts, generated models, and other content you or your organization upload to or create in the Services. Depending on the workflow, financial records may include personal information such as payroll or bank details.
- Communications. The content of emails and other messages you send us.
Information collected automatically
When you use the Site or Services, our hosting and infrastructure providers may log technical information such as IP address, browser type, device information, pages visited, and the date and time of access. We use this information to operate, secure, and troubleshoot the Services.
Within the Convexent application, we also record activity on models and projects (such as who made a change and when) to provide version history and restoration, and we use diagnostic and performance monitoring tools that may capture content displayed on screen.
How we use information
- To provide, maintain, and support the Services, and to improve their reliability and performance using technical and diagnostic information.
- To respond to inquiries and demo requests, and to communicate with you about the Services.
- To secure the Services, prevent fraud and abuse, and enforce our Terms of Service.
- To comply with legal obligations.
We treat Customer Data as confidential and process it to provide the Services to the customer that submitted it, as described in our agreement with that customer. This Policy does not grant additional rights to use Customer Data beyond that agreement. We do not sell personal information.
How we share information
We share information only in the following circumstances:
- Service providers. With vendors who process information on our behalf, described below.
- Within your organization. With other authorized users of your organization's account.
- Legal requirements. When required by law, or to protect the rights, property, or safety of Convexent, our users, or others.
- Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
- With your consent. When you direct us to share it.
Service providers
Depending on the features in use, information may be processed by the following service providers:
- Google Cloud for hosting, databases, file storage, and backups.
- Google (Gemini), OpenAI, and Anthropic for AI processing of customer content.
- Langfuse for AI observability, which may include prompts and outputs.
- Sentry for diagnostics, performance monitoring, and session replay, which may include content displayed in the application.
- Mailgun and Mailjet for inbound and transactional email, including attachments.
- Microsoft 365 for company email and correspondence.
Browser session replay is enabled for external application users without blanket text or media masking, so displayed Customer Data can be captured by Sentry. Customers may request that we disable session replay for their organization before live onboarding by contacting security@convexent.com. Permitted diagnostic data is addressed during the customer data-handling review.
AI processing may include customer documents, prompts, outputs, and model context. Applicable provider data-use terms, including any use for model training, retention settings, and processing locations, are addressed during onboarding and in the applicable customer agreements.
Customers can review data flows, permitted providers, and data-processing terms with us during onboarding. The Site itself loads fonts from Google Fonts, which receives your IP address when fonts are requested, and does not use advertising cookies or third-party advertising trackers.
Data retention
We keep Customer Data for the duration of the customer's engagement and other information for as long as needed for the purposes described in this Policy, unless a longer period is required by law. Deleting a document or model does not immediately remove every copy. Application audit history includes changes and state snapshots and currently has no automated expiry. Backups, archived file versions, AI transcripts, diagnostic logs, and service provider copies have separate retention settings; they do not all follow the same deletion schedule. Customers can request deletion through security@convexent.com. Deletion scope and timing, including retained copies, are addressed in the customer's service and data-processing agreements.
Security
We use administrative, technical, and organizational safeguards designed to protect information. These include HTTPS for all application traffic, encryption at rest, private and encrypted database connections, logical separation of customer data, role-based access controls, and support for multi-factor authentication and single sign-on. Access by Convexent personnel is restricted, and changes made through staff access are attributed to the acting user. No system is perfectly secure, and we cannot guarantee absolute security.
We maintain incident-response procedures covering investigation, containment, recovery, and follow-up actions. We notify affected customers as required by applicable law and customer agreements. Notification contacts, timing, and any additional requirements are established in the applicable customer agreement.
Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, or to object to or restrict certain processing. To make a request, email legal@convexent.com. We will not discriminate against you for exercising these rights. If your information is part of Customer Data controlled by your organization, we may refer your request to that organization.
International transfers
Convexent is based in the United States, and our core platform is hosted in the United States. Some service providers process information in other locations, including the European Union.
Children
The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children.
Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the effective date above and, for material changes, provide additional notice where appropriate.
Contact us
Questions about this Policy or our privacy practices can be sent to legal@convexent.com. Security questions and vulnerability reports can be sent to security@convexent.com.