Privacy Policy
Version 2026-09-21 · How SuperFile Inc. [confirm] handles personal data in SuperDRM.
Two different kinds of person appear in this policy: you, the customer who has an account with us, and your viewers, the people whose players ask us for licences. We are the controller for your account data. For viewer data we are your processor — the Data Processing Addendum governs that, and this policy describes what we actually store.
Your account
| What | Why | Kept |
|---|---|---|
| Email, name, password hash, or the SuperID / Google identifier you signed in with | To have an account at all | Until you delete the account |
| Passkeys (public key and metadata — never a private key) | Passwordless sign-in | Until removed, or the account is deleted |
| Sessions: a hashed token, the user agent, a salted hash of your IP address | Keeping you signed in; showing you your own sessions | Until expiry or sign-out, then purged nightly |
| Acceptance of these documents: the version and the timestamp | To show what you agreed to, and when | With the account |
| Audit log: who did what in a workspace | Security, and answering “who rotated that key?” | 90 days |
| Support email you send us | To answer you | As long as needed for the matter |
| Data-subject requests you make: kind, date, outcome | To show your request was answered, and in time | 24 months after it is closed |
| A Global Privacy Control signal your browser sent, with a salted hash of your IP address | To show we saw it and acted on it | 90 days |
Your workspace also holds things that are about the workspace rather than about you: its name and plan, API-key names and prefixes (never the key), verified domains, content-key labels, attested-device fingerprints, and who accepted the data-processing terms. They are in your export too.
Cookies. Three, all strictly necessary, all first-party: sdsess — your signed-in session, 30 days, HttpOnly; Secure; SameSite=Lax; a short-lived state cookie during sign-in with SuperID or Google; and sdrm_live on the gated operations console. There is no analytics cookie, no advertising cookie and no third-party cookie, which is why you are not asked to dismiss a banner.
Your viewers
Every licence request writes one row. That row is pseudonymous, not anonymous: it can single out a person even though it holds no name.
| Field | What it is |
|---|---|
user_ref | The viewer identifier you put in the licence token. We never see who it refers to. |
device_hash | A truncated hash of the client/device identifier in the CDM request. |
ip_hash | A salted hash of the viewer's IP address (SUPERDRM_IP_SALT). We do not store the address itself. |
ua | The user agent string the player sent (first 200 characters). |
client | The make, model and platform the CDM itself reported — the one platform signal a licence server can trust, because the user agent is the client's own claim. |
| Result | System, security level, latency, whether the licence was granted or refused and why. |
These rows are deleted after 90 days by a job that runs nightly. What survives is a daily count per workspace, per system, granted and refused — no viewer data in it. The retention period is a deployment setting (SUPERDRM_LICENCE_RETENTION_DAYS); the number shown here is the one this deployment runs.
Sharing signals — working out that one viewer reference is on many devices, or one device carries many viewer references — is profiling of your end users. It is off by default and can only be switched on by a workspace owner who has accepted the DPA.
The viewer's IP address itself is never written to our database. It exists in memory for the length of the request, and in the edge's own logs (Cloudflare). What we keep is the salted hash.
One thing the player fetches from someone else. Our player component needs Shaka Player for FairPlay playback on Apple devices, and by default it loads it from a public CDN (cdnjs.cloudflare.com) — which means that CDN sees your viewer's IP address, user agent and the page they were on. Widevine and Clear Key never load it. You can point the player at your own copy (the shaka-url attribute or window.SUPERDRM_SHAKA_URL) or pre-load Shaka yourself, and then nothing is fetched from anyone but you.
Who else sees data
Subprocessors, and what each one gets:
| Subprocessor | What for | What reaches them |
|---|---|---|
| IBM Cloud — VPC compute, Databases for PostgreSQL, Key Protect (United States) | The servers, the database, the HSM root key | Everything the service stores, encrypted at rest; Key Protect sees only wrapped keys |
| Cloudflare | The public edge and the tunnel to our nodes | Request metadata in transit (IP addresses, headers) |
| [transactional email relay — confirm] | Verification, reset, invite and alert email | Your email address and the message |
| Google LLC — Widevine cloud licence service | Registering content keys and signing Widevine licences | The licence challenge from the viewer's CDM, and key metadata |
| Apple Inc. — FairPlay Streaming | The FPS key-security module runs on our own nodes; Apple issues the credentials | Nothing routine is sent to Apple |
| EZDRM (only where a workspace uses proxy mode) | Relaying licences to a previous vendor during a migration | The licence challenge and key metadata for those requests |
| SuperIntel (only if you use the in-portal assistant) | Answering your questions about your workspace | Your question and the workspace facts shown on screen |
| SuperID / super.net (only if you sign in with it) | Federated sign-in | The sign-in itself; we receive your identifier, email, name and avatar |
| Google LLC (only if you sign in with Google) | Federated sign-in | The sign-in itself; we receive your identifier, email and name |
Full detail, including what each one is contracted to do and where it runs: the DPA's subprocessor table.
We do not sell personal data, and we do not use viewer data to advertise to anyone.
Your rights
- Export. Account settings → Your data downloads everything we hold about you as JSON. No secrets are included.
- Erasure. Account settings → Delete account. It removes your profile and any workspace you are the only member of. A workspace with other people in it needs a new owner first.
- Correction. Your display name is editable in the portal. Your email address is the account identifier, so changing it is a verification of the new address — write to us and we will do it.
- Anything else — objection, restriction, an access request in another form. Account settings → Your data → Make a request, or write to [email protected] [confirm]. Either way it is logged with the date it arrived.
- How long we take. We aim at 30 days and will answer within 45 in any event. If a request genuinely needs the extra 45 days the law allows, we will tell you why before the first period is up. Every request, and the date it was closed, is recorded.
- Complaint. You may complain to your local data-protection authority or Attorney General at any time; you do not have to come to us first.
- Crypto-shredding. Deleting a content key overwrites its sealed material. That is the strongest erasure we can offer for protected content — and it is irreversible.
If you are in the United States
California, Colorado, Connecticut, Texas, Virginia and a growing list of other states give you rights over your personal data. We give the same rights to everyone, wherever they are, so the controls above are the answer in every case. Four things those laws ask us to say plainly:
- We do not sell your personal data, and we do not share it for advertising. There is no advertising anywhere in this product: no pixel, no tag manager, no ad network, no data broker. There is nothing for an opt-out to stop.
- Global Privacy Control. If your browser sends
Sec-GPC: 1we record that we saw it, answer with anX-Privacy-Controlheader you can check, and switch off the one optional thing we do with your own words — sending a question to the in-portal assistant. Nothing else about the service changes. - Appeals. If we refuse a request, we will tell you why and how to appeal. Send “appeal” to [email protected] [confirm] within 45 days; a different person reviews it and answers within 45 days. If we still say no, we will tell you how to take it to your Attorney General.
- No penalty for asking. Nothing about your price, your plan or your service changes because you exercised a right.
Automated decisions. The licence server decides one thing automatically: whether a playback request gets a licence, under the policy our customer set. That affects playback, not any legal right. We make no automated decision about a person with a legal or similarly significant effect, and we do not profile anyone for credit, employment, housing, insurance or education.
Security
Content keys are sealed under a root key held in a FIPS 140-2 Level 3 HSM (IBM Key Protect) which cannot be exported, by us or by IBM. Databases and boot volumes are encrypted; there are no inbound ports on the servers. To report a vulnerability: [email protected], or see /.well-known/security.txt.
Changes
This policy carries the version shown at the top. Material changes are emailed to the address on your account and shown in the portal before they take effect.