Privacy notice
Version privacy-2026-11-03, last changed 3 November 2026. It covers this website, early access requests, Supernatural workspaces, and the Supernatural apps for Android and iPhone.
- Who we are
- Early access requests
- Supernatural workspaces
- Software you connect
- Data from Google
- The phone apps
- AI
- Who else handles it
- Where and how long
- Your choices
- Deleting your account
Who we are
Supernatural is built and run by Rang & Mall Private Limited, Visakhapatnam, India. Write to [email protected] about anything on this page.
For what a workspace holds about other people, such as its customers and contacts, the company that owns the workspace decides why and how it is used. We process it on that company's instructions.
Early access requests
| Your email address | To write to you when your workspace is ready. |
| The sentence you typed, if any | To understand what you want Blue to do first, so we can order who gets access. |
| A rough region (India, UK, US, EU country, or other) | Read from the country our network provider reports for your request, so we apply the right rules. We do not store your IP address. |
| The time you agreed, and which version of this notice | So we can show what you agreed to. |
The legal basis is your consent, given by ticking the box on the form. We use this only to reply about early access. A copy of each request goes to our team's mailbox so a person reads it and replies. We do not send a newsletter, sell the data, or share it with advertisers. No AI model reads it. We keep it up to 12 months after your last request, then delete it.
Supernatural workspaces
| Your account | Your name, email address, a hash of your password, and your sign-ins (when, and the browser and network address used), to let you in and keep your account safe. |
| What your workspace holds | The records, files, mail, messages, meetings, calls and apps your people make or bring in, to run Supernatural for your company. |
| People who never signed up | Contacts your workspace adds by hand, imports, or that come from mail and meetings (name, email address, phone, company), because your company keeps a customer list in Supernatural. |
| Your AI key and your keys for other software | Kept encrypted, used only for your workspace's requests, never shown back to anyone. |
| Usage records | Which features are used and what each AI request cost, to run, fix and plan Supernatural. |
| Your agreement | When you agreed to the terms and which version, so we can show what you agreed to. |
| Reports and mutes | When someone reports a message, a person or an answer from Blue, we keep who reported it, the reason, their note, and a copy of what was reported (for Blue, the question asked and the answer given), so the workspace's admins can look at it. Only those admins see it; it never leaves the workspace and no AI model reads it. When you mute someone, we keep that you did, so their messages stop notifying you. Only you see it. |
Some apps keep more, and say so where you use them. Calls in Reps are recorded or transcribed only after a spoken or written notice, and the transcript is kept for your workspace's retention setting (30 days unless an admin changes it). Campaign mail carries an unsubscribe link, and Supernatural keeps a record of who agreed to hear from your company and who stopped.
The app keeps your sign-in in your browser's storage. We set no advertising or tracking cookies.
Software you connect
A workspace admin can connect other software, such as a Google or Microsoft account, a CRM, or a mail account by its password. Before anything is connected, Supernatural shows what it will be able to read and change. What a connection brings in is copied into the matching app (mail into Mail, events into Calendar, files into Drive) and kept until someone deletes it.
The connection's sign-in or password is kept encrypted, used only by the code that talks to that software, and never shown back. Removing a connection deletes it and, where the other software allows, revokes it there. Records already brought in stay until you delete them.
Data from Google
When you connect a Google account, Supernatural asks only for what the connection you chose needs:
| Your name, email address and picture | To show which Google account is connected. |
| Gmail, read only | To bring your mail into Supernatural Mail, so you can read it, search it, and act on it alongside your other work. Supernatural never sends, changes or deletes mail in Gmail. |
| Google Calendar events, and the list of your calendars | To show your events in Supernatural Calendar and keep both sides in step when you add or change an event. Events are deleted in Google only if you turn on mirroring deletions. Adding an event never emails its guests. |
| Google Drive, read only | To bring your files and folders into Supernatural Drive. Supernatural never changes or deletes them in Google Drive. |
Supernatural's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google data only to provide and improve the features you see in Supernatural that use it.
- We transfer it to others only to provide those features (for example, to the AI provider your workspace chose, when you ask Blue about your mail), for security, to comply with the law, or as part of a merger or sale with notice to you.
- We never use it for advertising, never sell it, and never use it to train AI models.
- People at Rang & Mall do not read it, unless you ask us to for support, it is needed for security or abuse, or the law requires it.
You can remove the connection in Supernatural at any time, or at myaccount.google.com/permissions. Mail, events and files already brought in stay in your workspace until you delete them.
The phone apps
The Supernatural apps for Android and iPhone open the same service as this website, at run.supernatural.blue. You sign in with the same account, and everything on this page applies in the same way. The apps add only what a phone needs:
| Camera, photos and files | Only when you choose to take a photo or pick a file to add, for example to a message or a task. The app does not look through your photos or files. |
| Microphone and camera in calls | Only while you are in a call or meeting, or while you talk to Blue by voice. Your phone asks you first. |
| Notifications, if you allow them | Your phone gives the app a push token, a code that lets us reach that phone. We keep it until you sign out on that phone, Google or Apple tells us it no longer works, or your account is deleted. |
| Things you share into the app | Text, links and files you share from another app go into your own message box in Supernatural, as if you had added them yourself. |
| App lock | If you turn it on, your phone checks your fingerprint or face. The check happens on the phone. Nothing about it reaches us. The setting stays on the phone. |
Notifications travel through Google Firebase Cloud Messaging on Android and Apple Push Notification service on iPhone. They carry only the kind of thing that happened, such as "New message", and where it opens in the app. Never a name, a subject or the words of a message.
The apps do not read your location, your phone's contacts or calendar, or other apps. They show no ads, contain no advertising or analytics code, and do not track you across apps or websites.
AI
Blue, Supernatural's assistant, runs on the AI provider your workspace admin chose, with your workspace's own key, such as OpenAI, Anthropic or Google. When you ask Blue something, the records it needs to answer, which can include mail, messages and contacts you are allowed to see, are sent to that provider under your company's agreement with them. Blue only reads what the person asking could open themselves. Search indexes are built on our own servers. We do not use your workspace's data to train AI models.
Who else handles it
- The AI provider whose key your workspace adds, for each request Blue makes.
- The software you connect, which receives and sends what that connection does, under your agreement with it.
- Resend, in the United States, sends our sign-in codes, account emails, and the early access copies to our team.
- Cloudflare carries traffic between your browser and our servers.
- Twilio, only if your workspace connects its own Twilio account for phone calls.
- Google Firebase Cloud Messaging and Apple Push Notification service, which carry notifications to the phone apps, as described above.
We do not sell personal data, show ads, or share it with advertisers.
Where and how long
On our own servers in India. If you are in the UK or the EU, this means your data is transferred to India. Business customers there can ask us for a data processing agreement that includes the EU standard contractual clauses or the UK addendum.
While a workspace exists, we keep what it holds. When a workspace is deleted, its data is removed from our live systems within 30 days. Database backups are kept for 14 days, then deleted, so a deleted workspace leaves them within that time. Security logs are kept for at least 180 days. A report stays until an admin closes it, and is deleted one year after it was closed, with its copy of what was reported. A mute stays until you unmute or your account is deleted.
Supernatural is for businesses and people 18 or older.
Your choices
You can see, correct, export or delete your account's data, and withdraw any consent you gave. You can delete your account yourself, in the app or on the website: see Deleting your account. Your workspace admins can export or delete what the workspace holds. If you are a contact in someone's workspace, write to that company first; we will help them answer. Write to [email protected] for anything you cannot do in the app. We act within 30 days, and we do not need a reason.
Grievance officer for India: write to [email protected] with Grievance in the subject. We acknowledge within 24 hours and resolve within 15 days. If you are not satisfied with our answer, you can complain to the data protection authority where you live.
If we change this notice, the version and date at the top change, and we email workspace admins before a change that affects them.
Deleting your account
In the Android or iPhone app, or on the website: open Your account, then Delete my account. Supernatural shows what will be deleted and what will be kept before anything happens, and asks you to type a word and your password to confirm.
- If others still use your workspace, your account closes at once. Your sign-in, name, email address, picture, phone numbers, push tokens and private chats with Blue are deleted. Work you did for the company stays with it, because the company owns it.
- If you are the only admin and others still use the workspace, make someone else an admin first.
- If you are the only person in the workspace, the whole workspace is deleted with your account, at once.
Copies in our database backups leave within 14 days. If you cannot sign in, write to [email protected] from the address on your account. More on the account deletion page.