Privacy
Policy

01Who we are

Mach 11 Inc., a corporation incorporated in the State of Delaware with its principal place of business at 65 W 55th St, New York, NY 10019, United States, trading as Supersonic (“Supersonic”, “we”, “us” or “our”), is responsible for the personal information described in this policy.

For the purposes of the UK and EU General Data Protection Regulation, we are the controller of the personal information we collect through our website and in the course of running our business. Where we handle personal information on behalf of a client as part of an engagement, we act as a processor — see section 14.

You can reach our privacy contact at hello@supersonic.studio or on (808) 400-9872.

02Scope of this policy

This policy explains what personal information we collect through the website at supersonic.studio (the “Site”) and through our dealings with prospective and current clients, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

It does not cover third-party websites you may reach from links on our Site, or the internal privacy practices of our clients.

03Information we collect

Information you give us

When you submit the contact form on the Site, we collect the information you enter:

• Full name (required)
• Work email address (required)
• Company name (optional)
• The message you write describing what you are trying to solve (required)

We also collect whatever you choose to tell us if you email us directly, speak to us on a call, or send us documents during a proposal or engagement — which may include your job title, phone number and the business context you share.

Information we collect automatically

Our hosting provider records standard server and request data when you visit the Site, which may include your IP address, the pages you request, the date and time of the request, your browser type and version, your operating system, the referring page, and general location inferred from your IP address at city or country level.

Information from third parties

If you are a business contact at a prospective client, we may hold basic professional details — name, employer, job title and business email — obtained from your employer, from a colleague who introduced us, or from publicly available professional sources.

What we do not collect

We do not knowingly collect special category data (such as health, biometric, racial or ethnic origin, religious or political data), government identification numbers, or payment card details through the Site. Invoices are settled through banking channels or a payment processor that handles card details directly; we do not store full card numbers.

04How we use information

We use personal information to:

• respond to enquiries submitted through the Site or sent to us by email;
• discuss, scope, quote for and negotiate an engagement;
• perform services under a statement of work, and communicate with you about them;
• issue invoices, take payment, and keep accounting and tax records;
• operate, secure, maintain and improve the Site, and diagnose technical problems;
• detect, investigate and prevent fraud, spam, abuse and security incidents;
• keep records of contracts, consents and correspondence; and
• comply with our legal, regulatory and accounting obligations, and establish, exercise or defend legal claims.

05Legal bases for processing

Where the UK or EU GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we have concluded they are not. You may object to that processing — see section 12.

06Cookies and similar technologies

A cookie is a small text file placed on your device by a website. Similar technologies include local storage, pixels and browser fingerprinting techniques.

Some limited data is nonetheless exchanged with third parties simply because your browser must fetch files from them in order to render the page:

• Google Fonts — the Site loads typefaces from fonts.googleapis.com and fonts.gstatic.com. Your browser sends your IP address and basic request headers to Google in order to fetch them. Google’s handling of that data is governed by the Google Privacy Policy.
• unpkg (Cloudflare) — the Site loads its front-end JavaScript libraries from unpkg.com, and your browser sends your IP address and request headers to that content delivery network to fetch them.
• Netlify — our host records standard server logs for every request, as described in section 3.

If you would rather your browser did not make those requests, you can block third-party requests using your browser settings or an extension. The Site’s text and layout will still work; typography and interactive elements may not render as intended.

You can also delete or block cookies through your browser settings. Instructions are published by Chrome, Firefox, Safari and Edge.

If we introduce analytics or any other non-essential cookie in future, we will update this section and ask for your consent before setting it.

07How we share information

We share personal information only in these circumstances:

• Service providers. Vendors who process information on our behalf under contract and on our instructions — see section 8.
• Professional advisers. Our lawyers, accountants, auditors and insurers, where they need it and are under a duty of confidence.
• Subcontractors. Where an engagement requires it, and subject to confidentiality obligations at least as protective as our own.
• Legal and regulatory. Where we are required to disclose by law, regulation, court order or a valid request from a public authority; or where disclosure is necessary to protect our rights, safety, or the rights and safety of others.
• Corporate transactions. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will notify you if your information becomes subject to a materially different privacy policy.

We do not sell personal information, rent it, or trade it.

08Service providers we use

The main providers that may process personal information on our behalf in connection with the Site are:

Additional providers may be used in the course of an engagement — for example cloud infrastructure, project tooling or model providers. Where an engagement involves them processing personal data on a client’s behalf, they are identified in the relevant data processing agreement.

You can request the current list of providers by writing to hello@supersonic.studio.

09International transfers

We are established in the United States, and our providers are principally located there. If you are in the United Kingdom, the European Economic Area or another jurisdiction with data-transfer restrictions, your personal information will be transferred to and processed in the United States, which may not offer the same level of protection as the law of your country.

Where such a transfer takes place, we rely on an appropriate safeguard — normally the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider’s certification under the EU–US Data Privacy Framework — together with any supplementary measures required. You can request a copy of the relevant safeguard by writing to hello@supersonic.studio.

10How long we keep information

We keep personal information only as long as we need it for the purpose we collected it, then delete it or anonymise it.

You may ask us to delete your information sooner — see section 12.

11How we protect information

We take technical and organisational measures appropriate to the risk, including encryption of the Site in transit (HTTPS/TLS), access controls and multi-factor authentication on the systems that hold personal information, limiting access to personnel who need it, confidentiality obligations on our people and subcontractors, and periodic review of our providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive personal information, credentials or payment card details through the contact form or by unencrypted email.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, within the timeframes set by applicable law.

12Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access — to be told whether we hold information about you and to receive a copy of it.
• Rectification — to have inaccurate or incomplete information corrected.
• Erasure — to have information deleted where we no longer have a lawful reason to keep it.
• Restriction — to have our use of your information limited in certain circumstances.
• Portability — to receive information you gave us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Withdraw consent — where we rely on consent, to withdraw it at any time, without affecting processing already carried out.
• Automated decisions — not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. We do not make such decisions about you.

To exercise any of these, write to hello@supersonic.studio with enough detail for us to identify you and your request. We will respond within 30 days, and will tell you if we need longer because the request is complex. We may need to verify your identity first. Exercising these rights is free; we may charge a reasonable fee or decline only where a request is manifestly unfounded or excessive, and we will explain why.

If you are in the UK or EEA and are unhappy with how we have handled your information, you may complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

13US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use and disclose it, to access and delete it, to correct inaccuracies, to obtain a portable copy, and to opt out of sale, targeted advertising and certain profiling.

We will not discriminate against you for exercising any privacy right. To make a request, write to hello@supersonic.studio. You may use an authorised agent where your state’s law allows it; we may ask for proof of their authority. If we decline a request, you may appeal by replying to our decision, and we will respond to the appeal within the period your state’s law requires.

14Client data in engagements

During an engagement we may be given access to systems and datasets belonging to a client that contain personal information about that client’s own customers, employees or users.

In that situation the client is the controller (or, under US state law, the business) and we act as a processor (or service provider). We process that information only on the client’s documented instructions, for the purposes of the engagement, under a data processing agreement where one is required.

If you believe your personal information was processed by us in that capacity and you want to exercise a right over it, please contact the organisation you dealt with — they are the controller. If you contact us instead, we will pass your request on and support them in responding.

15AI systems and your data

Our work involves building systems that use artificial intelligence. In relation to your personal information:

• We do not use the contents of contact-form submissions or business correspondence to train AI models, and we do not sell or supply that content to anyone for model training.
• Where an engagement involves sending client data to a third-party model provider, that is agreed with the client in advance and, where required, covered by a data processing agreement. We use provider configurations that exclude the data from training wherever the provider offers that option.
• We do not make decisions about you based solely on automated processing.

16Children

The Site and our services are directed at businesses and are not intended for children. Consistent with section 2 of our Terms & Conditions, the Site is for people aged 18 or over, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, write to hello@supersonic.studio and we will delete it.

17Third-party links

The Site may link to websites we do not operate. We are not responsible for their content or their privacy practices, and this policy does not apply to them. We recommend reading the privacy policy of any site you visit.

18Changes to this policy

We may update this policy to reflect changes to our practices, our providers, or the law. The version in force is the one published on this page, and the effective date at the top shows when it last changed. Where a change materially affects how we use your personal information, we will take reasonable steps to notify you — for example by email where we hold your address for that purpose.

19How to contact us

For any question about this policy, or to exercise a privacy right, contact hello@supersonic.studio or (808) 400-9872. You can also write to:

Mach 11 Inc. (trading as Supersonic)
Attn: Privacy
65 W 55th St
New York, NY 10019
United States
(808) 400-9872