Privacy policy

Last updated 6 October 2026

Supersonic Playground Ltd runs Supersonic Playground Cloud, a service for hosting and looking after WordPress websites. This policy explains what personal data we hold, why we hold it and what you can ask us to do with it. Questions go to [email protected].

Who is responsible for your data

We are the controller for the data about the people who use Supersonic Playground Cloud: your account, your workspace settings and any Google account you connect.

The websites hosted through Supersonic Playground Cloud belong to our customers. Data about those websites’ visitors is controlled by the customer who owns the site, and we process it for them under our agreement with them. If you visited one of those websites and have a question about your data, contact the website’s owner first.

What we collect

Your account

Your name, email address and a hashed copy of your password. If you turn on two-factor authentication, we keep its secret and recovery codes encrypted. Each sign-in session records your IP address and browser, and we use the IP address to limit repeated sign-in attempts.

Your workspace

The workspace name, the logo and colour you choose for client reports, the AWS access keys you give us (stored encrypted) and the settings for each site, such as domains, PHP versions and backup times.

Your websites

Your sites’ files, databases and backups are kept in the AWS account you connect to your workspace. We read and change them only to deploy, update, back up, copy and monitor your sites.

Traffic and monitoring

We count page views, missing pages (404s), errors and response times from your sites’ edge and server logs. Page view and 404 counts are stored by page address and day, without cookies, IP addresses or query strings. Page view counts are kept for 400 days and 404 counts for 90 days. Server log lines can include visitors’ IP addresses and browser details. We use them for live logs and monitoring charts and keep them for one month; the charts’ hourly and daily totals are kept for six months.

Google user data

You can connect a Google account to show Google Search Console and Google Analytics figures for your sites. When you do, Google asks you to allow us to:

• see the email address of the Google account, so you can tell connected accounts apart
• read Search Console data for the properties the account can access
• read Google Analytics data and the list of Analytics accounts, properties and web streams the account can access

If you choose to set up Search Console for a domain from Supersonic Playground Cloud, Google also asks you to allow us to verify domains you own and to add them to Search Console. We use that permission only when you ask us to set up a property.

From those permissions we store the account’s email address, the tokens Google issues (encrypted) and, for each site you link, daily figures copied from Google: search clicks, impressions, click-through rate and average position, the pages and searches that brought visitors, the indexing status of your most visited pages, and Analytics sessions, engaged sessions, key events and page views. We keep these figures for 26 months.

Google tokens and figures are protected in the ways described under How we protect your data. The tokens are encrypted before they are stored, are used only by Supersonic Playground Cloud to fetch figures from Google and are never shown to anyone, including the people in your workspace.

We use this data only to show reports to the people in your workspace and in the monthly reports you produce for your clients. We don’t sell it, use it for advertising or use it to train AI models, and no one at Supersonic Playground Ltd reads it unless you ask us to help with your account, we need to investigate a security problem or the law requires it.

If you ask Supersonic Playground Cloud to write a summary for a monthly report, that report’s figures, including the Google figures shown in it, are sent to Anthropic to write the summary. Anthropic processes them on our behalf and doesn’t use them to train its models.

Supersonic Playground Cloud’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a Google account at any time from Workspace settings, which revokes our access and deletes its tokens. You can also remove our access from your Google account’s security settings. Figures already copied stay with the sites they were imported for until those sites are deleted or the figures reach 26 months old; email us if you want them deleted sooner.

Why we use your data

We use account, workspace and website data to provide the service you signed up for, which is our lawful basis under UK GDPR. We use sign-in records and error reports to keep the service secure and working, which is in our legitimate interests. Google data is used only with the permission you give when you connect an account.

Who we share data with

We use these providers to run Supersonic Playground Cloud. Each one processes data only to provide its service to us.

• Amazon Web Services, in your own AWS account, to host your websites and their backups
• Google, when you connect a Google account or we run a Lighthouse check of your homepage through PageSpeed Insights
• Anthropic, for monthly report summaries you ask for
• Sentry, to record errors in Supersonic Playground Cloud
• Our email provider, to send sign-in, invitation and alert emails

We don’t sell personal data. We share it with others only if the law requires it.

How we protect your data

We treat Google tokens and figures, AWS access keys, passwords and two-factor secrets as sensitive data and protect them like this:

• Encryption in transit. Every connection to Supersonic Playground Cloud uses HTTPS (TLS), and plain HTTP requests are redirected to HTTPS. We connect to Google, AWS and our other providers over TLS too.
• Encryption of secrets. Google access and refresh tokens, AWS access keys, two-factor secrets and recovery codes, and site database passwords are encrypted with AES-256 before they are written to our database. The encryption key is kept on the application server, separate from the database, so a copy of the database on its own can’t be used to read them.
• Passwords. We store only a salted bcrypt hash of your password, never the password itself, and limit repeated sign-in attempts.
• Two-factor authentication for everyone. Every user must set up two-factor authentication before they can see any workspace data, including Google figures.
• Access controls. Each workspace’s data, including its Google connections and figures, can be seen only by that workspace’s members. Workspace admins decide who joins, and a removed user loses access straight away. Within Supersonic Playground Ltd, only a small number of staff can reach workspace data or our servers, and only for the reasons given in the Google user data section above.
• Secure hosting. Supersonic Playground Cloud runs on Amazon Web Services in London. Our database and cache can’t be reached from the internet, and our servers accept administrative access only with SSH keys, not passwords.
• Least privilege with Google. We ask Google only for read-only access to Search Console and Analytics, plus permission to verify domains and add them to Search Console, which we ask for only when you choose to set up a property. Disconnecting a Google account revokes our access with Google and deletes its tokens.
• Retention. We keep data only for the periods set out in this policy and delete it when they end.

If we become aware of a breach that affects your personal data, we will tell the affected workspace users without undue delay and, where the law requires it, report it to the Information Commissioner’s Office within 72 hours.

How long we keep it

We keep account and workspace data while your workspace is active, and traffic and Google figures for the periods given above. A workspace admin can request closure from Workspace settings → Your data. We confirm with you, then delete the workspace’s data from Supersonic Playground Cloud within 30 days, including every member’s account. Sites, files and backups in your own AWS account stay under your control.

Your rights

You can download a copy of your personal data, or delete your account, at any time from Workspace settings → Your data. Workspace admins can also download the workspace’s data there. To correct your data, restrict how we use it, object to how we use it or ask for anything else, email [email protected]. If you’re not happy with our reply, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

When we change this policy we update the date at the top. If a change affects how we use Google data or other data you’ve already given us, we tell workspace users by email before it applies.