Privacy Policy

Last updated: 2026-06-28

1. What we collect

• Account data: name, email, organization, photo (provided through Clerk).
• Integration data: read-only data from the third-party tools you connect (Stripe, HubSpot, QuickBooks, Slack, Google Calendar, Notion, Gmail, Pipedrive). Scope is the minimum required for daily briefs.
• Usage data: pages visited, features used, error events, agent costs. Used to operate and improve the Service.
• Billing data: handled by Stripe. We never see your full card number; we store only the last 4 digits and brand for display.

2. How we use it

To generate your daily brief, send transactional email, process payments, support you, prevent abuse, and comply with legal obligations. We do not sell your data. We do not run targeted advertising on you.

3. AI processing

Your integration data is sent to Anthropic (Claude) and, as fallback, OpenAI to produce briefs. We use providers' enterprise APIs with their zero-retention/no-training data settings where supported. We do not permit either provider to train their models on your private workspace data.

4. Storage and security

Data is stored in Neon Postgres (US region) with encryption in transit (TLS 1.2+) and at rest. Third-party access tokens are encrypted with AES-256-GCM before write. Authentication via Clerk. Production access is restricted to two named operators.

5. Retention

Briefs and integration snapshots: retained for the life of your account, then deleted within 30 days of account closure. Logs: 90 days. Billing records: 7 years for tax compliance.

6. Your rights

You can access, export, correct, or delete your data at any time from the dashboard, or by emailing support@smbeastmode.com. We will respond within 30 days. EU/UK/California residents have additional rights under GDPR/CCPA including objection, restriction, and data portability.

7. Subprocessors

Anthropic (LLM), OpenAI (LLM fallback), Neon (database), Clerk (auth), Stripe (billing), Resend (transactional email), Inngest (workflows), Sentry (error tracking), PostHog (product analytics), Vercel (hosting), Upstash (rate limiting), Lakera (prompt-injection screening). A current list is available on request.

8. Cookies

We use first-party cookies for session, CSRF protection, and product analytics. No third-party advertising trackers.

9. Children

The Service is not intended for users under 18. We do not knowingly collect data from children.

10. International transfers

Data is processed in the United States. By using the Service from outside the US, you consent to that transfer.

11. Changes

Material changes will be announced in-app or by email at least 14 days before the effective date.

12. Contact

Questions or requests: support@smbeastmode.com.