Sweat AI Privacy Policy

Who we are

Sweat AI (“Sweat AI”, “we”, “our”) provides managed onboarding, fraud and due-diligence operations for businesses, and operates Check, a merchant due-diligence service. Businesses submit a subject and a question; we research publicly available sources, screen the subject name against published sanctions and watchlists, and return an evidence packet.

What we collect

Your account. The email address you sign in with, and the workspace you belong to. If you sign in with Google we receive your email address, name, and profile picture from Google — nothing else, and we never receive your Google password.

What you ask us to investigate. The subject you name, the question you type, any context you paste, and any documents you upload. These are stored against your case.

What the investigation finds. The public sources we read, the text captured from them, the time of capture and a content hash, and the findings built from them. This is the evidence packet, and it is kept so a conclusion can be traced back to the source it rests on.

How the product is used. Pages visited, referral parameters, button interactions, and session recordings — a replay of what happened in the browser window. Recordings are not masked: they can include the subject you typed, the question you asked, and the report returned. We record this to find where the product fails people. If that is not acceptable for a given case, do not run it here.

We do not collect payment card data, bank credentials, government identifiers, location data, or precise device identifiers. We do not ask for the personal data of the individuals a subject employs beyond what the public record already publishes.

How we use it

• Run the investigation you asked for and return the evidence packet.
• Keep each case available to you and to the workspace it was filed in, so a finding can be re-read and traced to its source.
• Meter usage in credits, and enforce the cost and rate limits that stop one workspace consuming the service.
• Find and fix failures — which is what the session recordings and error logs are for.

We do not sell your data, and we do not use the contents of your cases to train third-party models.

Who we share it with

• Your workspace: members of the workspace a case is filed in can see that case.
• Subprocessors: Supabase (managed Postgres + storage), Amazon Web Services (application hosting), Anthropic, OpenAI and Google (AI inference), Browserbase (a hosted browser we use for some public-registry lookups, which receives the name being looked up), PostHog (website and product analytics), and Google Calendar (meeting scheduling).
• Law enforcement only when legally compelled by a binding order in a jurisdiction we operate in.

Retention

A Check case run on our shared service is kept for 30 days after it is created and then deleted, unless your order form sets a different period. Other account data, including messages received through a channel your workspace connects, is kept while your account is active. When an account is deleted, we remove the associated data within 30 days, except where the law requires us to keep a record longer.

Messaging channels your workspace connects

A workspace can connect one of its own messaging accounts, such as an Instagram business account. We then receive the messages people send to that account, with the sender’s account identity and the earlier conversation, and pass them to that workspace’s workflows so its team can review and answer them. Only that workspace can see them, and they are kept as described under Retention. A short technical copy of each incoming message, used to diagnose delivery problems, is deleted after 30 days.

Our social media accounts

We publish our own content, such as short films, to our accounts on TikTok, YouTube, Instagram and Facebook. To do so we store the access tokens those platforms issue for our own accounts, and we read the performance of the posts we publish (views, likes, comments, shares). We do not use these integrations to collect data about other people, and we do not sell or share platform data. If you message or comment on our accounts, we see what you send us there, and the platform’s own privacy policy also applies.

Your rights

You can request access to, correction of, or deletion of any personal data we hold about you at any time by emailing [email protected]. Deleting a case removes its packet, its captured sources and its documents. Deleting your account removes your membership and the cases you filed; cases filed by others in a shared workspace stay with that workspace. The procedure is on our Data Deletion page.

Contact

Sweat AI · [email protected]