Privacy Policy

This Privacy Policy describes how SentiWorks, Inc. ("SentiWorks," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the SentiBrief service, including our websites at https://sentibrief.com and https://sentibrief.ai (which provide the same Service), our mobile-web experience, and our native mobile applications for iOS and Android (collectively, the "Service"). SentiBrief is a software-as-a-service application that lets users configure automated "agents" that generate personalized briefings ("Signals"), including text, images, and audio, using third-party artificial intelligence providers, and that delivers and shares those briefings on a schedule the user selects.

This Privacy Policy applies to personal information we process about visitors to the Service, registered account holders, and individuals who receive briefings shared through the Service. It does not apply to third-party websites, applications, or services that we do not own or control. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

SentiWorks, Inc. is the controller (or, where applicable, the business) responsible for the personal information processed through the Service. SentiWorks is a corporation based in the United States.

We collect personal information that you provide to us directly, information that is collected automatically when you use the Service, and information we receive from third parties such as authentication and payment providers. The categories of personal information we collect are described in Sections 3 and 4 below. The specific information collected depends on how you interact with the Service and the features you use.

We collect the following categories of information directly from you:

• Account and identity information. When you create an account, we collect your email address, a password (which we store only in hashed form), your name, your date of birth (used to confirm you meet our minimum age requirement), and your time zone (used to schedule delivery of your briefings). If you sign in using a third-party identity provider, we receive identifiers associated with that account (see "Authentication information" below).
• Authentication information. If you choose to sign in with Google or with Apple, we receive account identifiers, basic profile information, and authorization scopes from those providers in order to create or access your account. We do not receive your third-party account password. Sign-in, sessions, and password management are operated by our own authentication service; we do not use a third-party hosted identity provider to manage sign-in. In connection with sign-in we also maintain email-verification and password-reset codes, active-session records, and records of failed sign-in attempts used to protect your account.
• Agent configuration and content. When you set up and operate an agent, we collect the configuration inputs you provide, which may include free-text entries, selected lists and options, chosen icons, and other parameters. We also collect files and other materials you upload ("Artifacts"), such as images and documents, that an agent uses or relies on.
• Communications, sharing, and recipient information. If you share a briefing, we collect the information you supply to do so, including recipient email addresses (limited in number per share), any note you add, and your choice of whether to share anonymously. If you submit feedback or contact us for support, we collect the content of those communications and the contact details you provide.
• Preferences and consent choices. We collect your communication and notification preferences (including whether you wish to receive email notifications when new Signals are delivered, marketing email preferences, and delivery-time settings), your cookie-consent selections (on the web), and your analytics opt-out choice.
• Payment and plan information. When you purchase a paid subscription (Lite, Starter, Plus, or Pro) or a Signal Credit pack on the web, payment is processed by our third-party payment processor. We do not collect or store your full payment card number. We receive limited billing information from our payment processor, such as the card brand, the last four digits of the card, the card's expiration date, your subscription status, and your invoice and transaction history. In-app purchases made through the Apple App Store or Google Play are managed by Apple or Google under their terms; we receive purchase confirmations, transaction and subscription identifiers, and renewal, refund, and cancellation status needed to activate and manage your purchase, but not your payment card details. For every plan, including the Free plan, we maintain records of your current plan and curated-agent capacity, your Signal Credit grants and expirations, and the Signal Credits consumed by each of your agent runs.

The content you provide through agent configuration, uploaded Artifacts, and shared materials may contain additional personal information if you choose to include it. You are responsible for the information you submit to the Service, and you should not upload information you do not have the right to share.

When you access or use the Service, we and our service providers automatically collect certain information, including:

• Device and connection information. Your IP address, browser type, operating system, device type and identifiers, application version, and the platform you are using (for example, web, mobile web, iOS, or Android). Where we retain IP addresses in our operational logs, we apply masking to reduce the precision of the address.
• Usage and analytics information. Information about how you interact with the Service, collected through our first-party analytics pipeline. This includes events such as account creation and sign-in, page and content impressions, searches and search results, clicks, agent-setup funnel steps, sharing actions, notification events, and retention milestones. Analytics events are associated with a session identifier and, on the web, with a random identifier stored in your browser. The browser identifier is not derived from your device or from other information about you. If you create an account or sign in, we link it to your account so we can understand how you found and began using the Service.
• Referral and campaign information. When you arrive at the Service through a link that carries referral or campaign parameters (for example, from an advertisement, an email, or a shared link), we record the campaign source and name, the page you landed on, and, where your browser provides it, the referring page. We associate this information with your analytics events and, if you create an account, with your account.
• Log and diagnostic information. Server-side logs that record requests, correlation identifiers used to trace a request across our systems, error and performance information, and, for our mobile applications, crash and diagnostic reports. Our logging is configured to redact secrets and to reduce the inclusion of personal information.
• Cookies and similar technologies. Information collected through cookies, local storage, and session storage as described in Section 5.

We do not collect precise geolocation information, and we do not request location permission on any platform. On the web, camera, microphone, and geolocation permissions are disabled by the Service through our browser permissions policy. Our native applications request notification permission so that we can deliver push notifications you enable, and our iOS application requests access to your camera or photo library only at the moment you choose to attach a photo to an agent's setup or to save a Signal image to your photo library; photos you attach are processed as Artifacts. We infer only approximate location (for example, a general region derived from your IP address or the time zone you select) for purposes such as scheduling and security.

Sensitive Information

We do not intentionally collect special categories of personal data or sensitive personal information such as government identifiers, biometric data, genetic data, health information, precise geolocation, racial or ethnic origin, religious beliefs, or information about sex life or sexual orientation. We collect your date of birth for the limited purpose of verifying that you meet our minimum age requirement, and we collect account credentials (such as your hashed password) for authentication. Because you control the content of your agent configurations and uploaded Artifacts, such content could contain sensitive information if you choose to include it; we discourage you from submitting sensitive information that is not necessary for your use of the Service.

On the web, including our mobile-web experience, we use cookies, local storage, and similar technologies to operate the Service, remember your preferences, secure your session, and understand how the Service is used. We classify these technologies as follows:

• Strictly necessary. Required for the Service to function. These include authentication and session cookies, a cookie that records your cookie-consent choices, and a cookie that remembers whether you are using the desktop or mobile experience. We also store limited information in your browser's local and session storage to cache your profile, maintain analytics session identifiers, and preserve your billing and consent state. We rely on a bot-mitigation provider (see Section 7) that loads a script to distinguish humans from automated abuse.
• Personalization (optional). Used to remember preferences such as your display theme. These are enabled only with your consent.

When you first visit the Service in a web browser, we present a consent banner for optional cookies that allows you to accept, reject, or customize your choices by category. You can change your choices at any time using the "Cookie settings" control available in the Service. Your consent selections are stored on your device and, for signed-in users, associated with your account so that they are remembered across sessions and devices. Our native iOS and Android applications do not use browser cookies and do not present a cookie banner; they store the equivalent strictly necessary information (such as your sign-in session, your preferences, and your analytics choice) in application storage on your device. We do not use cookies or similar technologies for cross-context behavioral advertising on any platform.

Analytics

We use first-party analytics to understand how the Service is used and to operate, secure, and improve it. On the web, our analytics uses a random identifier kept in your browser's local storage. It persists across visits until you opt out, sign out, or clear your browser storage. We treat this as a necessary operational activity carried out in our legitimate interest in providing and improving the Service, not as advertising, and we do not use it to build advertising profiles or to track you across other websites, applications, or services. Analytics operates on an opt-out basis on every platform: it is on by default, and you can opt out at any time using the usage-analytics control in Cookie settings or in your privacy settings on the web, or in the settings of our native applications. If you are signed in, your choice is saved to your account and applied across your devices. If you are not signed in, it is saved in your browser and carried to your account if you later create one or sign in. When you opt out on the web, we stop sending analytics events from that browser and delete the browser identifier described above. On the web we also honor Global Privacy Control (GPC) signals sent by your browser as an opt-out. Opting out does not disable strictly necessary processing or the operation of features you use.

We use personal information for the following purposes:

• To provide and operate the Service, including creating and authenticating your account, configuring and running your agents, generating and delivering your Signals, storing and managing your Artifacts, and enabling sharing features you choose to use.
• To process payments and manage subscriptions, including initiating checkout, confirming and reflecting subscription changes, displaying invoices and payment-method information, and managing cancellations, renewals, and plan changes.
• To communicate with you, including sending transactional messages such as email-verification codes, password-reset instructions, security notices, notifications that new Signals are available, and responses to your support requests.
• To send product and marketing communications, where you have opted in or where otherwise permitted by law, and subject to your ability to opt out at any time.
• To personalize your experience, including presenting recommended agents and tailoring content and scheduling to your stated preferences and time zone.
• To analyze and improve the Service, including measuring engagement, understanding feature usage and funnels, diagnosing problems, and developing new features.
• To maintain security and prevent abuse, including authenticating users, mitigating automated abuse and fraud, checking proposed passwords against known-compromised password datasets, enforcing our terms, reviewing content and activity flagged by automated safety systems, issuing warnings and suspending or terminating accounts under our Terms, and protecting the rights, property, and safety of SentiWorks, our users, and others.
• To comply with legal obligations, including responding to lawful requests, maintaining records, and exercising or defending legal claims.

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising or targeted advertising. We disclose personal information only in the following circumstances:

• Service providers and sub-processors. We share personal information with vendors that perform services on our behalf and are contractually bound to protect it and use it only as directed. Our principal service providers include:

  • Cloudflare, Inc. — application hosting (including the infrastructure on which our own authentication service runs), content delivery, edge compute, object storage for Artifacts, bot mitigation (Turnstile), and email delivery infrastructure.
  • Neon, Inc. — managed database services used to store account and Service data.
  • Resend — email delivery for the messages we send you, such as sign-in and verification codes, password resets, receipts, notifications, and briefings you choose to send by email.
  • Stripe, Inc. — payment processing and subscription billing for purchases made on the web.
  • OpenAI and Google LLC (Google Gemini and Cloudflare Workers AI hosted models) — artificial-intelligence model providers used to generate briefing content, images, and audio (see Section 8). We may include a pseudonymous account identifier (a random value that is not your name or email address) with requests to these providers so that any policy violation can be associated with a specific account.
  • Google LLC — Google sign-in (OAuth), cloud computing infrastructure used to run our briefing-generation pipeline, Firebase Cloud Messaging used to deliver push notifications, and Google Play billing for in-app purchases made through Google Play.
  • Apple Inc. — Sign in with Apple, the Apple Push Notification service, and App Store billing and subscription management for in-app purchases made through the App Store.
  • A provider of compromised-password screening, queried using a privacy-preserving method that does not transmit your full password, used to enforce our password policy.
  • Where enabled, third-party analytics providers that process usage events on our behalf to help us understand and improve the Service.
• User-directed sharing. When you create a share link, send a briefing by email, or use your device's native sharing features, we disclose the relevant briefing content and associated information to the recipients and through the channels you select. Public agent pages and shared briefing pages that you choose to make available may be accessible to anyone who has the link.
• Legal and safety. We may disclose personal information if we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of SentiWorks, our users, or the public, including by reporting unlawful content or activity to law enforcement or other authorities where the law requires it.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, personal information may be transferred as part of that transaction, subject to the commitments made in this Privacy Policy.
• With your consent or at your direction. We may share personal information for other purposes with your consent or at your direction.

We may also create and share aggregated or de-identified information that cannot reasonably be used to identify you.

The Service generates briefing content using third-party artificial-intelligence model providers, currently OpenAI, Google (including Google Gemini and models hosted on Cloudflare Workers AI). To generate your Signals, we transmit the configuration inputs, uploaded Artifacts, and related context you provide to these providers, which process that information to produce text, images, and audio outputs that are returned to you through the Service.

These AI providers process the information we transmit in order to deliver the outputs and may retain it for a limited period in accordance with their respective terms, including for purposes such as service delivery and abuse monitoring. We do not use the content of your agent configurations, Artifacts, or generated Signals to train our own machine-learning models.

Safety screening and enforcement records. Our AI providers apply automated safety filters to the content we transmit to them. When a provider declines a request or flags content for safety reasons, we record a safety event associated with your account. The record includes the provider, the reason category, the affected agent and run, and a cryptographic hash or short excerpt of the affected content, not a full copy. Our staff may review these events, together with the related agent configuration and Artifacts, to decide whether our Terms have been violated. Enforcement decisions combine automated flags with human review.

AI-generated content may be inaccurate, incomplete, or otherwise unreliable. The Service displays a notice that AI can make mistakes and that you should verify important information. The Service does not make decisions that produce legal or similarly significant effects about you solely by automated means without human involvement. Automated processing is used to generate briefing content and to present recommended agents based on your use of the Service.

The agent personas, characters, and imagery generated or displayed by the Service are fictional and AI-generated. They are not real people and are not intended to depict or resemble any actual person, living or dead, and any such resemblance is unintentional and coincidental. We do not create these personas or images to represent identifiable real individuals.

We offer a Free plan and paid subscription plans (Lite, Starter, Plus, and Pro), as well as one-time Signal Credit packs. The current prices, monthly Signal Credit allotments, and curated-agent capacity for each plan are set out in Section 6 of our Terms and Conditions at https://sentibrief.com/terms and are shown in the Service at the time of purchase. Purchases made on the web, including purchases you begin in our native applications and choose to complete on the web, are processed by Stripe, our third-party payment processor. In-app purchases made through the Apple App Store are processed by Apple, and in-app purchases made through Google Play are processed by Google. We do not receive or store your full payment card number, security code, or other complete payment credentials from any of these processors. Stripe processes your payment information in accordance with its own privacy policy and applicable payment-industry standards. We receive from Stripe the limited billing information necessary to manage your subscription, such as your card brand, the last four digits of your card, expiration date, subscription status, and invoice history, and from Apple and Google the purchase confirmations, transaction identifiers, and subscription status needed to activate and manage in-app purchases. We also keep a ledger of the Signal Credits granted to and consumed by your account, including the credits consumed by each agent run, so that we can meter usage, show you forecasts and history, and resolve billing questions. You can manage your payment methods and billing details through the billing portal made available in the Service or, for in-app purchases, through your Apple or Google account.

We retain personal information for as long as necessary to provide the Service, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements. In general:

• Account information is retained for the life of your account and deleted or de-identified after the retention period described in Section 12, unless we are required or permitted to retain it longer.
• Artifacts and agent content are retained while the owning agent and account remain active and until you delete them. Files that you upload and that remain associated with an active agent are retained for the life of that agent; files you delete are removed in accordance with our standard processes.
• Share links that you create expire after a limited period (typically thirty days) and may be revoked by you at any time before expiration.
• Operational logs are retained for a limited period for security, troubleshooting, and reliability purposes.
• Safety and enforcement records are retained for the life of your account. Safety events are deleted with your account. Records of warnings, suspensions, terminations, and appeals, including the reason category and a pseudonymous account identifier, are retained after your account is closed or deleted for as long as needed to prevent users we have removed from returning, to resolve disputes, and to demonstrate compliance with our providers' policies and applicable law.
• Analytics information is retained for as long as needed to understand and improve the Service.

Where we are unable to delete certain information promptly (for example, because it is stored in backups), we will isolate it from further processing until deletion is possible. Actual retention periods may vary based on the type of information and the purposes described above.

We maintain reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. These measures include encryption of data in transit using industry-standard protocols, storage of passwords in hashed form, access controls, automated bot-mitigation and temporary lockout after repeated failed sign-in attempts on authentication actions, screening of passwords against known-compromised datasets, redaction of secrets and personal information in our operational logs, and hardened security response headers designed to reduce common web vulnerabilities.

No method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee the absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for notifying us of any unauthorized use of your account. You may sign out of other active sessions and change your password through the Service.

You have choices regarding your personal information:

• Access and update. You can review and update your name, time zone, and certain other profile details within the Service, and you can change your password or set a password if you registered using a third-party identity provider.
• Communication preferences. You can opt in or out of email notifications for new Signal deliveries and of marketing communications through your settings. Marketing emails also include a one-click unsubscribe link. Transactional and service-related messages are not promotional and may still be sent while your account is active.
• Cookie and consent choices. You can accept, reject, or customize optional cookie categories at any time using the cookie-settings control.
• Analytics choices. You can opt out of our first-party analytics at any time using the usage-analytics control in Cookie settings or in your privacy settings on the web, or in the settings of our native applications. If you are signed in, your choice is saved to your account and applied across your devices; if you are not, it is saved in your browser and carried to your account if you later sign in. On the web we also honor Global Privacy Control (GPC) signals sent by your browser as an opt-out.
• Manage your content. You can view, download, and delete your Artifacts through the artifact-management area of the Service, and you can delete individual agents. Deleting required setup files may archive the agent that relies on them.
• Connected accounts. You can view, link, and unlink third-party sign-in accounts (such as Google) through your settings.

To exercise rights that are not available as self-service features—including requests to access, correct, delete, or receive a portable copy of your personal information, or to close your account entirely—you may contact us at support@sentiworks.com. We will respond to verifiable requests as required by applicable law. We may need to verify your identity before fulfilling your request, and we will not discriminate against you for exercising your privacy rights. If an authorized agent submits a request on your behalf, we may require proof of authorization and verification of your identity.

Account Deletion

You may delete your account at any time through the account-deletion controls in the Service, or by contacting us at support@sentiworks.com. You may also delete specific agents and Artifacts directly within the Service at any time. Deleting your account deletes your entire SentiWorks account, not only your SentiBrief data. When you delete your account, your SentiBrief product data is archived for up to 60 days for restoration requests, charge disputes, fraud prevention, security, legal compliance, and legitimate business administration. At the end of that period, we delete your sign-in identity, remove your email address, name, and date of birth from your account record, and delete your SentiBrief product data, except where retention is required or permitted by law as described in Section 10. If your account was warned, suspended, or terminated for violating our Terms, we retain limited enforcement records after deletion as described in Section 10.

Depending on your state of residence, you may have rights under state privacy laws, including the California Consumer Privacy Act, as amended (the "CCPA"), and comparable laws in states such as Virginia, Colorado, Connecticut, and Utah, among others. These rights may include the right to know or access the personal information we collect about you, the right to correct inaccurate personal information, the right to delete personal information, the right to obtain a portable copy of certain personal information, the right to opt out of the sale of personal information or of processing for targeted advertising, and the right to be free from discrimination for exercising your rights.

We do not sell personal information and do not process personal information for targeted advertising or share it for cross-context behavioral advertising as those terms are defined under applicable state law. We do not use or disclose sensitive personal information for purposes that would require us to offer a right to limit its use under the CCPA. We honor Global Privacy Control (GPC) signals sent by your browser as an opt-out of first-party analytics, and we treat such signals as a valid opt-out request where applicable law requires us to recognize them.

In the preceding twelve months, we have collected the categories of personal information described in Sections 3 and 4, which correspond to the following CCPA categories: identifiers (such as name, email address, IP address, and account or device identifiers); information described in California Civil Code Section 1798.80(e) (such as name and payment-related information processed by our payment processor); commercial information (such as subscription and transaction history); Internet or other electronic network activity information (such as usage and analytics data and logs); audio, electronic, or visual information (such as uploaded Artifacts and generated images and audio); approximate (non-precise) geolocation information; and inferences drawn to recommend agents. We collect these categories from the sources, use them for the purposes, and disclose them to the categories of recipients described in this Privacy Policy.

To exercise your state privacy rights, contact us at support@sentiworks.com. You may also designate an authorized agent to make a request on your behalf, subject to verification.

California "Shine the Light"

California residents may request information about our disclosure of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Right to Appeal

If we deny your request to exercise a privacy right and you reside in a state that provides a right to appeal, you may appeal our decision by contacting us at support@sentiworks.com. If your appeal is denied, you may contact the attorney general or relevant supervisory authority in your state.

The Service is not directed to children under the age of 13, and we require account holders to be at least 13 years old. We do not knowingly collect personal information from children under 13. In jurisdictions where the minimum age of digital consent is higher, you must meet the applicable minimum age in your jurisdiction to use the Service. If we learn that we have collected personal information from a child below the applicable minimum age without appropriate consent, we will take steps to delete that information. If you believe a child has provided us with personal information, please contact us at support@sentiworks.com.

The Service may contain links to, or integrate with, third-party websites, applications, and services that we do not own or control, including identity providers, payment processors, and AI providers. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third party before providing your information to it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will revise the "Last Updated" date above. If we make material changes, we will provide additional notice as appropriate, such as by posting a prominent notice within the Service or, where required, by notifying you by email. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes, except where additional consent is required by law.

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us: