Privacy Policy

Scope and Customer Data

This policy applies to personal information for which Suede is the controller. It does not apply to Customer Data (defined below), which we process on behalf of our Customers.

Our customers are organizations (“Customers”). Each Customer has an account in the App (a “Workspace”), and individuals use the App through a Workspace (“Users”).

“Customer Data” means information that a Customer or its Users submit to or create in the App, including configuration, uploaded files, conversations with the App’s AI agent, reports and other artifacts, and information obtained from third-party tools and accounts connected to the App (“Connected Services”).

We process Customer Data on the Customer’s behalf, as a “service provider” or “processor” as applicable privacy laws use those terms, under the agreement between Suede and that Customer (the “Customer Agreement”). The Customer Agreement governs our processing of Customer Data, including processing by AI model providers. If you are a User, or your personal information appears in Customer Data, please direct requests about that information to the relevant Customer. We will assist the Customer in responding.

The configuration a Customer provides may include:

• the organizations and brands to monitor, with their names and aliases;
• competitors and peers, with their websites and social media accounts;
• topics and prompts, and the languages, regions, and third-party AI chat products (“AI Assistants”) in which to monitor them;
• personas, which describe fictional audience members used to frame prompts;
• websites and pages to audit; and
• scheduled tasks and instructions for the agent.

This policy does not apply to third-party websites or services, including AI Assistants and Connected Services. Each third party’s privacy policy governs its own practices.

Information we collect

We collect personal information that you provide, information collected automatically when you use the Services, and information from AI Assistants, public sources, and Connected Services. We also collect information about viewers of shared artifacts and about access by AI Clients, as described below.

Information you provide

• Demo requests and inquiries. When you request a demo, we collect your name, work email address, organization, role, and message. When you book a meeting through our scheduling page, we collect the details you enter. When you email us, we receive your email address and message.
• Account information. Your name, email address, username, profile photo, and password (we store only a hashed version). If you sign in with Google or your organization’s single sign-on provider, that provider shares your name and email address with us and may share your profile photo. If you enable two-factor authentication or passkeys, we store the credentials needed to verify you.
• Workspace information. The Workspace’s name and logo, and the email addresses of individuals invited to it.
• Billing information. You enter payment details directly with our payment processor, Stripe. We store a Stripe customer identifier and the Customer’s subscription details. We may display a card’s brand, last four digits, and expiration date, which we retrieve from Stripe and do not store.

Information collected automatically

• Device and usage information. Your IP address, browser type, device type, the pages you view, the referring page, and the time of your visit, recorded in our server logs. In the App, our logs also record your account identifier and the actions you take.
• Sessions. When you sign in, we record the IP address and browser type for each session, so that you can review your active sessions in your account settings and so that we can protect your account.
• Account security. When you sign in or create an account, our authentication provider derives a device identifier from your browser’s characteristics to detect abuse, such as automated sign-in attempts and fraudulent accounts.
• Metered usage. We record each Workspace’s use of metered features, such as monitored prompts and AI Client requests, to bill Customers and apply plan limits.
• Cookies and similar technologies. See Cookies and analytics.
• Content from third parties. Certain pages of the Services load content, such as fonts and website icons, directly from third parties, which receive your IP address and browser information as a result.

Information from AI Assistants and public sources

To measure how AI Assistants describe organizations and public issues, we send prompts, written by Suede or by Customers, to AI Assistants and record the answers they give, the sources those answers cite, and related search results.

AI answers often name individuals, such as public officials, executives, journalists, and advocates, and may describe their roles, actions, or views, including political opinions. When an answer cites a public social media post, we collect that post and its author’s public profile details, such as the author’s handle, profile link, and follower count. For cited news articles, we collect the author’s byline. We also analyze public web pages that Customers ask us to audit.

We process the personal information described in this subsection because we and our Customers have legitimate interests in understanding how AI Assistants describe organizations and public issues, and in improving the accuracy of those descriptions. We do not use this information to make decisions about individuals, such as decisions about employment, credit, or housing.

AI answers may be inaccurate, and they are generated and controlled by the operators of the AI Assistants, not by Suede. Our recording of an answer does not mean that we endorse it or have verified its accuracy. If you are named in an answer or a cited source and believe we hold personal information about you, you may ask us to access, correct, or delete it, or object to our processing it, by writing to privacy@suedewebsystems.ai.

Information from Connected Services

We use a Connected Service only to carry out actions that you request directly, through the agent, or through an AI Client you authorize.

• Tools for the agent. A Workspace administrator may connect tools to the agent, such as an MCP server. We access a connected tool only when the agent uses it during a conversation or a scheduled task. Information a connected tool returns becomes part of the conversation and is stored with the Workspace’s conversations as Customer Data.
• Social media accounts. Users may connect their own X, Facebook, or Instagram accounts. We request read-only access to posts, profile information, and page or account insights.
• Access tokens. We encrypt the access tokens for Connected Services before storing them.
• Removing access. When you disconnect a social media account, we ask the provider to revoke our access, and we delete the stored access tokens. A Workspace administrator may remove a connected tool, which deletes its stored access tokens. You may also revoke our access in the Connected Service’s own settings.

Suede’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Information about viewers of shared artifacts

A User may share an artifact through a link. Before you can open an artifact shared this way, we ask for your email address, and the User who shared it can see that you viewed it.

• We collect your email address, your name (if you provide it), when you first and last viewed the artifact, and how many times you viewed it. We also record your browser information and a one-way hash of your IP address; we do not store the IP address itself. We set a cookie that recognizes you as a returning viewer for 30 days, so that you need not re-enter your email address.
• The artifact’s owner and the User who created the link receive an email with your name and email address the first time you view the artifact. Users with permission to manage the artifact can see the list of viewers. If you comment, others viewing the artifact can see your name or email address with your comment.
• The Customer whose User shared the artifact controls the artifact and the link, and we process information about the artifact’s viewers on that Customer’s behalf. We also use that information to keep the Services secure. You may send requests about your information as a viewer to that Customer or to us.

Information about AI Client access

You may authorize a third-party AI application that supports MCP (an “AI Client”) to access a Workspace through our MCP server. Information an AI Client retrieves is governed by the AI Client provider’s terms and privacy policy, not this policy.

• Depending on the permissions you grant, an AI Client may read Customer Data and make changes on your behalf.
• For security and billing, we record details of each request, including the account, Workspace, and AI Client involved, the action requested, a truncated IP address, and browser information.
• You may revoke an AI Client’s access in your account settings. Access tokens already issued to the AI Client may remain valid until they expire.

How we use AI

AI Assistants are the subject of our monitoring, and we use third-party AI models to analyze information and to operate the agent.

• Monitoring. We send prompts to AI Assistants and record their answers and citations, as described in Information from AI Assistants and public sources.
• Analysis. We use AI models to analyze information we collect, for example to classify the websites that AI Assistants cite and to evaluate public web pages in audits.
• The agent. When you use the agent, we send your messages and attachments, the Customer Data the agent reads, and the results of the tools and web searches it runs to the AI model providers that power the agent, which may use cloud providers to host their models. Conversations are stored as Customer Data.
• Documentation chat. Questions you ask in the chat on our documentation site are sent to an AI model provider. We do not store those conversations.

How we use information

We use personal information to provide, secure, and improve the Services, including to:

• operate accounts and Workspaces, and provide monitoring, analysis, audits, and the agent;
• respond to demo requests and inquiries, and schedule meetings;
• authenticate Users, protect accounts, detect abuse and fraud, and investigate security incidents;
• bill Customers and apply plan limits;
• send service emails, such as sign-in codes, security notices, invitations, and notifications you set up;
• send product update emails, which you may unsubscribe from at any time;
• provide support you request;
• understand how the Services are used, and improve them; and
• comply with law, enforce our agreements, and protect the rights, property, and safety of Suede, our Users, and the public.

Authorized Suede personnel may access an account to provide requested support or to investigate a security incident.

De-identified and aggregated information. We may create de-identified or aggregated information from the personal information we process and use it for any lawful purpose, including to develop and improve our products and services. Where that information is derived from Customer Data, we create and use it only as the Customer Agreement permits. We maintain de-identified information in de-identified form and do not attempt to re-identify it.

Cookies and analytics

We use the cookies listed below. If you are in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, Google Analytics runs on our website only after you consent. Wherever you are located, you may turn off Google Analytics at any time.

• Google Analytics. We determine your location from the country of your IP address. In the EEA, the UK, or Switzerland, Google Analytics loads only after you choose Accept; elsewhere it loads by default, and you may choose Reject. We turn off Google Analytics’ advertising features, including Google signals and ad personalization. Google Analytics retains event data for up to 14 months.
• Changing your choice. You may use Cookie settings in our website footer at any time. If you reject Google Analytics after accepting it, we delete the Google Analytics cookies. Cookie settings
• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a choice to reject Google Analytics, unless you then choose Accept in Cookie settings.
• Do Not Track. Because there is no common standard for Do Not Track signals, we do not respond to them. We honor Global Privacy Control signals as described above.
• Other technologies. We use cookieless analytics to measure traffic and performance on the Services. When you sign in or create an account, our authentication provider uses a device identifier, as described in Information collected automatically. We use your browser’s storage to keep an unsent message in the documentation chat and, for the duration of your visit, to remember whether your region requires cookie consent.
• Stripe. Stripe’s checkout and billing pages set Stripe’s own cookies, under Stripe’s privacy policy.

How we share information

We disclose personal information to our service providers (“Service Providers”) to operate the Services, and otherwise only as described in this section. We do not sell personal information, and we do not share it for targeted or cross-context behavioral advertising.

• Service Providers. Companies that process personal information on our behalf under contract, including hosting and infrastructure providers, AI model providers, web data and search providers, payment processors, email delivery providers, analytics providers, logging and monitoring providers, account security providers, and business productivity providers. Our subprocessors page lists each Service Provider and records changes to that list.
• Customers. Customer Data, and information about viewers of shared artifacts, is available to the relevant Customer. Users of a Workspace can see one another’s names and email addresses.
• Connected Services and AI Clients. Connected Services and AI Clients that you authorize receive the information needed to carry out the actions you request.
• Legal requirements and safety. We disclose personal information when we believe in good faith that disclosure is required by law or is necessary to protect the rights, property, or safety of Suede, our Users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, we may transfer personal information to the acquiring or successor entity. This policy will continue to apply to the transferred information unless we notify you otherwise.
• With your consent. We disclose personal information with your consent or at your direction.

How long we keep information

We retain personal information only for as long as we need it for the purposes described in this policy, and then delete or de-identify it. Retention periods depend on whether you have an account, the requirements of the applicable Customer Agreement, our legal obligations, and our need to resolve disputes and keep the Services secure.

• Accounts. For as long as your account exists. When you delete your account, we delete or de-identify the personal information associated with it, except information we need to retain to comply with law, resolve disputes, enforce our agreements, or keep the Services secure. Content in a Workspace is Customer Data and is retained as the Customer Agreement provides.
• Invitations. Invitation links expire after 7 days.
• Metered usage records. For the period set by the Customer’s plan.
• Information about viewers of shared artifacts. For as long as the link exists. We delete or de-identify it when the link, the artifact, or the Workspace is deleted.
• Billing records. For as long as tax and accounting laws require.
• Demo requests and correspondence. For as long as needed to respond and to maintain our business relationship with you.
• AI answers and the public information they cite. For as long as we use them to provide historical analysis to Customers.
• Logs and backups. We retain server and application logs for a limited period for security and troubleshooting. Deleted information may persist in backups until those backups are overwritten in the ordinary course.
• Analytics and cookies. Google Analytics retains event data for up to 14 months. Cookie durations are listed in Cookies and analytics.

Security

We use technical and organizational measures designed to protect personal information, but no system is completely secure.

• We encrypt information in transit between your browser and the Services.
• Our database provider encrypts data at rest, and we additionally encrypt the access tokens for Connected Services.
• We store passwords only as hashes, and we offer two-factor authentication, passkeys, and single sign-on.
• We store only a hash of a shared-artifact viewer’s IP address, and only a truncated IP address in AI Client request logs.
• Role-based permissions control which Users can view and change a Workspace’s Customer Data.

If you believe there has been a security incident affecting Suede or your personal information, contact support@suedewebsystems.ai.

If a security incident affects your personal information, we will notify you and the relevant authorities where and as required by applicable law.

Your rights and choices

You may access, correct, export, or delete your personal information, and you may opt out of product update emails and analytics.

• In the App. In your account settings, you may update your profile, review your active sessions, revoke an AI Client’s access, disconnect social media accounts, and delete your account.
• By request. To access, correct, export, or delete your personal information, or to object to how we use it, write to privacy@suedewebsystems.ai. We will ask you to confirm your identity, usually by replying from the email address we have on file, and we will respond within the time required by applicable law.
• Emails. You may unsubscribe from product update emails using the link in any such email. We will continue to send service emails, such as sign-in codes and security notices, while you have an account.
• Analytics. You may use Cookie settings or a Global Privacy Control signal, as described in Cookies and analytics.
• Customer Data. Direct requests about Customer Data to the Customer whose Workspace holds it. We will assist the Customer in responding.

We will not discriminate against you for exercising any of these rights.

US state privacy rights

Depending on the state where you live, you may have additional rights regarding your personal information under that state’s privacy law. These rights may include:

• the right to know what personal information we collect, use, and disclose, and to access it;
• the right to correct inaccurate personal information;
• the right to delete personal information;
• the right to receive personal information in a portable format;
• the right to opt out of the sale of personal information, its sharing for cross-context behavioral advertising, targeted advertising, and profiling that produces legal or similarly significant effects; and
• the right to limit the use of sensitive personal information.

Our practices. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. We use account sign-in credentials only to provide and secure the Services, and we do not use sensitive personal information to infer characteristics about anyone. We honor Global Privacy Control signals as described in Cookies and analytics.

Categories of personal information. In the 12 months before the “Last updated” date above, we collected the following categories of personal information, as the California Consumer Privacy Act defines them. We collected them from the sources described in Information we collect, used them for the purposes described in How we use information, and disclosed them for business purposes to the recipients described in How we share information.

• Identifiers, such as name, email address, IP address, account identifiers, and online identifiers.
• Commercial information, such as subscription and billing records.
• Internet or network activity, such as usage, log, and analytics information.
• Approximate location, inferred from IP address.
• Professional information, such as organization and role, including public professional information that appears in AI answers and cited sources.
• Audio or visual information, such as profile photos.
• Sensitive personal information, limited to account sign-in credentials. AI answers and public sources may also mention sensitive characteristics of the individuals they name, such as religious beliefs; we do not seek to collect this information.

Making a request. To exercise a right available to you, email privacy@suedewebsystems.ai. We will verify your request by matching information you provide with information we hold. You may use an authorized agent, who must provide written permission signed by you; we may also require you to verify your identity directly with us. We will respond within 45 days. If we need more time, we will tell you why and may extend the period by up to 45 additional days.

Appeals. If we decline your request, you may appeal by replying to our decision or by writing to us with “Appeal” in the subject line. We will respond to your appeal within the time required by applicable law. If you disagree with the outcome, you may contact your state’s attorney general.

California “Shine the Light.” We do not share personal information with third parties for their own direct marketing.

Nevada. We do not sell covered information, as Nevada law defines “sale” and “covered information.” Nevada residents may nonetheless submit a request to privacy@suedewebsystems.ai with “Nevada request” in the subject line.

EEA, UK, and Switzerland

If you are in the EEA, the UK, or Switzerland, Suede Web Systems, Inc. is the controller of the personal information this policy describes, except Customer Data, for which the relevant Customer is the controller. You have rights under the EU General Data Protection Regulation (the “GDPR”), the UK GDPR, and the Swiss Federal Act on Data Protection.

Legal bases. We rely on:

• contract, to provide the Services and bill for them;
• legitimate interests, to respond to demo requests, secure the Services, measure use of our website without cookies, send product update emails, improve the Services, and collect and analyze AI answers and the public information they cite;
• consent, for Google Analytics; and
• legal obligation, for tax records and lawful requests.

Where we rely on legitimate interests, we weigh those interests against your rights, and you may object. You may withdraw your consent to Google Analytics at any time in Cookie settings.

Your rights. You may ask to access, correct, or delete your personal information, to restrict our processing of it, to receive a portable copy of it, and to object to our processing it. We will respond within one month, which we may extend by two months for complex requests. You may also lodge a complaint with the supervisory authority in the EEA country where you live or work, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable.

Personal information not obtained from you. The sources and categories of personal information we collect from AI Assistants and public sources are described in Information from AI Assistants and public sources. On request, we will tell you what personal information we hold about you.

International transfers. Suede is based in the United States, and we and our Service Providers process personal information in the United States and other countries. Where applicable law requires a transfer mechanism, we rely on a recognized mechanism, such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents.

Automated decisions. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

Children

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will delete it. If you believe a child under 16 has provided us with personal information, contact privacy@suedewebsystems.ai.

Changes to this policy

We may update this policy from time to time. We will post each updated version on this page with a new “Last updated” date. If we make a material change, we will email Users and post a notice on our website before the change takes effect. Changes apply prospectively. We handle personal information under the version of this policy in effect when we collected it, unless you consent to a new use.

Contact us

For questions about this policy or to make a request, email privacy@suedewebsystems.ai, or write to us:

Suede Web Systems, Inc. is a Delaware corporation.