Privacy Policy

This Privacy Policy describes how Sentinel Labs ("we", "us", "our") collects, uses, and discloses information when you use the Prospect Sentinel platform ("Service"). It applies to information about you as an account holder and information you provide about your business contacts.

1. Information we collect

Account information. Email address, name, and workspace name you provide at signup. Authentication tokens and session metadata necessary to maintain your login.

Workspace data. Prospect records (company name, contacts, phone, email, addresses), activity history, notes, attached files, and any other data you upload or generate within the Service.

Usage data. Pages visited, features used, AI calls made, errors encountered. We log this to operate, debug, and improve the Service.

Billing information. Core and Pro purchases are currently assisted. Payment processing and the information it requires must be confirmed before purchase. Do not enter payment-card details in product fields or support messages.

Technical data. IP address, browser type, device type, and operating system, logged for security and debugging purposes.

2. How we use information

• To provide, maintain, and improve the Service.
• To authenticate you and protect your account.
• To arrange billing and provide the access agreed with you.
• To send service communications when the relevant delivery service is configured and verified.
• To respond to support requests and communicate with you about the Service.
• To detect, prevent, and address technical issues, fraud, and security incidents.
• To comply with legal obligations.

We do not sell personal information or share it with third parties for their marketing purposes.

3. AI processing and third-party sub-processors

The Service uses third-party providers ("sub-processors") to deliver functionality. Information you upload may be processed by these providers as needed to operate the Service:

• Supabase — database, authentication, and file storage. Hosted infrastructure.
• Vercel — application hosting and edge compute.
• xAI — AI model processing for features such as briefs, drafts, and summaries. Relevant prompts and workspace context are sent to xAI when you use these features. See its API data-handling policy. A zero-data-retention arrangement has not been verified for this service.

Stripe, Resend, and Sentry integrations exist in the application, but payment processing, application transactional email, and external error tracking are not enabled in the verified launch setup. Supabase authentication email is separate and its delivery still needs verification. Confirm additional providers before activating a service that sends them your information.

See our draft Data Processing Agreement for the provider list and unresolved contractual terms.

4. Data retention

• Active workspace data is retained for the life of the subscription.
• Post-cancellation access and deletion periods remain to be confirmed in the final agreement. Automatic workspace deletion is not currently implemented; removing a prospect preserves history and is not complete erasure.
• Scheduled database backup snapshots are present. Their retention and a tested restoration process must be confirmed. Database backups do not contain uploaded storage objects.
• Audit-log retention remains to be confirmed for the relevant records. A universal 90-day retention period is not established.
• Aggregated, anonymized usage metrics may be retained indefinitely for analytics.

5. Your rights

Depending on your jurisdiction (GDPR, CCPA, etc.), you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your personal information ("right to be forgotten").
• Export your data in a portable format.
• Object to certain processing activities.
• Withdraw consent at any time.

To exercise these rights, contact us at keating.andrewj@gmail.com.

6. Security

The application uses HTTPS, workspace-scoped authorization, database access policies, and role-based controls. See the current security overview for verified controls and open readiness limits. No system is perfectly secure; we cannot guarantee absolute security.

7. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us to delete.

8. International data transfers

Our infrastructure may store and process data in multiple regions. The production database is in US East (Ohio); this does not establish a residency guarantee for every provider or AI processing. Applicable transfer safeguards and contractual terms must be confirmed before relying on this draft for an international transfer.

9. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least [30 days] before the changes take effect.

10. Contact

Privacy questions? Contact us at keating.andrewj@gmail.com. For mailing address: [Company Legal Address].