Hard questions. Answered in writing.

Will we see individual recipient behavior?

Not in our own surfaces. SweetNote’s dashboard, deliverable reports, and the cross-tenant benchmark show aggregates only (Reach, Engagement, and Affirmation), with sample-size minimums enforced uniformly on every surface that displays results. The per-recipient drill-down doesn’t exist as a feature in our output. Your own engagement data, keyed by pseudonymous token and never by name, is available to you on request under the DPA export schedule; that is your data coming back to you, not a SweetNote surface. Integrations you opt into (signed webhook destinations, activating at launch; CRM connectors on the roadmap) are a separate layer: per-recipient activity is documented to flow to those tools keyed by a pseudonymous code you join to your own records on your side, matching the industry norm (Qualtrics, Forsta, Sprig, Medallia all forward per-respondent data to customer-controlled tools).

Do you reuse our data, or train AI on it?

No model training on your recipient data, and we never combine one brand’s data with another’s. The only secondary use is the cross-tenant benchmark and our published research, both drawn from de-identified, aggregated data at strict sample floors (for the portal benchmark, your comparator — the network excluding you — must hold 10 other contributing brands, at n ≥ 25 recipients per cell; k ≥ 15 and n ≥ 50 for any academic publication), with the cell-merge and rounding-or-noise controls set out in DPA Section 4. No benchmark, paper, or dataset ever identifies your brand or any recipient, and you get 30 days’ notice plus a per-publication exclusion right (terms: MSA § 6.3 · DPA § 4). The no-model-training commitment is contractual: DPA § 4 states it outright, and the MSA § 6.3 aggregate license expressly does not extend to ML or AI training.

How long do you keep recipient data, and what happens when we leave?

Per-recipient Personal Data (the names and addresses that link an engagement event to a specific person) is automatically deleted 30 days after the engagement window closes, severing the link between any event and an individual. From that point, engagement events persist only in de-identified form. Aggregate engagement events without recipient identifiers are retained 24 months rolling for year-over-year program comparison and the cross-tenant benchmark dataset. Live dashboard filtering and re-cuts are available for those 24 months after the window closes; your settled study report stays available while your workspace is open, with no fixed end date, and anything you export is yours to keep. Customer may negotiate an even shorter retention window in the MSA, same option, same wording, for any customer who elects it. On termination, we return or securely delete your Personal Data at your option (default: secure delete if you don’t elect within 30 days), independent of any unpaid invoice. Full detail: /security · DPA § 13.

A recipient asks us to delete their data, what happens?

You stay in control as the data controller. When you route a data-subject request (access, deletion, correction) to us, our standard SLA is 10 business days to provide the technical means, and the deletion propagates to every subprocessor that received the data. If a recipient contacts SweetNote directly, we forward the request to you within 5 business days and don’t respond substantively unless you authorize it. Contract: DPA § 10.

Who is the data controller, and who owns the data?

You are the data controller (a Business under CCPA / CPRA); SweetNote is the processor (a Service Provider). We process recipient data only on your documented instructions, never sell or share it, and never use it for our own commercial purposes beyond the de-identified aggregate benchmark above. Your data stays yours, throughout the engagement and on the way out. Contract: DPA §§ 2–3 · MSA § 6.

What about Illinois and BIPA?

No biometric data captured anywhere in the pipeline, no facial-emotion inference, no voice-tone analysis, no eye-tracking. Sentiment is a deliberate three-tap choice the recipient makes, or doesn’t — never inferred. The platform operates in all 50 US states (you ship your own gifts via your existing fulfillment; we provide the QR code, the reveal page, and the dashboard): it's built to support compliance with US state consumer-privacy law: CCPA/CPRA in California, BIPAIllinois Biometric Information Privacy Act, the toughest US biometric-data law. Because we capture zero biometric data, there is no biometric data to regulate. in Illinois (the zero-biometrics architecture means there's no biometric data to regulate), and every comprehensive US state consumer-privacy law now in force. The full list of named state laws lives in our Privacy Policy; the formal BIPA exclusion attestation is in Section 14 of the DPAData Processing Agreement, the standard contract addendum that names what data we touch, how we process it, retention rules, and your rights as the data controller. Required for most procurement reviews.. International expansion (UK, EU, Canada) is on the post-launch roadmap alongside SOC 2 Type 1 attestation. This describes how the platform is built; it isn’t legal advice. Confirm fit with your own counsel.

Are you SOC 2 certified, and how do you handle a breach?

SOC 2System and Organization Controls 2, the AICPA audit standard for security, availability, and privacy controls. Type 1 = controls designed correctly. Type 2 = controls operating correctly over time (typically a 6-12 month observation period). We do not hold a SOC 2 report yet, and no third-party penetration test has been run, so neither can be shared today. What your review can have now: a completed security questionnaire (SIG Lite, SIG Core, CAIQ, or your own) within five business days, requested here; the controls SOC 2 codifies (access, change management, encryption, incident response, vendor governance), documented in the DPA, which you can read before you sign; and the published subprocessor list. More on the security page. On a security incident affecting your data, we notify you within 72 hours of becoming aware, in line with applicable breach-notification law (DPA § 11). If your review has a hard SOC 2 or penetration-test prerequisite, tell us before you commit and we will answer in writing whether we can meet it.

Will you take an exclusive partnership in our category?

No. The SweetNote QR drops onto whatever you already send, through whatever tools fulfill it: Goody, Sendoso, Bonusly, Classy, your own print shop. Independence is what makes cross-platform benchmarks credible. We offer published per-study pricing and email support throughout, not category exclusivity, not a discount-for-loyalty deal, not anything that compromises measurement neutrality.

Do you compete with our gifting catalog or fulfillment?

No. We don't sell gifts, carry inventory, or operate fulfillment. Your customer relationships and unit economics stay yours. We're the platform for physical-digital brand moments, running on top of whatever you already ship: an owned channel for your customers, research-grade signal for you. Your customers see your brand throughout, not ours.

What does this actually cost?

SweetNote sells research studies, not subscriptions. One published per-study formula: base + graduated per-recipient charge + methodology premium + Outcome Attribution add-on (optional, included at no charge) (the per-recipient charge follows published graduated rate bands: each band's rate applies only to the recipients within that band, like tax brackets; the premium reflects the research evidence the methodology delivers, $0 Snapshot, $1,500 Cohort, $3,000 A/B (base + $1,000 per variation above 2 · 2–5 variations), $3,000 Gift A/B (base + $1,000 per SKU above 2 · 2–5 SKUs), $4,000 Gift Lift). Same number for every brand at the same study size, no negotiation. QR codes generate at commercial commitment so you have print-and-ship lead time; reveal pages render only on your specified activation date. Your study templates, brand setup, and past results stay in your profile so every study after the first is a CSV upload + a click. See the calculator →

How do we pay, and when?

Two paths, same published price on each: credit card (pay now), or invoice, Net-30 — payable by card or bank, available on any study size and built for AP-gated buyers (nonprofits, healthcare, finance). Paying by bank? Use the invoice path. You’re charged at commercial commitment, and your deliverable artifacts (QR ZIP, variable-data CSV) unlock immediately so you have print-and-ship lead time; reveal pages render only on the activation date you set. See how you pay →

Can we get a refund if we cancel?

Before a study activates: your fee back less a flat 3% processing fee, any time, on request, even if QR codes are generated and you’ve already downloaded the variable-data CSV (they don’t resolve before activation, and we retire them on refund). There’s no 3% when the cancellation is on us: our breach, an IP claim, a change of control, force majeure, the uptime-termination right, a methodology review we don't return on time, or your objection to a new subprocessor. A study becomes non-refundable only once reveals begin resolving to recipients on your activation date. If we materially breach and don’t cure within 30 days, you get a full refund for pre-activation studies plus a pro-rated refund for the unused portion of an active one. Plain-English terms: Refund & credit policy.

Can SweetNote tell me how much revenue a campaign drove?

Yes, with the opt-in outcome layer. We don’t track recipients across your site. Your own systems relay the conversion event (the one your payment processor reported to you), we attribute it to the reveal cohort, surface the aggregate, and discard the per-recipient amount.

On a randomized study (A/B, Gift A/B, Gift Lift) that becomes a causal dollar lift, the strongest evidence available for a budget argument. For Snapshot or Cohort, it’s an associative floor (“at least $X”). The result serves your study alone; conversion data is never pooled into the cross-tenant benchmark (Outcome Schedule § 3), and it is not ad-tech conversion tracking.

That lift is the incremental result: the conversions your send actually caused, measured against a randomized group that didn’t receive it. It reads lower than a last-click or platform-attribution number, because those also count the recipients who would have converted anyway. The incremental figure is the one that holds up when a CFO asks how you know.

What's a Gift Lift, and why is it priced higher?

Gift Lift is the only study design that isolates the gift itself from the rest of the brand moment. Every recipient gets the same QR card, shown the same way (the first thing they see on opening), leading to the same reveal page, from the same sender, in the same send window. SweetNote randomizes 50/50: assignment is fixed deterministically at mint, so the split is exact rather than approximate, and a reviewer can recompute it from the stored tokens. Name a cohort_ column to balance within (tier, region, whatever you uploaded) and assignment balances independently inside each group, so each segment lands 50/50 too. Half of the recipients also receive the gift. The only thing that changes is the gift, including the packaging a real gift comes in: a card alone travels in an envelope, a gift travels in a box, and that box is part of what “receiving a gift” means. So the lift between the two groups is the causal effect of sending a gift, not the card, the reveal, or the brand voice. The same design tests any other single difference in the physical mailing (two designs, two formats, an insert or none): randomized 50/50 and read on Reach over everyone sent.

The $4,000 premium reflects the research it delivers, a causal incrementality verdict on whether the gift itself drives value. A custom market-research firm often prices a standalone causal study of this kind at $30k to $50k (illustrative; vendor quotes vary); a whole Gift Lift on 1,950 recipients is $10,124 at published prices. Server-side randomization (you can't reassign), the methodology attestation locked at scoping (identical execution across groups), the cryptographic audit trail your procurement team keeps on file, and the post-send screenshot review all underwrite that claim. It's the strongest causal evidence anything we publish produces, and it's priced against that value. Minimum n is 200 (100 per group); capability tiers up to causal-robust at n ≥ 2,000 total (1,000 per group) are disclosed live in the calculator.

Half my list gets no gift. What do they get?

The card, the video, the reveal, and the same next step: everything but the gift. Nobody receives nothing. The card-only group is the send you already make today; the gift group is that send plus the gift, and that is exactly what lets the study attribute the difference to the gift and nothing else. You choose the sample. Once the study reads, the rest of your list can get whichever version earned it.

How long does it take to go live?

Two to four weeks from signup to first study, depending on fulfillment timeline and CRM integration scope. The whole flow is self-serve via the portal, free signup, brand setup, draft campaigns, dashboard preview, with email support throughout for any non-standard situations. Payment is collected at commercial commitment (checkout or invoice countersignature), not signup — reveal pages then activate separately on the date you set. You print and ship the QR-bearing physical; we generate codes via API and host the digital reveal.

When do reveals go live, and how long do they stay up?

Reveals stay dark until your chosen activation date, which you set in the campaign builder. Your print-and-ship deliverables (the QR ZIP and the variable-data CSV) unlock the moment you commit commercially, so you have lead time to produce and mail before anything goes live, but a recipient who scans early sees a friendly “not ready yet” page, never the video.

Once activated, each study runs for a fixed 30-day engagement window. That window is when recipients can watch, react, and click, and when the dashboard collects signals. The same 30 days applies to every study so results stay comparable across the cross-tenant benchmark. When the window closes, reporting locks: your readout and dashboard settle on the 30-day window. A pseudonymous, token-keyed observation tail is retained through day 90 post-activation per DPA § 13 and is never surfaced per-recipient. The reveal page keeps working for recipients, and per-recipient identifying data is automatically purged 30 days after the window closes (see Retention, above). Your own video creative is kept separately and stays reusable for future sends.

How do you slice cohorts if you don't know who recipients are?

You bring the audience knowledge via CSV upload, exported from any CRM or donor system. Tag columns become cohortA labeled group of recipients (e.g. "VIP donor", "West region", "Q4 hires"). Tags arrive with your recipient list as a CSV column; the dashboard cuts engagement signals across them. dimensions: department, customer tier, donor segment, region, tenure. We never infer demographics or buy enrichment data.

Can the data flow into our CRM or warehouse?

Yes, and the data stays yours. Every study’s results export as a multi-tab Excel workbook (.xlsx) today, the KPI summary plus per-variation and per-cohort aggregates, loading straight into Excel, Looker Studio, Tableau, Snowflake, or BigQuery. Clean per-recipient events (keyed by a pseudonymous code you join on your side) are documented to flow to a webhook destination, so your privacy review can run ahead of delivery. Direct CRM connectors and managed warehouse sync are on the integrations roadmap. The join keys are clean and the schema is documented; we don’t own attribution.

The data flow is bi-directional if you enable the optional outcome layer. Your own systems can send conversion events back to SweetNote on the Webhook path or the Click-token path (your server reads the code you kept on the payment and sends it), or you can upload a file on the Identity-Match CSV path. SweetNote then attributes the downstream result to the reveal cohort and surfaces an Outcome KPI. It is aggregate-only: per-recipient amounts are discarded on ingestion. Wire nothing and only the outbound webhook applies, once outbound delivery activates at launch.

Where is our data stored?

In the United States, US-East regions, on Supabase (database) and Netlify (hosting). The contractual posture at launch is US-only: non-US recipient data should not be submitted under the current scope, and EU / UK / Canada residency is on the post-launch roadmap. Detail: /security · DPA § 9.

What's your uptime commitment?

A 99.0% Monthly Uptime Service Commitment in the MSA, measured against the reveal pages and dashboard while you have an active study. Miss it and you earn service credits (starting at 10% of monthly active-study fees); sustained underperformance gives you a termination-for-cause right. A public status page at status.thesweetnote.com targets incident posts within 15 minutes. Terms: MSA Exhibit A.

Is the recipient reveal page accessible?

Our conformance target is WCAG 2.1 Level AA for both the recipient reveal page and the brand dashboard; because Section 508 incorporates WCAG 2.0 Level AA by reference, and 2.1 AA is a superset of it, the same target informs federal-procurement evaluations. Honest framing: it’s the standard we build and design against, not a claim that every surface passes every criterion today, and no third-party audit or VPAT is published yet (both are on the roadmap). Video captions are auto-generated from your video at upload, and recipients can turn them on with the CC toggle on the reveal. Full statement: Accessibility.

Do you handle RSVP for invitation studies?

No, we don't manage RSVP responses. Any event that needs RSVP already runs on a dedicated tool (Cvent, Eventbrite, and the like), and we're more useful as the measurement layer alongside those than as a worse replacement for them. For invitation sends, write the event details (date, venue, time) into the digital reveal's message and set the single required next-step CTA to your existing RSVP URL. The click is captured as a behavioral signal, that's the revealed-preference RSVP intent we measure, while the response logic lives where it should: on your partner system.

What is the outcome layer, and do I have to use it?

It’s optional and additive. Today a study’s data ends at the CTA click. The outcome layer lets you report what happened after the click (a donation, a purchase or a registration) back to SweetNote. There are three paths: your systems send it on the Webhook path or the Click-token path, or you upload a file on the Identity-Match CSV path. SweetNote attributes the conversion to the reveal cohort, surfaces an Outcome KPI and discards the per-recipient amount. Only the aggregate (n ≥ 25 floor) is kept.

Wire nothing and your study is unchanged. Outcome attribution is opt-in; the behavioral signals and cohort intelligence come with every study regardless, and category benchmarks join them once your comparator — the network excluding you — reaches 10 other contributing brands in your cell.

What are we committing to, and for how long?

One study at a time. No subscription, no auto-renewal, no minimum commitment. Each Order Form (the SOW your study generates) attaches to the MSA and runs for the term of that one study: the 30-day engagement window plus a 24-month dashboard-access tail. The MSA itself stays in force only while you hold an active or pending study, and either side can end it for uncured material breach on 30 days’ notice. Terms: MSA § 1.1 · MSA § 5.

How long do we keep access to the results?

24 months from the day your engagement window closes. That is the same 24 months as the aggregate-retention schedule, deliberately: your live dashboard (filtering and re-cuts) is available for those 24 months. Your settled study report stays available while your workspace is open, with no fixed end date. Export at any time, and anything you have exported or downloaded is yours to keep with no time limit. The settled readout and deck are frozen at window close, so what you got on day 30 is what you keep. Terms: MSA § 1.1 · DPA § 13.

What does signing actually trigger?

Commercial commitment starts the clock: a card payment, or your countersignature on the invoice path. At that moment your print deliverables (the QR ZIP and the variable-data CSV) unlock, so you have lead time to produce and mail. Reveal pages stay dark until the activation date you chose, and until the study is paid. A card payment counts right away; on the invoice path the reveals wait for the invoice to be paid. Two payment paths, same published price on each: credit card now, or invoice on Net-30 terms, payable by card or bank. See how you pay →

What if we change our mind before it activates?

Your fee back less a flat 3% processing fee, any time before activation, on request. That holds even after the codes are generated and you have downloaded the CSV, because they do not resolve before activation and we retire them. There is no 3% when the exit is not you changing your mind: our breach, an IP claim, a change of control, force majeure, the uptime-termination right, a methodology review we return late, or your objection to a new subprocessor. Once reveals begin resolving on your activation date, the study is non-refundable. Refund & credit policy.

What if a card is lost, or the print run goes wrong?

You pay for exactly the recipients you scope, and that is exactly how many codes we mint. There is no buffer charge and no per-code fee stacked on top. If a card is lost or damaged in the mail, reprint that recipient’s own card from the campaign page: it reuses the same code, so nothing is minted twice and none of your numbers move. Every pack also ships with a test card you can scan yourself before mailing, which is not a recipient code and is counted in nothing. The rule underneath all of it: only a code assigned to a recipient ever enters a rate or a denominator.

What happens to recipient data on the way out?

Names and any addresses you chose to supply are deleted 30 days after the window closes, which severs the link between any engagement event and a person. Live aggregates carrying no recipient identifiers are kept 24 months; your settled study report stays available while your workspace is open, with no fixed end date. On termination we return or securely delete your Personal Data at your option (default: secure delete if you do not elect within 30 days), independent of any unpaid invoice. You can negotiate a shorter window in the MSA; the option and the wording are the same for everyone. DPA § 13.

We are a public institution. Can we sign this at all?

Yes, and without a redline. MSA Exhibit B (Public Entity Terms) applies automatically where you are a state agency, a public university, school or hospital district, a municipality, a federal agency, or a tribal government. Every Customer indemnity is capped and applies only as law and appropriation permit; you indemnify but do not defend; your own state’s law governs and venue is non-exclusive in your own courts; sovereign immunity and your public-records duties are preserved; and the 3% cancellation fee is waived on a failure or withdrawal of appropriation. Warranties, DPA, SLA, retention and price are unchanged. It is published and uniform rather than negotiated, and only public institutions qualify for it.

Where do the MSA, DPA, and SOW live?

All published, all linkable, all readable before you speak to anyone: the MSA, the DPA, the SOW template your study generates from, and the procurement bundle that summarizes the whole set for an intake form. Every legal page carries a pre-rendered PDF for offline review and circulation. No NDA required to read the terms, no redlines, and a contractual same-paper covenant that you get the terms every other brand at your study size gets (MSA § 13.18).