Legal & privacy posture.
Every document your legal, IT and compliance teams need, public before you sign up. The MSA and DPA bind when you accept them at checkout, the same paper for every brand, and the counter-signed PDFs are made for you automatically.
Architectural commitment formalized in the DPA: no biometric processing occurs in the SweetNote pipeline, so the service ships to recipients in all 50 U.S. states, including Illinois. See DPA §14.1 for the formal BIPA exclusion attestation.
Core B2B documents
The documents most B2B procurement reviews need first, written specifically for the SweetNote B2B service. Reviewable here before signup; binding at checkout when you accept and pay. Counter-signed PDFs generated automatically for your audit file.
-
Data Processing Agreement (DPA)
CCPA / CPRA, BIPA (zero-biometrics architecture, §14.1 attestation), and aligned with the comprehensive US state privacy laws (VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, TIPA, MTCDPA, DPDPA, Iowa CDPA, NH DPA, NJ DPA, MN CDPA, MD ODPA, RI DTPPA, KY CDPA, IN CDPA, NDPA, FDBR). See the DPA §1 for the full enumeration. Reviewable here before signup; binding at checkout when you accept and pay. Counter-signed PDF generated automatically. International expansion on the post-launch roadmap.
-
DPA · Outcome Attribution Schedule
Attaches only when Customer enables Outcome Attribution on a study. Governs the inbound conversion-event data flow: ingestion at
POST /v1/conversions, the platform-locked 30-day primary + 31–90-day extended observation window, increment-only per-cell aggregation (no per-recipient amount persisted), 120-day Token Map retention horizon, Customer-payment-processor-as-Customer-subprocessor model. Accepted by clickwrap at checkout for studies of any size (counter-signature available on request); SweetNote recommends an optional methodology review for larger Outcome studies. Executes before the first conversion-enabled QR is generated. -
DPA · Recipient-Level Export Schedule
Attaches only when Customer opts in to the recipient-level export on a study. Governs the return of Customer’s own engagement data to Customer in a pseudonymous, token-keyed, one-row-per-recipient file (no names, addresses, emails, IPs, or raw timestamps; timing and watch-depth ship as coarsened buckets). It does not change SweetNote’s aggregate-only output everywhere else. The export capability activates only for studies where Customer has executed this Schedule. Where Customer also turns on CRM sync for a study, the Schedule covers writing a short closed list of study facts onto the records Customer identifies in its own CRM.
-
Study Order Form (SOW)
Auto-generated per study at commercial commitment. Captures the study's recipient count, methodology, price breakdown, payment path, activation date, engagement window, and incorporated-document version hashes (MSA, DPA, and any executed DPA Schedule: Outcome Attribution or Recipient-Level Export). Clickwrap-accepted by Customer at checkout for studies of any size, with SweetNote's counter-signature applied automatically (a traditional dual counter-signature is available on request). Lands in Customer's portal at Settings → Contracts, with an email linking to it, typically within minutes of commercial commitment. Same paper for every brand, not redlined.
-
Privacy notice
What we process on behalf of brand customers and what we don't (no biometrics, no enrichment, no cross-tenant exposure), retention windows, and the data-subject rights we support. Plain-language; suitable to share with your privacy team.
-
Subprocessor list
Every third-party processor SweetNote routes data through (Supabase, Netlify, Mux, Postmark, Stripe, Sentry, Better Uptime), what role each plays, where each is located. Reviewed quarterly; 30-day notice on any change.
-
Master Services Agreement (MSA)
The B2B agreement covering services, fees, term, IP, warranties, indemnification, the Acceptable Use Policy, and termination. Per-study SOWs attach to this MSA. Same paper for every brand, the reasoning behind the no-redlines model is documented at Contract philosophy.
-
Contract philosophy
A narrative companion to the MSA + DPA explaining the same-paper-for-every-brand model: the fairness reasoning, what your team's procurement work looks like, what we accept and what we don't, and the honest "this isn't a fit" exit. Designed to forward to legal alongside the contracts.
-
Procurement bundle
A single consolidated procurement-handoff artifact: pricing, contract philosophy, privacy + security posture, DPA + MSA highlights, subprocessor list, refund terms, and stakeholder routing, designed to be saved as PDF and circulated internally for legal, IT, procurement, and finance review in parallel.
Secondary documents
Secondary legal documents for the SweetNote platform.
-
Terms of Service
Rules for browsing the marketing site, using the public Study Calculator, viewing the demo reveal URLs, submitting information through public contact forms, and holding a portal account until an MSA is in force (accepted at sign-up and recorded per version). Paid services are governed by the MSA instead; once an MSA is in force it controls over these Terms for any conflict. Covers eligibility (13+), acceptable use (no scraping, no reverse-engineering), SweetNote intellectual property, calculator-output disclaimer, governing law (Delaware), and limitation of liability for unauthenticated use.
-
Acceptable Use Policy
Platform-wide rules binding every person interacting with SweetNote — Visitors, brand-customer Operators, recipients, third-party integrators, and security researchers. Covers prohibited content, prohibited conduct (automation / scraping, security probing, engagement-instrument misuse, credential misuse, recipient-list misuse, IP respect), the responsible-disclosure safe harbor for security researchers, Customer responsibility for downstream Users, enforcement procedure (notice-and-cure with immediate-suspension carveouts), and reporting channels. Incorporated by reference into MSA §3.1 and ToU §4.
-
Cookie policy
Cookies SweetNote sets across three surfaces: marketing site (no cookies of its own and no third-party analytics scripts at launch; one strictly-necessary cookie during the invite-only preview), brand-facing dashboard (Supabase Auth sign-in storage, a session ticket, and UI preferences), and recipient-facing reveal page (one consent cookie, set only when the recipient makes a choice on the consent ribbon or taps a reaction or the call-to-action; nothing else is stored on the device). No advertising or tracking pixels anywhere.
-
Do-not-sell & CCPA rights
SweetNote does not sell or share Personal Data for cross-context behavioral advertising. The formal CCPA / CPRA disclosure plus parallel state-law rights (VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, TIPA, MTCDPA, DPDPA, Iowa CDPA, NH DPA, NJ DPA, MN CDPA, MD ODPA, RI DTPPA, KY CDPA, IN CDPA, NDPA, FDBR) and how to exercise them.
-
Accessibility statement
WCAG 2.1 Level AA conformance target for the recipient-facing reveal page and the brand-facing dashboard. Known issues + remediation timeline disclosed openly. Reporting procedure included.
-
DMCA & copyright policy
DMCA notice and counter-notice procedure for Customer-supplied video content. The AUP in the MSA places primary content responsibility on Customer; this policy documents the statutory takedown workflow.
-
Refund & credit policy
Plain-language summary of refund and credit terms for B2B partners. Pre-activation refund window, activation-date-gated resolution, termination-for-cause, and usage-dispute procedure with 30-day window. Substantive terms governed by the MSA (principally Sections 4, 5, and 9 and Exhibit A).
-
Trademark policy
How the SweetNote marks (SweetNote, BBMR™, the methodology names, the logomark and lockup) may be used: acceptable nominative, customer, founding-partner, and academic use without prior permission; prohibited uses; and the permission process.
-
Brand-asset guidelines
Logo, color, and naming usage for press, partners, and academic citation, with the license-by-conduct terms and a clear list of what is not permitted.
-
SOC 2 Type 1 / Type 2
SOC 2 Type 1 is on the post-launch roadmap once the audit-evidence window from early customer studies builds; Type 2 follows within 12 months of Type 1 completion. The DPA documents the controls SOC 2 codifies; full security posture is at /security.
Request status → In progress -
Penetration test report
Annual third-party penetration testing is active after the first paid customer studies launch; reports are shareable under NDA on completion. If your security team needs penetration-test evidence ahead of contract finalization, request status here and we’ll confirm the schedule in writing.
Request status → Post-launch
Need something not listed here? Email lauren@thesweetnote.com with the document name and your legal entity. We respond within one business day with the file or a schedule for when it ships.
Read the data processing agreement →