Legal · Privacy notice

SweetNote B2B privacy notice.

Effective 2026-10-13

What this is. The privacy notice for the SweetNote platform, what we process on behalf of brand customers, what we don't, how recipient data flows, retention windows, and the data-subject rights we support.

1. Roles and scope

Under this notice, The Sweet Note, Inc. ("SweetNote") is a data processor (or "Service Provider" under CCPA / CPRA terminology): we process Personal Data on the documented instructions of brand customers ("Customers"), the brands, nonprofits, employers, and membership organizations that engage SweetNote to deliver video-gift campaigns to their recipients.

The Customer is the data controller. The Customer determines which recipients receive a campaign, supplies the recipient data, configures the reveal-page experience, and bears the principal responsibility for lawful basis, recipient notice, and data-subject rights routing.

This notice describes how SweetNote handles Personal Data in the B2B service. The substantive processing terms are codified in the Data Processing Agreement (DPA); this notice is the plain-English version designed to be shared with the Customer's privacy team and, where appropriate, included in the Customer's recipient-facing privacy disclosures.

1.1 Where SweetNote is the controller of its own data

Sections 2 through 13 describe recipient Personal Data, where SweetNote is the processor. SweetNote separately holds a small amount of Personal Data in its own right, as controller (a "business" under CCPA / CPRA terminology): the data of the people who work at a Customer or prospective Customer and deal with SweetNote directly. This is disclosed here for completeness.

Category	Source	Why we hold it	Retention
Workspace account: name, work email address, and (if you set one) a profile image	Directly from you, when you create an account or accept an invitation	Authenticate you, apply your workspace role, and show who did what inside a shared workspace	For as long as the account exists. Removing a member or closing the workspace ends access but does not delete the account; there is no automatic expiry. Ask us at privacy@thesweetnote.com to delete your account and we will.
Terms of Service acceptance: your account identifier, the email address on your account when you agreed, the Terms version, the time, and where you agreed (sign-up or the in-portal terms step)	Directly from you, when you tick the box to agree	Keep evidence that you agreed to the Terms, and ask you again when a new version takes effect	5 years from acceptance, then automatically deleted, even if your account is removed sooner. Each version you accept adds a record; earlier records are kept on the same schedule. A legal hold on your workspace suspends deletion while you remain a member
Pending-invitation email address	Entered by the colleague who invited you	Deliver and match the invitation before an account exists	Until the invitation is accepted, revoked, or expires
Enquiries: name, work email, organization, role, and whatever you write in the message, plus any indication of expected volume or topic	Directly from you, via the contact form or by emailing us	Answer the enquiry and, if it becomes a commercial conversation, scope and contract the work	Held as ordinary business correspondence; no automatic expiry. Ask us to delete it and we will.
Billing and contracting details	Directly from you, and from Stripe as our payments subprocessor	Take payment, issue invoices, and meet tax and accounting obligations	As required by tax and accounting law, which is longer than the windows in Section 6

For this data: SweetNote does not sell or share it, does not use it for cross-context behavioral advertising, and does not use it to build a profile or make automated decisions about you. It is disclosed to the subprocessors in Section 7 only where one of them provides the underlying function (authentication, email delivery, payments). The rights in Sections 11 and 12 apply to it and reach us the same way — privacy@thesweetnote.com — except that you do not need a Customer to route the request, because here the relationship is directly with us.

2. Personal Data we process

The volume of recipient Personal Data SweetNote processes depends on the input mode Customer selects per campaign. Two modes are available; Customer's selection is recorded in campaign metadata and is auditable on Customer request. SweetNote does not print or ship — Customer handles fulfillment:

Recipient list (default): Customer uploads a recipient list. No field is required — SweetNote processes only what Customer includes. First name (when provided) personalizes the reveal greeting; cohort tags drive aggregate analytics; and a postal address (when provided) is used solely to assemble the print file SweetNote returns. A Customer that prefers not to share names or addresses can upload a list without them.
Count-only: Customer uploads only a recipient count. Customer handles all addressing, printing, and shipping using the QR archive SweetNote returns. SweetNote processes no recipient names, addresses, or per-recipient identifying data.

Both modes preserve the aggregate-only output architecture, the n ≥ 25 per-cell suppression floor, and the no-biometric architecture. The categories below apply only to fields actually uploaded in the selected mode:

Category	Source	Why we process it
Recipient first name, optional last name, optional email	Customer-supplied (CSV upload or API)	Personalize the reveal page (SweetNote does not email recipients)
Delivery date of the card, if Customer or its mail provider supplies it	Customer-supplied	Measure how quickly a card was opened after it arrived, reported only in aggregate
Cohort metadata (department, donor tier, segment, region, randomized variation)	Customer-supplied	Aggregate-only dashboard cuts at sample-floor thresholds
Customer-supplied video creative	Customer-uploaded	Hosting and adaptive delivery to recipients via Mux
Per-recipient greeting text, sender attribution	Customer-supplied	Render the personalized reveal page
Engagement events: scan/open, video play (pressed play), time-on-page, watch-depth, reaction tap (3-option fixed: Sweet / So sweet / The sweetest), CTA-click; and the aggregate opt-in rate	Split basis (see Section 5): the scan/open, its timing, pressing play (the video start that powers the Engagement metric), and time-on-page (how long the reveal page was open, which powers the Dwell metric) are legitimate interest, captured for every recipient; only continuous watch-depth measurement — how far through the video someone watches — is consent-gated (fires only after “Count me in”); the reaction tap and CTA-click are action-as-consent (the tap is itself the opt-in). The three-tap reaction renders on every reveal, tapping is voluntary, recipients may close the page without tapping.	Capture aggregate engagement signal; generate the dashboard reporting Customer pays for. In SweetNote’s own analytical output — the dashboard, deliverable reports, and the cross-tenant benchmark — reactions are anonymous and aggregated to the campaign; those surfaces never display a per-recipient reaction or any individual response. Where the sending organization has opted in and executed the DPA Recipient-Level Export Schedule, per-recipient engagement — including the reaction — may be provided to that organization keyed by a pseudonymous code it joins to its own records on its side (no name, address, or contact detail is included, and the file does not contain the code-to-identity map; on SweetNote’s side the code sits beside any name the organization supplied only until the 30-day name purge); that is the organization using its own data through SweetNote, not SweetNote attaching identity in its own output. The reveal page does not accept open-ended text input from recipients (no comment box, no reply field).
Technical data: IP address and User-Agent (held only in hosting, database and email-provider logs; the User-Agent is read to screen out automated traffic and is not stored), and a random per-page-load session identifier stored with the engagement events	Recipient device	Abuse prevention and bot filtering. Logs are kept for the server-log period in Section 6; the session identifier is kept with the engagement events on their schedule in Section 6.
Conversion Data (join key, value, currency, timestamp) — Outcome Attribution campaigns only	Customer-supplied (relayed by Customer’s own systems from Customer’s payment-processor webhook, or uploaded as Customer’s identity-match CSV). SweetNote never collects Conversion Data from the recipient’s device.	Increment the per-cell Conversion Aggregate that powers the Outcome KPI. The per-recipient value is discarded in the same transaction that ingests it; only per-cell aggregates (n ≥ 25 floor) are retained, and Conversion Data is never pooled into the cross-tenant benchmark. Governed by the DPA Outcome Attribution Schedule.

3. What we deliberately do not process

The following are not processed in the SweetNote B2B pipeline. These are architectural commitments, not policy preferences:

No biometric identifiers or biometric information. No face geometry, voice template, retina or iris scan, fingerprint, or hand-scan analysis. No automated biometric analysis (e.g., AWS Rekognition or comparable services) is invoked in the SweetNote pipeline. Recipient sentiment is captured exclusively as a deliberate three-tap selection, a self-reported preference, not a biometric measurement. See DPA §14.1 for the formal BIPA exclusion attestation.
No demographic enrichment. SweetNote does not buy, infer, or attach gender, age, ethnicity, income, sexual orientation, religious affiliation, political views, or comparable inferred attributes to Personal Data we process.
No cross-tenant exposure. Customer's data is not combined with other Customers' data for any purpose other than (a) the published cross-tenant benchmark and (b) SweetNote's external academic publications (including pre-print working papers on the Social Science Research Network, peer-reviewed journal articles, and methodology-replication datasets submitted to public research data repositories such as the Open Science Framework). Both publish only at sample-floor thresholds and never identify individual brands or recipients: the portal benchmark at k ≥ 10 other contributing brands per cell (each brand's comparator is the network excluding that brand — eleven brands in the cell in total) and n ≥ 25 recipients per cell, and external academic publications at an elevated k ≥ 15 brands and n ≥ 50 recipients per cell.
No surveillance-class tracking. SweetNote does not use device fingerprinting, GPS / geolocation, camera or microphone access, session-replay tools, or cross-site behavioral advertising on recipient devices.
No sale or sharing for advertising. SweetNote does not sell or share Personal Data for cross-context behavioral advertising under CCPA / CPRA, and does not engage in "Targeted Advertising" or "Profiling in furtherance of solely automated decisions" under VCDPA / CPA / CTDPA / UCPA.

4. Business purpose for processing

SweetNote processes Personal Data for the business purpose Customer establishes with its recipients under applicable US law. For most B2B campaigns this will be Customer’s documented business purpose, performance of an existing brand-recipient relationship (customer, donor, employee, member, or similar) where the campaign falls within the scope of that relationship, supplemented by recipient consent for continuous watch-depth measurement; the open, pressed-play and time-on-page records rest on that business purpose (Section 5). The consent ribbon and action-as-consent mechanism described in Section 5 together ensure no watch-depth measurement is recorded without the recipient’s opt-in and no reaction or CTA-click event is recorded without the recipient’s own affirmative action.

Where Customer relies on contract or legal obligation as the basis for processing (e.g., delivering a recognition gift required under an employment contract, or a regulatory recognition program), Customer documents that basis in the recipient-facing notice. SweetNote’s role is service provider in all cases.

The reveal page does not gate the recipient’s message behind a consent decision. The video, the sender’s written note, and Customer’s call-to-action are visible from the moment the page loads — the recipient taps a poster button to start the video, an act of their own intent. Analytics consent is requested separately on a small non-blocking ribbon that the recipient may answer, ignore, or revisit. This design satisfies freely-given consent under GDPR Recital 42 and Article 7(4), the European Data Protection Board’s Guidelines 5/2020 prohibition on cookie walls, and the CCPA / CPRA prohibition on financial-incentive practices unrelated to the service.

Events captured on the reveal page fall into three groups, each with a distinct lawful basis:

Strictly necessary · legitimate interest. Server-side rendering, session-token issuance, abuse-prevention logging (IP address, User-Agent, session token), the server-side record that a reveal was opened — the scan event, the time it was first opened, and any re-opens — the record that the recipient pressed play (the video-start event), and the record of how long the reveal page was open and in front of the recipient (the time-on-page record) are processed under Customer’s documented business purpose and SweetNote’s operational legitimate interest. These records are captured for every recipient, regardless of the consent choice (including a decline; a Global Privacy Control signal additionally suppresses the pressed-play and time-on-page records, which are sent from the recipient’s browser, so under GPC only the server-side record that the reveal was opened is kept, together with a consent record noting that the GPC signal was honored): they are how the sending organization confirms its mailing reached people and that they engaged, and they power the aggregate Reach (opened), Engagement (pressed play), Speed (how quickly it was opened), Rescanned (opened again later), and Dwell (how long the reveal page was open) metrics. The time-on-page record measures the page, not the video: it carries two durations, the time the reveal was actually in the foreground (which is what the Dwell metric reads) and the total time the page stayed open including time it sat in the background, is held in memory and sent each time the page moves to the background and once more as it closes, stores nothing on the recipient’s device, and observes nothing about what was watched — which is why it sits here rather than with the consent-gated watch-depth measurement below. They carry no name — only a pseudonymous per-recipient token whose name-link is purged 30 days after the engagement window closes (Section 6) — and they are reported to Customer only in aggregate, suppressed below a 25-recipient floor. They are not the consent-gated watch-depth measurement described in the next bullet. Server logs (IP/User-Agent) are kept for the period in Section 6 (up to 45 days; hosting and database logs 7 days or less).
Watch-depth measurement · opt-in consent. Continuous measurement of how far through the video a recipient watches — video progress (at each 10% of playback), video completion (≥85% watched), replays, and the retention curve — fires only after the recipient taps Count me in on the consent ribbon. It is suppressed entirely on a decline, on a no-decision, and when the browser sends a Global Privacy Control signal. Pressing play itself is not gated, and neither is the time-on-page record (both are captured for every recipient under the previous bullet); only the watch-through measurement described here — how far into the video the recipient got — requires opt-in.
Action-as-consent events. Tapping one of the three universal reactions (Sweet / So sweet / The sweetest) or following Customer’s call-to-action is itself the recipient’s affirmative action under GDPR Article 4(11). The reaction or CTA-click event fires at the moment of the tap, unless you have already declined on the ribbon: in that case the tap is not recorded and, for a reaction, the ribbon is offered again so you can change your mind deliberately. A consent_decision audit record is written alongside it so the consent → action ordering is unambiguous in the log. Global Privacy Control is an absolute kill-switch even for these events.
Conversion measurement · Outcome Attribution campaigns only. On campaigns where Customer has enabled Outcome Attribution, following Customer’s call-to-action carries a signed attribution reference (sn_ref) to Customer’s own site. Any later conversion (a donation, purchase, or registration) happens on Customer’s site, under Customer’s own privacy notice, in Customer’s own systems; SweetNote receives only the four-field Conversion Data described in Section 2, from Customer, and discards the per-recipient value on ingestion. The attribution reference is governed by the same consent posture as the CTA-click itself: on a consent decline or a Global Privacy Control signal, no attribution reference is carried on the call-to-action, so no conversion can be click-attributed from that session. Recipient-facing disclosure of Customer’s conversion measurement (e.g., “we measure whether outreach you respond to leads to a donation”) is delivered through Customer’s own channels per the DPA Outcome Attribution Schedule §10; recommended wording is published on the security page.

Consent text is versioned (the version active at the time of decision is recorded with each consent record), persisted in a first-party cookie, and retained for 5 years for audit purposes. SweetNote also computes, from these records, an aggregate opt-in rate — the share of recipients who scanned who chose “Count me in” — reported to the sending organization at the 25-recipient floor as a de-identified measurement-transparency figure; no individual recipient’s decision is shared, and no additional data is captured to produce this figure (it is derived from the consent records and the existing scan count). Recipients can revisit a prior decision at any time via the “Privacy choices” link in the SweetNote reveal-page footer, which re-opens the consent ribbon. A withdrawal propagates to downstream pipelines as soon as technically feasible and in any event within 24 hours. SweetNote honors the Global Privacy Control (GPC) signal on the marketing site, the brand dashboard, and the reveal page; on the reveal page a GPC signal hides the consent ribbon and suppresses the watch-depth measurement and every action-as-consent event (and the pressed-play and time-on-page records too; only the server-side record that the reveal was opened, and a consent record noting that the GPC signal was honored, are unaffected, as described above).

Region tagging on the consent record uses the recipient’s IANA timezone as a transient client-only proxy for jurisdiction (the same approach Google Consent Mode v2 and similar consent-management tools use). The timezone string itself is never stored or transmitted: it is read in memory and reduced immediately to one of four coarse region tags (EU, AMERICAS, OTHER, UNKNOWN), and only that tag is recorded, on the consent cookie and in the server-side consent record, for audit purposes only. It is not persisted as a tracking identifier.

When the code takes you straight to the organization’s own page. Some organizations send you from the QR code straight to their own web page instead of a SweetNote reveal page. In that case SweetNote records only that the code was scanned and when (pseudonymously, under the legitimate-interest basis above), sets nothing on your device, and passes nothing that identifies you to that page. There is no SweetNote consent ribbon or reaction on that page; what the page collects, and the choices it offers you, are governed by that organization’s own privacy notice.

6. Retention windows

The default retention windows for the B2B service are:

Data category	Default retention
Per-recipient Personal Data (name, any address supplied, any delivery date Customer or its mail provider supplied, and the identifying linkage that makes engagement events linkable to an individual)	30 days after the engagement window closes, then automatically deleted. Engagement events are themselves processed in pseudonymous, token-keyed form (keyed to an opaque per-recipient token, never to a name); deleting the names and addresses on this schedule removes the linkage that could connect those events to an identified individual. The events themselves are not deleted on this schedule — they are retained, de-identified, on the schedule in the next row
Per-recipient Personal Data on a campaign that was issued QR codes but never went live	60 days after the campaign's scheduled activation date, and never sooner than 30 days after the first deletion notice to the brand (notices 30, 14 and 1 days before; deletion on or after the stated date), then automatically deleted, together with the print files that include recipient names. The QR codes are kept and remain valid; if the campaign later goes live, the reveal opens without the recipient's name. Suspended by a legal hold, with a new 30-day notice period after release
Per-recipient Personal Data on a cancelled or refunded study	30 days after the cancellation or refund, then automatically deleted. The study's QR codes are retired at cancellation and no longer resolve to a recipient. Suspended by a legal hold
Recipient data uploaded to a draft study that is never paid for	Automatically deleted 90 days after upload, with notices to the brand 30, 14 and 1 days before; the brand may extend, never past 180 days from upload. The brand can also delete a draft at any time from its dashboard
Engagement events without recipient identifiers (aggregate, and pseudonymous token-keyed events once the linkage above is deleted)	24 months rolling, supporting period-over-period program comparisons and the cross-tenant benchmark dataset. Events are captured only during the campaign's engagement-tracking window — from activation to a hard bound of 90 days post-activation — comprising the 30-day engagement window SweetNote's reporting is based on plus an observation tail through day 90 that is banked only in pseudonymous, token-keyed form and is never surfaced as a per-recipient record. Live dashboard filtering and cohort re-cuts draw on these events and are available for 24 months after the engagement window closes
Settled study report (the aggregate report frozen when the engagement window closes; counts and floored rates, no recipient identifiers)	Kept with no fixed end date and available in the portal while Customer's workspace is open; not subject to the 24-month window above. Customer may ask SweetNote to delete it at any time; once deleted it is not regenerated. Anything Customer exports or downloads is Customer's to keep
Customer-supplied video creative	Default 5 years from upload to support recipient revisits; a brand may ask, before a study activates, for a shorter window for that study's video
Consent records (consent timestamp + version)	5 years from date of consent, for audit purposes
Audit logs (integration events, role changes, DSAR fulfillment records)	Retained for at least 7 years for compliance and dispute purposes
Token Map (Outcome Attribution only)	120-day hard ceiling per the DPA Outcome Attribution Schedule § 8 (applies only when Customer enables Outcome Attribution)
Outcome Attribution test receipts (Outcome Attribution only): the record of each test conversion, test-key request and refused live conversion, shown to the brand so it can check its wiring; no amount, no recipient token, no Personal Data	30 days from receipt, then deleted; suspended by a legal hold
Per-recipient conversion values (Outcome Attribution only)	Not retained. Discarded in the ingestion transaction; only per-cell aggregates persist, on the aggregate-engagement schedule above
Engagement events forwarded to an integration the Customer enabled (outbound webhooks; pseudonymous, token-keyed)	Event contents deleted from SweetNote's systems as soon as delivery settles (every destination received the event, or delivery failed five times); an event still undelivered after 30 days is dropped and its contents deleted within a day. A delivery record without the contents, including the pseudonymous recipient token, is kept 24 months so SweetNote can tell the Customer which destinations received a recipient's events. What the Customer's own systems received is retained under the Customer's own policy
Server and email delivery logs (technical metadata, IP)	Up to 45 days for security / abuse-prevention purposes (hosting and database logs 7 days or less; email delivery logs 45 days, held by our email provider)

Customer may instruct SweetNote to delete or return Personal Data at any time through the data-subject-rights routing or by contractual instruction in the MSA.

7. Subprocessors

SweetNote engages a small number of subprocessors for specific service components (video hosting, transactional email, payments, error monitoring, infrastructure). The current list is published at thesweetnote.com/legal/subprocessors, kept current, and available with 30 days' written notice on any change.

8. Data residency and international transfers

SweetNote processes Personal Data in the United States (default region: US-East via Supabase managed infrastructure). At launch, SweetNote serves US-based Customers and US-resident recipients only; data does not transfer outside the United States in the ordinary course of providing the Services. International expansion (UK, EU, Canada, and other jurisdictions) is on the post-launch roadmap. SOC 2 Type 1 attestation is a separate post-launch roadmap item (see DPA §12), not tied to international launch. When international support launches, SweetNote will publish the supporting transfer mechanisms and offer EU/UK data residency as a Customer-elected option at that time.

8.1 Children's privacy

SweetNote does not knowingly process Personal Data of minors. The platform is designed for adult B2B contexts, brand-to-recipient stewardship, donor recognition, employee acknowledgment, and similar relationships between an organization and adult individuals. Customer represents and warrants in DPA §4 that no recipient is a minor under any applicable law — meaning no recipient under eighteen (18) years of age in general-consumer contexts, and no recipient under whatever higher threshold any applicable state age-appropriate-design statute imposes. SweetNote does not knowingly process the personal information of any child under thirteen (13) in any context. Customer is responsible for ensuring that recipient lists submitted to SweetNote do not include minors. If SweetNote learns it has processed a minor's Personal Data without the appropriate parental consent, the data will be deleted promptly.

9. Security measures

SweetNote maintains appropriate technical and organizational measures to protect Personal Data, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, multi-factor authentication for administrative access, documented incident-response procedures, and annual third-party penetration testing (active starting after first paid customer studies launch; reports shareable under NDA). Detailed posture is published at /security.

9.1 Staff access to Personal Data

SweetNote runs its internal operator tooling on an aggregate-only privacy hard-wall. The surfaces authorized SweetNote staff use to operate the platform read aggregated, de-identified data, and no operator surface — including the founder's — exposes a per-recipient reaction, per-recipient engagement timing, or any name-attached engagement signal. Routine platform operation, analytics, and support neither require nor grant access to recipient identity. Authorized staff can access recipient-identifying Personal Data (recipient names and any addresses the Customer supplied) only through the logged data-subject-request fulfillment path described in Section 11 and DPA §10; each such access is recorded in the audit log retained on the schedule in Section 6.

10. Security incident response

SweetNote will notify Customer without undue delay and in any event within 72 hours after becoming aware of a Security Incident affecting Customer's Personal Data, with the information required under Section 11 of the DPA.

11. Data-subject rights

SweetNote supports Customer's obligations under applicable Data Protection Laws to honor data-subject rights, including the rights to access, deletion, correction, portability, restriction of processing, and objection. Customer routes data-subject requests through SweetNote's privacy intake at privacy@thesweetnote.com (or legal@thesweetnote.com — same intake queue); SweetNote provides the technical means to fulfill the request within 10 business days of Customer's routed submission. Customer's statutory response window to the underlying recipient (e.g., the 45-day CCPA response window) runs from Customer's receipt of the original request and is independent of SweetNote's 10-business-day processing SLA. Full procedure is in DPA §10.

If a recipient contacts SweetNote directly, we forward the request to the relevant Customer within five (5) business days of receipt and do not respond substantively unless required by law or authorized by Customer.

A request may be made through an authorized agent. We ask for the agent's written authorization signed by the person the request concerns, and we may verify that person's identity directly before acting, using the same verification steps described on the Do Not Sell or Share page. Verification asks only for what is needed to match the request to a record and is never used for any other purpose.

12. California and other state privacy rights

Under the California Consumer Privacy Act and California Privacy Rights Act, California recipients have the following CCPA / CPRA statutory rights:

(a) Right to know what Personal Data is collected and processed about them.
(b) Right to deletion of Personal Data SweetNote processes about them.
(c) Right to correction of inaccurate Personal Data.
(d) Right to opt out of the sale of Personal Information (Cal. Civ. Code §1798.140(ad)).
(e) Right to opt out of the sharing of Personal Information for cross-context behavioral advertising (Cal. Civ. Code §1798.140(ah)).
(f) Right to limit the use and disclosure of sensitive Personal Data.
(g) Right to non-discrimination — SweetNote will not deny services, charge different prices, or provide a different level of service for exercising any CCPA / CPRA right above (Cal. Civ. Code §1798.125).

SweetNote additionally honors, as a matter of course, the following two rights for California recipients even where CCPA / CPRA does not statutorily require them:

(h) Data portability — receive Personal Data SweetNote processes about you in a structured, commonly used, machine-readable format. (Portability is statutorily grounded only in a narrow CCPA provision at §1798.130(a)(3)(B); SweetNote extends it as a goodwill commitment.)
(i) Restriction of processing — instruct SweetNote to limit further processing of your Personal Data pending a dispute or correction. (Restriction of processing is a GDPR / state-law right that CCPA does not statutorily require; SweetNote extends it as a goodwill commitment.)

SweetNote processes no sensitive Personal Information (SPI) on Customer's behalf in the B2B pipeline, and engages in no sale or sharing of Personal Data; the opt-out rights are nonetheless honored as a matter of course. The SweetNote "Do Not Sell or Share My Personal Information" mechanism is at thesweetnote.com/legal/do-not-sell.

Recipients in other US states with comprehensive consumer-privacy laws have analogous rights to access, deletion, correction, and (where applicable) opt-out of targeted advertising and profiling for solely automated decisions. SweetNote honors these rights under each applicable state regime, including: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Utah (UCPA), Oregon (OCPA), Tennessee (TIPA), Montana (MTCDPA), Delaware (DPDPA), Iowa (Iowa CDPA), New Hampshire (NH DPA), New Jersey (NJ DPA), Minnesota (MN CDPA), Maryland (MD ODPA, including its heightened sensitive-data provisions), Rhode Island (RI DTPPA), Kentucky (KY CDPA), Indiana (IN CDPA), Nebraska (NDPA), Florida (FDBR), and any other US state consumer-privacy statute in force at the time of the request. SweetNote does not engage in targeted advertising or in profiling for solely-automated decisions; opt-out rights are honored under all applicable state laws as a matter of course.

If a request is refused, you may appeal. The VCDPA / CPA family of statutes gives you a right to appeal a refusal that CCPA does not, and SweetNote honors it for every request it receives — including requests about the data SweetNote holds in its own right under Section 1.1, where SweetNote is the controller and there is no Customer in between. To appeal, reply to the refusal or write to privacy@thesweetnote.com with the word “appeal”. SweetNote will respond in writing within 45 days, explaining the reasoning for the decision. If the appeal is denied, SweetNote will tell you how to lodge a complaint with your state Attorney General. Where the request concerns recipient data, the Customer is the controller and owns the appeal decision; SweetNote will route the appeal to that Customer and provide the technical means to act on the outcome.

13. Recipient-side rights and pseudonymization requests

If a recipient wishes to be pseudonymized on the SweetNote platform, that is, to have their identifying details replaced with a non-identifying placeholder — severing the link between their identity and any engagement records SweetNote holds (any later scans are recorded only against the anonymous placeholder, never re-linked to them) — the request can be sent directly to privacy@thesweetnote.com (or legal@thesweetnote.com) or routed through the Customer that originally sent the campaign. The substantive procedure is described in DPA § 10: SweetNote replaces the recipient's identifying token on SweetNote's side, but records SweetNote has already forwarded to Customer-enabled integrations remain in the Customer's systems and must be addressed with the Customer directly.

Cookie policy, cookies and equivalent storage technologies set across the marketing site, brand dashboard, and reveal page
Do Not Sell or Share My Personal Information, CCPA / CPRA opt-out mechanism (also honored under analogous state laws)
Subprocessors, the third-party services SweetNote engages to operate the platform
Data Processing Agreement (DPA), the substantive processing terms; this notice is the plain-English version
DPA Outcome Attribution Schedule, the additional terms that apply when Customer enables Outcome Attribution on a campaign

15. Contact

Privacy-related questions, data-subject requests, or notices under this policy may be routed to either privacy@thesweetnote.com or legal@thesweetnote.com — both addresses reach the same intake queue. Security-incident contact: security@thesweetnote.com.

The Sweet Note, Inc.
Delaware corporation
Mailing address available on signed engagements.

16. Changes to this notice

SweetNote may update this notice where required to comply with applicable law or to reflect material service changes. Substantive changes are communicated to Customers with at least 30 days' notice and are reflected in the canonical version published at thesweetnote.com/legal/privacy.

This notice is provided as the privacy notice for SweetNote brand customers. It supplements but does not replace the Data Processing Agreement: where the two address the same topic, the DPA controls.