Everything your team needs to evaluate SweetNote.

Executive summary.

SweetNote is the platform for physical-digital brand moments: wherever you decide to put a QR code on something physical you're already shipping (a gift, a mailer, an event kit, a package insert, a donor thank-you), the platform opens an owned digital reveal for the recipient and streams the engagement signal back to you. Aggregate-only by architecture, comparable across cohorts and (at k ≥ 10 other brands) across the SweetNote network. The video gift is the delivery mechanism; the data is the product.

The methodology SweetNote applies, Behavioral Brand Moment Research™ (BBMR™), captures observed action at the point of contact, under disclosed methodology, on channels the brand controls. BBMR™ is the research-tech name for the work; the platform is how you operate it. See the academic foundation →

What you buy

A research study, not a subscription. Each study is a single line item with methodology, sample, schedule, and an auto-generated study report (in the portal, printable to PDF) + executive deck + dashboard access for the campaign term. Same paper for every brand at the same study size. The research-design palette: Snapshot, Cohort, A/B (2–5 variations), Gift A/B (2–5 SKUs), Gift Lift.

What we measure

Every study reports the same six engagement KPIs, in funnel order, the locked metric set on every dashboard and readout:

• Reach: Did they open it? (scans / cards shipped)
• Engagement: Did they press play? (video plays / scans)
• Affirmation: Did they react? (three-tap reactions, Sweet / So sweet / The sweetest, over scanners)
• Action: Did it drive a next step? (clicks on the required CTA / reveals loaded)
• Speed: How fast did they open it? (median time from your activation date to first scan)
• Rescanned: Did they come back? (recipients who scanned the QR again after their first scan — scan_count ≥ 2, over scanners)

Plus the aggregate consent (opt-in) rate as a measurement-transparency signal. All rates suppress below the n ≥ 25 per-cell floor.

How long it takes

Automated payment paths, all turnkey:

• Pay now (credit card), typical for pilots and small studies (under $5,000). Signup-to-artifacts-unlocked in minutes.
• Pay by invoice (Net-30): typical for production studies. SOW auto-generated at checkout from your campaign config; artifacts unlock when you countersign the SOW in the portal. Reveal pages render on your activation date once the invoice is paid, so allow for your AP processing time before that date.

Same paper, same automation, same speed either way. Internal review on your side (legal, IT, procurement, finance) is typically the longest stretch, 2–3 weeks, which is why this bundle exists: to compress that work by giving every stakeholder what they need on day one. See the full flow →

Pricing & payment paths.

Per-study research-firm model. Same published list price for every brand at the same study size. No subscription, no negotiation, no surprise invoices, no per-scan fees, no tier mechanics.

Per-recipient graduated rate bands

Methodology premiums & sample-floor minimums

Payment paths

Automated payment paths, same paper across both:

• Pay now (credit card), authorizes in seconds; deliverable artifacts unlock on authorization. Typical for pilots and small studies (under $5,000).
• Pay by invoice (Net-30): typical for production studies, and the path for bank payment. SOW auto-generated at checkout from your campaign configuration and emailed to you, ready to forward to your AP team; artifacts unlock on SOW countersignature. The invoice itself is paid by credit card or bank account on the invoice.

Either path is fully automated end-to-end, no human in the launch loop, no counter-signature delay beyond your team's standard cycle, no manual SOW drafting. The platform itself adds no time to either path.

Activation-date-gated resolution

Reveal pages render on the brand-specified activation date only once the study is paid (by card at checkout, or when the invoice is paid) and its video is ready to serve. Deliverable artifacts (QR ZIP, variable-data CSV) unlock the moment commercial commitment is recorded so you have print-and-ship lead time before activation. Three reasons: legal protection, no collections risk, clean revenue recognition. Firm across all customers and all payment paths.

Auto-deliverables included with every study

• Study report (in the portal, printable to PDF), full methodology, sample frame, headline metrics with n + 95% CI, sample-floor disclosures, cross-tenant benchmark callouts (where Customer's comparator — the network excluding Customer — holds at least 10 other contributing brands and 25 recipients per cell)
• Executive deck, a tight 6–7-slide narrative summarizing the study for internal sharing
• Live dashboard access for the campaign term
• Webhook event streams to your CRM, warehouse, or custom endpoint, available to every customer on request and configured per study; not enabled by default
• Authentication: Supabase Auth at launch (email magic-link, OAuth via Google / Microsoft) for every customer; SAML / OIDC SSO and multi-factor authentication roll out post-launch, included for every customer — no enterprise gate, no upcharge, no contract addendum
• Brand subdomain (acme.thesweetnote.com) ships at launch, wildcard *.thesweetnote.com DNS at Netlify with free wildcard SSL via Let's Encrypt; team-member invites available for every customer

Contract philosophy: same paper for every brand.

SweetNote signs the same MSA and the same DPA with every customer. Same pricing, same refund policy, same data-retention schedule, same security commitments, same SLA, same indemnification, same termination terms. No redlines and no negotiated terms. The one departure SweetNote may make is a one-off concession on a single study, at its discretion, recorded on that study’s Order Form (MSA §13.18(vi)); it is never a rate, tier or program and changes no contract term. The single published variant is Exhibit B (Public Entity Terms), which applies automatically and identically to every customer that is a public institution, because such institutions are generally prohibited by law from accepting several standard provisions. It is published rather than negotiated, and no customer — public or private — redlines it. See below.

What we accept

• Jurisdiction-required compliance language (state Attorney General requirements, industry-specific regulatory clauses; SweetNote serves US customers and US recipients at launch; international support is on the post-launch roadmap)
• Form-only changes (your company name, contact information, custom subdomain configuration, named technical contact)
• Notice and termination clauses required by your jurisdiction or industry regulator
• Your standard vendor-onboarding pack (W-9, COI, banking forms, vendor questionnaires)
• Counter-signed PDF copies of the standard MSA + DPA on request
• Public-entity terms, applied automatically where you are a state agency, public university, school / hospital district, municipality, federal agency, or tribal government: capped indemnities, subject to law and appropriation, indemnify-but-not-defend, your own state’s law and non-exclusive venue, sovereign immunity untouched, and your public-records obligations preserved. Published and uniform, not negotiated (MSA Exhibit B)

What we don't accept

• Pricing redlines, the published per-study formula is the price, full stop
• Refund-policy redlines, activation-date-gated resolution and termination-for-cause are firm
• Negotiated indemnification caps, calibrated for the per-study price model — the published Public Entity Terms above are the one variant, and they are published rather than negotiated
• Custom data-residency commitments beyond the standard DPA
• Exclusivity / category-exclusivity provisions, never (it's an architectural commitment, not a negotiation lever)
• Custom retention schedules beyond the standard DPA defaults

If our standard terms genuinely don't work for your team

If your procurement process requires substantive contract negotiation as a matter of policy, SweetNote is unlikely to be a fit, and we'll say so on the first call. We'd rather acknowledge a fit issue than waste your team's time. Where appropriate, we can connect you with traditional research firms that operate on negotiated-MSA models.

Privacy & data posture.

SweetNote operates under a set of locked architectural commitments. Each is enforced in code at the database / query layer, not in policy:

1. Aggregate-only data exposure in SweetNote’s own output: the SweetNote dashboard, deliverable reports, and cross-tenant benchmark show aggregates only within a tenant AND across tenants, with sample-size minimums enforced at query time. Per-recipient drill-down endpoints do not exist as API surface on SweetNote’s analytics layer. Customer-enabled integrations are a separate layer: when Customer enables a webhook destination or the opt-in recipient-level export, per-recipient activity flows to Customer-controlled tools keyed by a pseudonymous code Customer joins to its own records on its side, matching the industry norm (Qualtrics, Forsta, Sprig, Medallia all forward per-respondent data to customer-controlled tools). Those destinations are Customer’s subprocessors and sit on Customer’s privacy disclosures.
2. No biometrics, anywhere in the pipeline: not on senders, not on recipients, not in moderation. Sentiment is a deliberate three-tap choice (Sweet / So sweet / The sweetest), self-reported, never inferred.
3. Basis-appropriate event capture: opening the reveal and pressing play (the video-start event that powers the Engagement metric) are captured for every recipient on an aggregate-only legitimate-interest basis; only the continuous watch-depth measurement (video progress thresholds, completion, retention curve) requires an opt-in tap on the analytics-consent ribbon; reaction taps and CTA clicks are themselves the recipient’s affirmative action under GDPR Article 4(11) and create the consent record at the moment of action. The consent text is versioned and auditable, and the Global Privacy Control signal is honored as an absolute kill-switch.
4. Aggregate-only engagement output in SweetNote’s own analytical surfaces: in the SweetNote dashboard, deliverable reports, notification emails, and the cross-tenant benchmark, senders see counts and aggregates only, never name-attached engagement detail. Reactions never appear, name-attached or per-recipient, in SweetNote’s own analytical surfaces. (If Customer enables an integration per the line above — or opts in to the recipient-level export under the DPA Recipient-Level Export Schedule — per-recipient activity, including the reaction, flows to Customer’s own tools keyed by a pseudonymous code Customer joins to its own records on its side — that’s Customer using its own data through us, not SweetNote exposing identity in our own output.)
5. No exclusive partnership deals, ever: structural independence is what makes cross-brand benchmarks credible. The DPA, MSA, and integration-agreement templates explicitly do not contain exclusivity language.

BIPA (Illinois) clearance

Because no biometric processing occurs in the SweetNote pipeline, the B2B service is delivered to recipients in all 50 U.S. states, including Illinois. Formal BIPA exclusion attestation is in DPA § 14.

Draft-state recipient PII handling (DPA § 13.1)

The SweetNote portal allows Customer to configure a campaign, including uploading a recipient CSV, before the campaign is paid for and launched. Personal Data uploaded into a campaign in draft state is held under the same security measures as live campaigns, plus six additional commitments:

• Encryption at rest at the field level (AES-256 envelope)
• No QR generation, no reveal page, no recipient activation pre-commercial-commitment
• No analytics processing; data exists solely to render the configuration view
• Customer-initiated deletion at any time from the portal
• Automatic deletion of uncommitted draft recipient data at 90 days, with email warnings at 30, 14, and 1 day prior and a no-fee extension capped at 180 days from upload
• Never used as benchmark seed data

The architectural rule: account = configuration; QR generation = recipients = commercial commitment + activation date. Full clause text →

Customer-elected input modes

SweetNote does not print or ship; Customer handles fulfillment. The volume of recipient PII SweetNote processes is determined by Customer's mode selection per campaign:

• Recipient list (default): Customer uploads a recipient list. No field is required — SweetNote processes only what Customer includes. First name (when provided) personalizes the reveal greeting; cohort tags drive aggregate analytics; postal addresses (when provided) are used solely to assemble the print file SweetNote returns. A Customer that prefers not to share names or addresses can upload a list without them.
• Count-only: recipient count only; Customer handles all addressing, printing, and shipping. SweetNote processes no recipient names or addresses in this mode.

Both modes preserve the aggregate-only output architecture, the n ≥ 25 per-cell suppression floor, and the no-biometric architecture. Mode selection per campaign is recorded in campaign metadata and is auditable on Customer request. Full schedule in DPA § 4.

Retention defaults

• Per-recipient PII (names, addresses, personal notes, engagement events linkable to an individual): deleted automatically 30 days after the engagement window closes
• Aggregate engagement events (without recipient identifiers): retained 24 months rolling to support period-over-period trend comparisons + cross-tenant benchmark dataset; the settled study report is kept with no fixed end date while Customer's workspace is open (DPA § 13)
• Customer-supplied video creative: retained 5 years from upload to support recipient revisits
• Consent records (timestamp + version): retained 5 years from consent for compliance audit
• Audit logs (integration events, role changes, DSAR fulfillment): retained for at least 7 years for compliance and dispute purposes
• Token Map (Outcome Attribution only): 120-day hard ceiling per the DPA Outcome Attribution Schedule
• Customer DSAR requests: processed within 10 business days of receipt; where a subprocessor holds a copy, SweetNote instructs it in the same step

Compliance posture

CCPA / CPRA (California) · BIPA (Illinois, zero-biometrics architecture) · aligned with the comprehensive US state privacy regimes: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Utah (UCPA), Oregon (OCPA), Tennessee (TIPA), Montana (MTCDPA), Delaware (DPDPA), Iowa (Iowa CDPA), New Hampshire (NH DPA), New Jersey (NJ DPA), Minnesota (MN CDPA), Maryland (MD ODPA, with heightened sensitive-data provisions), Rhode Island (RI DTPPA), Kentucky (KY CDPA), Indiana (IN CDPA), Nebraska (NDPA), Florida (FDBR), and any other US state consumer-privacy law in force at the time of processing. International expansion (UK, EU, Canada) is on the post-launch roadmap alongside SOC 2 Type 1. Full privacy posture →

Security overview.

Encryption

• TLS 1.2+ for all data in transit; older protocols and ciphers explicitly disabled at the edge
• AES-256 (or equivalent) at rest in databases, object stores, and backups
• Field-level encryption envelope for recipient PII (separate key from general database encryption); engineering observability tools never expose plaintext PII

Hosting & data residency

• Managed cloud infrastructure: Supabase (database, auth, storage, edge functions) and Netlify (static hosting, edge CDN, edge functions, SSL termination)
• Default region: US-East. Recipient engagement events are processed and stored in the United States.
• SweetNote serves US-based Customers and US-resident recipients at launch. International expansion (UK, EU, Canada) is on the post-launch roadmap; transfer mechanisms (EU SCCs, UK IDTA, or equivalent) will be published when international support is enabled.

Access control

• Production access gated by least-privilege RBAC, all engineering access requiring MFA
• Per-tenant data isolation enforced at the database layer via Supabase Row Level Security (RLS) policies, tenant data cannot be read across boundaries even with otherwise valid credentials
• Engineering access to PII fields is logged at the database level
• Customer-side authentication: Supabase Auth at launch (email magic-link, OAuth via Google / Microsoft). SAML / OIDC SSO and multi-factor authentication roll out post-launch, included for every customer with no enterprise gate or upcharge

SOC 2 status

SOC 2 Type 1 audit is on the post-launch roadmap once the audit-evidence window from early customer studies builds, with Type 2 to follow within 12 months of Type 1 completion. Operating from day one: the controls SOC 2 codifies (access management, change management, encryption, incident response, vendor governance) are documented in the DPA and reviewable before contract signing.

Penetration testing & vulnerability disclosure

• Annual third-party penetration testing on the standard ops calendar, active after first paid customer studies launch; reports shareable under NDA
• Codebase hardened against the OWASP Top 10; automated SAST/DAST scans on every deploy
• Vulnerability disclosure: send to security@thesweetnote.com; acknowledged within 1 business day; safe-harbor for good-faith research under disclose.io principles

Incident response

• Detection via continuous logging, automated alerting, and customer-reported channels
• Notification to affected customers within 72 hours of becoming aware of a Security Incident (actual or reasonably suspected) as the DPA defines it, ahead of any regulatory deadline
• Public status page at status.thesweetnote.com for incidents that affect platform availability
• Remediation with root-cause analysis and post-incident report shared with affected customers

Subprocessor list.

Each subprocessor is bound by data-processing terms equivalent to or stricter than what we contractually commit to under the DPA. Adding a new subprocessor triggers a notice to existing customers with a 30-day window to object before activation.

Always-current list at /legal/subprocessors.

DPA highlights.

The Data Processing Agreement is the contractual addendum to the MSA covering service-provider and processor obligations under CCPA / CPRA and the other U.S. state privacy laws. The service is offered in the United States only (DPA Section 9.1). Full DPA →

• Customer is the Data Controller; SweetNote is the Data Processor under written instructions documented in the DPA + MSA + portal configuration choices.
• International transfers: US-only at launch. Transfer mechanisms (EU SCCs, UK IDTA, or equivalent) will be published when international support is enabled.
• Subprocessor changes: 30 days' prior written notice; Customer may object on data-protection grounds.
• Data Subject Rights: SweetNote provides technical means + 10 business-day SLA on Customer-routed requests.
• Security incident response: 72-hour notification to affected customers ahead of any regulatory deadline.
• Audit rights: Customer (or third-party auditor) may audit at Customer's expense; most requests satisfied via security-questionnaire responses (SIG, CAIQ), DPA + subprocessor list, and documentation review under NDA. SOC 2 Type 1 attestation is on the post-launch roadmap and will be added to the audit package once available.
• Retention defaults: 30 days after the engagement window closes for per-recipient PII; 24 months rolling for aggregate non-identifying events (the settled study report has no fixed end date); Customer can negotiate shorter retention in MSA.
• BIPA exclusion attestation (DPA § 14), SweetNote does not collect, capture, or process biometric identifiers or biometric information.
• Draft-state PII handling (DPA § 13.1), covers pre-payment recipient data uploaded during campaign configuration.

MSA highlights.

The Master Services Agreement is the foundational contract; per-study SOWs attach to it. Standard terms across all customers. Full MSA →

• Term: per-study; no subscription, no auto-renewal, no minimum commitment. Each Order Form attaches to the MSA on execution and defaults to the campaign window plus the 24-month dashboard-access tail defined in MSA § 1.1 (measured from the day the window closes, matching the 24-month aggregate-retention window in DPA § 13). The MSA itself remains in force for so long as Customer holds an active or pending Order Form.
• Fees: per-study formula ($500 base + per-recipient charge + methodology premium + Outcome Attribution add-on if enabled) per the published graduated rate bands. Same number for every Customer at the same study size. Activation-date-gated resolution firm across all paths.
• Termination: immediate written notice for material breach (with 30-day cure), insolvency, or AUP violation that cannot be cured. SweetNote may suspend Services without termination for AUP violations pending investigation.
• IP: Customer retains all rights in Customer-supplied content (videos, recipient data, campaign configurations). SweetNote retains rights in the platform, methodology, and aggregate-only network data.
• Acceptable Use Policy: Customer attests that Customer-supplied videos comply with content standards (no harassment, illegal content, biometric surveillance setup, etc.) and that Customer holds appropriate releases for any individual whose likeness is included.
• Indemnification: each side covers what it controls. SweetNote indemnifies for U.S. patent / copyright / trademark / trade-secret infringement claims against the platform (with standard carveouts for Customer-supplied content, modifications, and out-of-scope use); SweetNote's remedies are procure right / modify / replace / terminate-with-refund. Customer indemnifies for its content, AUP violations, recipient-list lawful basis, the minors-exclusion warranty, and contacting a recipient without lawful basis or against an opt-out. Every Customer indemnity sits under the Indemnification Cap (§9.2(b)); SweetNote also defends third-party and regulatory claims arising from a Security Incident it caused, under the Data-Protection Cap (§10.1); for public entities every Customer indemnity is capped, applies only as law and appropriation permit, and carries no duty to defend (MSA Exhibit B §§B.2–B.4). Full text at MSA §10.
• Limitation of liability: general cap = greater of trailing-12-month fees paid or $250,000. Two separate higher caps in §9.2: Data-Protection Cap = greater of 2× general cap or $500,000; Indemnification Cap = greater of 2× general cap or $500,000 (independent ceilings, not bundled). Uncapped for confidentiality breach (except that a Security Incident or other DPA violation stays under the Data-Protection Cap even if it is also framed as a confidentiality breach), gross negligence / fraud / willful misconduct, unpaid fees, and liability that cannot be limited by law. Every Customer indemnity sits under the Indemnification Cap, for every Customer (MSA §9.2(b), §9.3). Full text at MSA §9.
• Insurance: SweetNote maintains commercial general liability ($1M/$2M), professional liability / E&O ($1M/$2M), and cyber-liability coverages for the duration of any active engagement, at the floors stated in MSA §9.5; limits are reviewed as engagement size and data scope warrant, and the Certificate of Insurance evidences the limits actually in force. A Certificate of Insurance evidencing those coverages is typically issued by the carrier within 1–2 business days of written request to legal@thesweetnote.com. On written request to legal@thesweetnote.com, SweetNote names Customer as an additional insured on its Commercial General Liability policy on a primary and non-contributory basis, with waiver of subrogation, per the policy’s blanket endorsements (general-liability policy only); the endorsed certificate typically issues within 1–2 business days.
• Governing law & venue: Delaware (SweetNote's state of incorporation), with carve-outs for jurisdiction-required compliance. Exclusive forum in Wilmington, Delaware courts. Public entities: your own jurisdiction’s law governs and venue is non-exclusive in your own courts, with no forum objection waived (MSA Exhibit B §B.5).
• Dispute resolution: mediation-prerequisite (30-day informal negotiation, then up to 60 days of non-binding mediation under AAA Commercial Mediation Procedures) before either Party files in court. IP / confidentiality / trade-secret / equitable-relief claims are carved out and may proceed directly to court. No arbitration clause; no class-action waiver. Full text at MSA §13.
• SLA: contractual 99.0% Monthly Uptime Percentage service commitment, with tiered service credits (10% / 25% / 50% of Monthly Active Study Fees) and Customer termination right after three consecutive months below 95.0% or any single month below 90.0%. Public status page at status.thesweetnote.com, with incidents posted within 15 minutes of detection and updated at least every 30 minutes until resolution (MSA Exhibit A §A.6). Full SLA at MSA Exhibit A.
• Same-paper covenant: contractually binding favored-nations clause, SweetNote will not offer another Customer of the same study size materially more favorable MSA / DPA / SLA / pricing terms; if it does, Customer may elect those terms with prospective effect on 90-day notice. Six carveouts are not treated as "more favorable terms": (i) the non-price Founding-Partner benefits available to the first ten paying brands who accept the published Founding-Partner participation terms — the precision commitment, named citation, and founder access — which involve no price concession of any kind (Founding Partners pay the published price on the same formula as every other Customer), and which close once the cohort fills; (ii) jurisdiction-required compliance language and form-only changes (Customer name, contact, subdomain); (iii) good-faith clarifications and operational accommodations that don't change either Party's substantive obligations; and (iv) later-launched product modules, so long as they're offered to every then-active Customer as a published tier on the same paper; (v) the published Public Entity Terms (Exhibit B), available identically to every Customer that qualifies as a public entity and adopted because such institutions are generally prohibited by law from accepting the corresponding standard provisions; and (vi) a one-off concession on a single study at SweetNote’s discretion, recorded on that study’s Order Form, never published or offered as a tier or program, and changing no contract term. Full text at MSA §13.18 · Same-paper covenant.

Refund & termination.

• Pre-activation refunds: the study fee less a flat 3% processing fee if the campaign has not yet activated, and refunded in full with no deduction where the cancellation arises from SweetNote’s breach, the warranty remedy, an IP claim, a change of control, force majeure, the uptime-termination right, a methodology review not returned within the published turnaround, a subprocessor objection, a Public Entity appropriation failure, or a cancellation by SweetNote. Holds even if QR codes have been generated and the variable-data CSV has been downloaded; the study becomes non-refundable only once reveals begin resolving to recipients (on the activation date, once the study is paid and its video is servable). Customer requests a refund by emailing support.
• Post-activation: per-study fees are non-refundable except as set out in MSA Sections 4, 5, 10.3, 13.12, 13.13 and Exhibit A (SweetNote’s uncured breach, the uptime-termination right, a competitor change of control, force majeure, an IP claim). Reveals are resolving; recipients are receiving cards; the methodology + readout are running.
• Termination-for-cause refunds: pro-rated refund if SweetNote materially breaches the MSA and fails to cure within 30 days of written notice.
• No subscription, no negotiated rates: studies are paid per-study, pay now (credit card) or pay by invoice (Net-30, payable by card or bank account), the published per-study price is identical on every path.

Full text at /legal/refund-policy; substantive terms in MSA § 4–5.

Vendor onboarding.

Most production studies are paid by invoice (Net-30), corporate AP systems require vendor records to issue checks against invoices. The vendor pack is available on request at founding-cohort stage; portal-direct downloads are on the post-launch roadmap.

Available on request (1–2 business days)

• W-9 (U.S. tax classification)
• Bank-account banking instructions (ACH / wire details for incoming invoice payments)
• Anti-bribery / anti-corruption attestation
• Modern-slavery declaration (UK / Australia / equivalent)
• SIG Lite, SIG Core, CAIQ: standard security questionnaire responses (within 5 business days)
• Counter-signed MSA + DPA PDFs: generated when you accept terms at checkout
• Certificate of Insurance (COI): requested via email to legal@thesweetnote.com. SweetNote maintains the coverages in MSA §9.5; the carrier emails a COI evidencing them directly to your AP team within 1–2 business days of request. Additional-insured status, if your procurement requires it, is granted on written request on the general-liability policy, on a primary and non-contributory basis with waiver of subrogation, per the policy's blanket endorsements.

Email legal@thesweetnote.com with the items you need; founder-direct response.

Returned in your format within two business days

• Brand-specific vendor management portal forms (Coupa, Ariba, Workday, custom), we complete in your portal's format
• State-specific tax classification questionnaires beyond the W-9
• Diversity / supplier-classification surveys (informational only; we don't claim certifications we don't hold)

Available on request, longer turnaround

• Custom security questionnaires beyond SIG/CAIQ, we typically suggest the SIG Lite/Core or CAIQ in lieu (same scope, industry standard). If a custom questionnaire is required, 5–10 business days.

None of this gates campaign launch. The MSA, DPA, and SOW are accepted in-portal at checkout; deliverable artifacts unlock the moment commercial commitment is recorded regardless of vendor-pack status. Reveal pages render on your activation date once the study is paid (on the invoice path, once the invoice is paid).

What each of your stakeholders needs.

Contact & canonical docs.

Single contact for procurement-routed requests

Send vendor-onboarding paperwork, security questionnaires, and specific legal questions to legal@thesweetnote.com. Standard SLAs above. (For founder-direct contact at founding-cohort stage, see the footer.)

Vulnerability disclosure

Send suspected security issues to security@thesweetnote.com. Acknowledged within 1 business day.

Self-serve before you need to talk to us

• Scope a study + see the price: /pricing#calculator
• See an example study (free account): /demo
• Sign up free, configure your brand, draft a campaign: /login

Canonical full documents (this bundle is a summary)

• Master Services Agreement, foundational contract
• Data Processing Agreement, data-handling terms
• DPA Outcome Attribution Schedule, attaches when Outcome Attribution is enabled
• DPA Recipient-Level Export Schedule, attaches when the recipient-level export is enabled
• Study Order Form (SOW), auto-generated per study
• Contract philosophy, why we don't redline
• Subprocessor list, always current
• Refund policy, full text
• Security overview, full posture
• Trust center, everything together
• Privacy policy, full text