Every privacy commitment in writing. Enforced in code or contract. Reviewable before signup.

SweetNote’s dashboard, deliverable reports, and the cross-tenant benchmark show rates and patterns, never individuals; the per-recipient drill-down doesn’t exist in our surfaces by architecture. The one exception for your data is yours to switch on: the opt-in, DPA-gated recipient-level export hands you back your own engagement data as pseudonymous, token-keyed rows (no names, timing coarsened), for your own systems, never shown in ours. The n ≥ 25 floor is applied at render, uniformly, on every dashboard, report, and export we publish; the same floor applies to the optional Outcome KPI (opt-in), where per-recipient amounts are discarded on ingestion and only the per-cell aggregate is stored. Integrations a customer opts into are a separate layer: per-recipient events flow to destinations the customer configures once outbound delivery activates at launch (signed webhooks; CRM connectors are on the roadmap) keyed by a pseudonymous code, matching the Qualtrics / Sprig / Forsta norm. Mechanism in DPA § 4.

The reveal never gates the recipient’s message behind consent, and every event carries a distinct lawful basis: opening the reveal, pressing play, and the time the reveal was open are counted under legitimate interest (a Global Privacy Control signal suppresses the pressed-play and time-on-page records, which the browser sends; only the server-side open, and a record that the signal was honored, survive it), aggregate-only, keyed to a pseudonymous token, never a name, whose name-link is deleted 30 days after the engagement window closes; tapping one of the three reactions or following the call-to-action is itself the recipient’s affirmative action (GDPR Article 4(11)); and only the continuous watch-depth measurement — how far through the video someone watches — waits for the recipient to tap Count me in on a non-blocking ribbon, and it is suppressed on a decline, a no-decision, or a Global Privacy Control signal. GPC is honored as a kill-switch for pressed play, time on page, watch-depth, the reaction, and the call-to-action events alike. Full architecture in the Privacy Notice § 5.

No face, voice, gait, or biometric data anywhere in the B2B pipeline. The platform is built to operate in all 50 US states and to support compliance with US state consumer-privacy law: CCPA/CPRA in California, BIPA in Illinois, and the comprehensive in-force state regimes (full statute list in DPA § 1). The architecture itself doesn’t permit biometric capture, so there's no biometric data to review state by state. International expansion (UK / EU / Canada) and SOC 2 Type 1 are on the post-launch roadmap. This describes the architecture, not legal advice. Confirm fit with your own counsel.

No category exclusivity, ever. The SweetNote QR drops onto whatever you already send, through whatever tools fulfill it (Goody, Sendoso, Bonusly, Classy, your own print shop). Cross-brand benchmarks are only credible if no single seller can shape them, and the MSA names that explicitly: no exclusivity and no benchmark influence, for any customer at any spend (MSA § 13.20), backed by the same-paper covenant (§ 13.18).

If SweetNote is acquired, you get 90 days’ written notice before the assignment takes effect. If the successor is a competitor of yours, you may terminate within that 90-day window and receive a full refund for any study still in pre-activation status and a pro-rated refund for the unexpired portion of any study active at the effective date. Named in MSA § 13; same wording in every MSA.