Privacy Policy | SweetSync

1. Introduction

SweetBot Inc. ("SweetBot," "we," "us," or "our") is committed to protecting the personal information of everyone who uses the SweetBOS platform — including the portal and dashboard at portal.sweetbot.ai, the SweetSync membership environment (including this site when you use SweetSync services), and all services delivered through these channels (collectively, the "Platform"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights under applicable privacy law — including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), and, where applicable, the California Consumer Privacy Act (CCPA).

For information about data practices on our public marketing site, please refer to the privacy policy at explore.sweetbot.ai.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

Privacy contact

Elizabeth Dykes, Founder & CEO — SweetBot Inc.
1301 – 600 Fleet St., Toronto, ON M5V 1B7, Canada
hello@sweetbot.ai·514-893-0168

2. Information we collect

2.1 Information you provide directly

When you access or use the Platform, we may collect:

Full name and company name
Email address and phone number (where provided)
Business information submitted through the SweetCycle Seed phase, including operational data, challenges, goals, and strategic materials
Information provided through SweetSync membership activities, including Sparks, Quests, and Vault submissions

Information submitted through the Seed phase and SweetSync membership is used to deliver your engagement and personalize your SweetBOS experience.

2.2 Access and activity logs

We collect access logs for your portal and Platform sessions, including the date and time of access, frequency, and which sections you view. This helps us understand engagement, troubleshoot issues, maintain security, and improve service delivery.

2.3 Device and technical information

We may automatically collect device type, browser type, operating system, and IP address for security, fraud prevention, analytics, and performance purposes.

2.4 Analytics

We use Google Analytics to understand how visitors and users navigate the Platform — for example, page views, approximate geographic region (derived from IP), session duration, and referral sources. Google Analytics may use cookies or similar storage on your device. How Google handles this data is described in Google's Privacy Policy. You can control cookies through your browser settings. You may also install the Google Analytics Opt-out Browser Add-on where available.

2.5 Payment information

Payment transactions are processed by Stripe or, in some cases, by wire transfer or ACH / direct deposit. SweetBot does not store full payment card numbers on its own servers. Where Stripe is used as processor, payment data is subject to Stripe's privacy policy in addition to this Policy.

3. How we use your information

We use the information we collect to:

Deliver SweetBot services, including portals, Mirror, Map, and Machine sessions, and SweetSync membership
Configure and personalize AI-powered outputs and deliverables for your engagement
Operate and personalize your SweetSync membership experience, including Sparks, Quests, Journeys, Vault, and the Resource Centre
Communicate with you about your engagement, sessions, membership, and platform updates
Maintain access logs for security and platform monitoring
Process payments and maintain billing records
Comply with applicable legal obligations
Improve our methodologies and platform using anonymized, aggregated insights (see Section 7)

We will not use your personal information for any purpose materially different from those listed above without your prior consent.

4. AI systems and your data

SweetBot's services are powered by artificial intelligence. To deliver personalized outputs and deliverables, your information and materials may be processed by third-party AI platforms including Anthropic (Claude), OpenAI, and Google (Gemini). This processing is necessary to provide the services you have engaged SweetBot to deliver.

If you do not want your data used to train third-party AI models, please notify us in writing at hello@sweetbot.ai and we will make every commercially reasonable effort to honor that request and communicate it to the relevant AI providers. Our ability to enforce such opt-outs is limited to the controls those providers make available.

Anonymized, aggregated insights derived from engagements may be retained and used to improve SweetBot's methodology and platform. No individually identifiable information is retained for this purpose.

5. Who we share your data with

Service providers

Your information may be accessed by members of the SweetBot team in the course of delivering your services, operating the Platform, and maintaining the infrastructure that supports it. All team members and contractors are bound by confidentiality obligations.

We also engage service providers who process information on our behalf, including:

Stripe — payment processing for card and certain other payment methods, subject to Stripe's terms and privacy policy.
Anthropic, OpenAI, and Google — AI platforms that process prompts and content you submit to generate personalized outputs, in accordance with their policies and our agreements.
Vercel, Render, and Amazon Web Services (AWS) — hosting, deployment, and cloud infrastructure to run, deliver, and secure the Platform.
Resend — transactional and operational email delivery.
MongoDB and SurrealDB — database services used to store and manage application data.

Our subprocessors may change over time as we improve the Platform. Where we make a material change, we will update this Policy or notify you as described in Section 12.

Legal requirements

We may disclose personal information if required by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the rights, safety, or property of SweetBot, our clients, or others.

Business transfers

In the event of a merger, acquisition, or sale of substantially all of SweetBot's assets, your information may transfer to the successor entity subject to the same protections described in this policy. You will be notified of any such transfer.

What we never do

We do not sell your personal information. We do not share it with advertisers or data brokers.

6. Data storage and server location

The Platform and associated data are currently hosted on servers located in the United States. We are actively working toward migrating to Canadian-based hosting. This policy will be updated when that migration is complete.

Personal information may be accessed from Canada and other countries where we or our service providers operate. Where data is stored or transferred outside Canada, we take steps — including contractual safeguards with service providers where appropriate — to ensure it receives protection substantially equivalent to PIPEDA requirements.

7. Data retention

We retain your personal information for the duration of your active engagement with SweetBot. Following the end of your last active engagement or the termination of any SweetSync membership, we retain your data for three (3) years, after which it is securely deleted from active systems. Financial and billing records are retained for seven (7) years in accordance with applicable tax and accounting requirements.

You may request earlier deletion of your personal information by contacting hello@sweetbot.ai. Deletion requests will be honored within sixty (60) days, subject to our right to retain information required by law or necessary to resolve outstanding disputes.

8. Your privacy rights

Depending on your location, you may have the following rights. To exercise any right, contact hello@sweetbot.ai.

Canadian residents (PIPEDA)

The right to access the personal information SweetBot holds about you
The right to request correction of inaccurate or incomplete information
The right to withdraw consent to collection or use of your information (subject to legal and contractual obligations)
The right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca)

Quebec residents (Law 25)

In addition to the rights above:

The right to data portability — to receive your information in a common, machine-readable format
The right to request erasure of information collected without adequate legal basis
The right to be informed about and to refuse profiling or automated decision-making

California residents (CCPA)

The right to know what personal information we collect and how it is used
The right to request deletion of your personal information
The right to opt out of the sale of personal information (SweetBot does not sell personal information)
The right not to be discriminated against for exercising your privacy rights

9. Security and breach notification

We implement commercially reasonable technical, administrative, and organizational safeguards to protect your personal information from unauthorized access, disclosure, alteration, or loss.

In the event of a security breach involving your personal information, we will notify you in writing within seventy-two (72) hours of discovery. Notification will describe the nature of the breach, the categories of information affected, and the steps being taken to address it.

10. Portal and platform access

Your portal is your space. You are welcome to share it with your team, partners, collaborators, and anyone you're considering working with. Your deliverables are yours to use in the way that serves your business.

Portal access is granted through a personal access link or credential. The format of that access (link, PIN, or password) may vary by portal type and platform version. Please do not publicly publish your portal access link or provide it to people who have no business reason to see your engagement content.

11. Children's privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided personal information, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to the address on file. Continued use of the Platform following notification constitutes your acceptance of the updated policy.

13. Contact

SweetBot Inc.
1301 – 600 Fleet St., Toronto, ON M5V 1B7, Canada
hello@sweetbot.ai·514-893-0168

Canadian residents may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Quebec residents may also contact the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.