Privacy Policy

1. About This Policy

SentientWorks AI, Inc. ("the Company," "we," "us," or "our") operates the website sentinetworksai.com and the SentientWorks AI workflow-automation platform (together, the "Service"). The Company's principal place of business is 153 Kearny Street, Suite 300, San Francisco, CA 94105.

This Privacy Policy describes what information the Company collects, how we use it, with whom we share it, and the choices available to you. It applies to information collected through the Service and through direct communications with us.

SentientWorks AI is an AI workflow-automation platform built for enterprise operations teams. Our agents execute multi-step back-office jobs -- vendor invoice reconciliation, scheduled report generation, support ticket routing, and similar workflows -- and produce a full, human-readable run log for every execution. Because our customers connect the platform to their internal business tools and grant it access to operational data, this policy specifically addresses those data types and our handling commitments around them.

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, email address, phone number) when you fill out a form, request a pilot, or send us a message;
• Company information you choose to share (employer name, job title, team structure, the workflows you are trying to automate);
• Billing and account information when you subscribe to a paid plan;
• The content of any messages, support requests, or survey responses you send us.

2.2 Information Collected Automatically

When you visit sentinetworksai.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.3 Operational Workflow Data Processed on Your Behalf

When you use the SentientWorks AI platform to automate workflows, the Company processes operational data that you or your organization supply or that our agents retrieve via the integrations you authorize. This includes:

• Integration credentials and access tokens for connected tools (for example, Google Sheets, Airtable, Salesforce, HubSpot, Slack, Gmail, Zendesk, or custom webhook endpoints) -- stored in encrypted form and used solely to execute the workflows you configure;
• Operational workflow data retrieved during execution (for example, vendor invoice records, purchase order data, report source data, support ticket content, and similar business records your workflows process);
• Agent run logs, which record each step taken, the tool invoked, the duration, and any exception flags raised during a workflow execution;
• Workflow configuration data (trigger settings, exception-handling rules, routing targets, and output templates you define).

This operational data is processed on your behalf to deliver the Service. The Company does not use your operational workflow data to train machine-learning models without your explicit written consent. Run logs are retained for the period specified in your plan (12 months on Growth, plan period on Team, session duration on Pilot) and then deleted or aggregated in non-identifiable form.

2.4 We Do Not Knowingly Collect Children's Data

The Service is directed to business users and is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it promptly.

3. How We Use Information

We use the information we collect to:

• Operate and deliver the SentientWorks AI platform, including executing workflows you configure and generating run logs;
• Respond to inquiries, provide onboarding support, and communicate about your account;
• Send service updates and, where required by applicable law, marketing communications (you may opt out of marketing at any time);
• Maintain audit trails so you and your organization can verify every agent action;
• Detect, investigate, and prevent unauthorized access, fraud, or abuse of the Service;
• Improve the Service through aggregated, non-identifiable usage analytics;
• Comply with legal obligations, including responding to lawful requests from authorities.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see the California section below.

4. Sharing of Information

We share personal information only in the following circumstances:

• With service providers acting on our behalf -- hosting infrastructure, email delivery, payment processing, and internal analytics -- under contractual obligations that prohibit them from using your data for any purpose other than providing those services to us;
• With authorities, when required by valid legal process or to protect the rights, safety, or property of the Company, our users, or the public;
• With a successor entity in the event of a merger, acquisition, or sale of assets, subject to the protections in this Policy.

We do not sell personal information to third parties. We do not share operational workflow data with third parties except as directed by you through the integrations you configure.

5. Cookies and Tracking

We use cookies and similar technologies to operate the Service, maintain session state, and measure usage in aggregate. For full details and your opt-out options, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, to fulfill legal or accounting obligations, and to resolve disputes.

• Marketing contact records: purged 24 months after the last interaction;
• Inquiry and support communications: retained 36 months, then deleted;
• Agent run logs: retained for the period specified in your plan, then deleted or aggregated in non-identifiable form;
• Integration credentials and access tokens: deleted within 30 days of account termination;
• Server access logs: retained 90 days, then aggregated.

7. Security

The Company uses administrative, technical, and physical safeguards to protect personal information, including TLS encryption for data in transit, AES-256 encryption at rest for integration credentials and tokens, restricted-access databases with least-privilege access controls, and audit logging of access to sensitive systems.

The run log that SentientWorks AI generates for each workflow execution is part of the product's transparency design -- it is accessible to authorized members of your account, not to the Company's staff except where required for support with your explicit authorization.

No system is perfectly secure, and we cannot guarantee absolute security. If you believe a security issue has occurred, contact [email protected] immediately.

8. Your General Rights

Depending on your jurisdiction, you may have rights including the right to access, correct, or delete personal information we hold about you, and the right to limit certain processing. To make a request, email [email protected] with the subject "Privacy Request." We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, the Company has collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, email address, IP address); commercial information (service plan, billing history, workflow configuration choices); professional or employment-related information (employer, job title, team context that customers voluntarily provide); internet activity (browsing on sentinetworksai.com); inferences drawn from the above for service-improvement and account management purposes.

For customers who use the platform, the Company also processes operational workflow data on your behalf as described in Section 2.3. This data is processed as a service provider under your instructions and is not used for the Company's own commercial purposes.

9.2 Sources, Purposes, Disclosure

We obtain this information from you directly and through automatic site instrumentation. We use it to operate and improve the Service, communicate with you, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date at the top of this page and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints regarding this Privacy Policy can be sent to: