1. Data we collect
- For a Free Public Commitment Scan: the submitted public HTTPS URL, visible page text needed for the request, selected language, generated preview, and rate-limit telemetry. SharpWave stores only keyed hashes of the requesting network/device signal and website host with status, finding count and timestamps; it does not store the raw URL or public page text in its database for this preview.
- Account data such as name, email, authentication status, role and MFA status.
- Order data such as selected package, price, currency, payment status and transaction identifiers.
- Deal materials you submit, including offer text, RFP requirements, scope, pricing and supporting evidence.
- Automated review data such as findings, complete document versions, closure states, decisions, approval records and audit events.
- Customer-recorded post-send data such as send status, outcome, final value, scope change and payment issues, which may be used to calculate Controlled Deal Rate.
- Organization control-profile settings such as margin, payment, acceptance, liability, exclusion and approval rules.
- Technical and security data such as IP address, device/browser information, timestamps, rate-limit events and error logs.
- Support communications and the information you choose to include.
2. Why we process data
- Fetch the public page you request, generate the limited commitment preview and prevent repeated or abusive free scans.
- Create and secure accounts and workspaces.
- Accept, verify and reconcile orders, deal credits and refunds.
- Generate and deliver the purchased automated control output and included re-reviews.
- Compare versions, evaluate reported BLOCKING closure and apply customer-configured organization rules.
- Maintain customer-owned evidence, approval, audit and post-send outcome records.
- Calculate workspace indicators such as Controlled Deal Rate from customer-recorded data.
- Prevent abuse, investigate incidents and enforce service terms.
- Comply with lawful obligations and resolve disputes.
- Measure product reliability using aggregated or de-identified operational data.
3. AI processing
Visible text fetched for a Free Public Commitment Scan and text submitted for a purchased review may be sent to OpenAI through the API to generate the requested output. SharpWave sends current requests with response storage disabled. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in; under default API controls, abuse-monitoring logs may still retain content for up to 30 days, or longer where legally required. Provider controls can change and separate approved retention arrangements may apply.
Free-scan page text and generated previews are returned to the current browser and are not stored in the SharpWave database. Paid AI output, submitted document versions and relevant evidence are stored as needed to provide the workspace, version comparison and audit record. Do not submit secrets or specially regulated data unless a separate written agreement confirms the required controls.
4. Service providers
SharpWave uses service providers only for defined operating purposes. Current core providers include Vercel for hosting and server execution, Supabase for database and authentication, Stripe for checkout and payment processing, OpenAI for AI processing, Cloudflare for DNS/security delivery, and Google Workspace for business email. Each provider processes data under its own terms and privacy commitments.
- Payment-card details are collected by Stripe; SharpWave does not store the full card number.
- SharpWave does not sell submitted deal materials or use one customer’s Offer to compare a competing customer.
- Customer names, logos and claimed results are not published without permission.
5. Cookies and local storage
SharpWave currently uses essential session, authentication, security and checkout technologies needed to operate the service. It does not currently use third-party advertising cookies on the production application. Vercel Web Analytics measures page views, referral sources and device information without analytics cookies. URL query parameters are removed before page-view events are sent. We do not send submitted deal content or contact details as analytics event properties.
6. Retention and deletion
Free-scan status telemetry is retained for up to 90 days; hourly rate-limit keys expire from the active store after approximately 48 hours and host-day keys after approximately 30 days. The raw public URL and page text are not stored in the SharpWave database for the free preview. Processor retention may differ as described above.
Other data is retained for as long as reasonably necessary to provide the workspace, preserve the requested audit trail, meet payment and security obligations, resolve disputes and comply with law. You may request account or deal deletion. SharpWave may retain limited records where required for payment, fraud prevention, legal claims, backups or an agreed audit record. Backup copies expire through normal rotation rather than immediate deletion.
7. Security
SharpWave uses role-based access, row-level database controls, MFA requirements for privileged users, encrypted transport and server-only secrets. These measures reduce risk but cannot guarantee absolute security. Notify support@sharpwaver.com promptly if you suspect unauthorized access.
8. Sharing and legal disclosure
SharpWave shares data with authorized customer team members and service providers only as needed for the purposes above. Current packages do not route submissions to SharpWave human reviewers. Limited authorized personnel may access data when reasonably necessary for customer-requested support, security investigation, abuse prevention or legal compliance; this is not a purchased human review service. SharpWave may also disclose information when legally required, to protect rights and security, or as part of a business transaction subject to appropriate confidentiality and notice where required.
9. International processing
Providers may process data in countries other than yours. Where applicable law requires a transfer mechanism or additional terms, SharpWave will use the mechanism associated with the relevant provider agreement. Do not use SharpWave where such processing is prohibited for your materials.
10. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may complain to a competent privacy authority. Identity and authority must be verified before a request is fulfilled. Some requests may be limited by lawful retention or another party’s rights.
11. Children
SharpWave is a business service and is not directed to children. Do not create an account or submit personal information if you are under 18.
12. Changes and contact
Material changes will be shown by a new effective date and, where required, a notice before they take effect. Privacy questions and rights requests may be sent to support@sharpwaver.com. Do not include passwords, API keys or full payment-card details.