Privacy Policy

This Privacy Policy describes how MagnaMente LLC (“MagnaMente,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use the SawItOn service at https://sawiton.ai and related services (the “Service”). MagnaMente LLC’s website is https://magnamente.com. It should be read with our Terms of Service.

For personal information subject to the EU/UK GDPR, MagnaMente LLC is the controller of account and platform data. Advertisers may act as independent controllers of information they submit about their campaigns and of business contacts they invite. Stripe, social networks, and AI providers are independent controllers or processors of data you share with them under their own policies.

Contact: privacy@magnamente.com. If we appoint a data-protection officer or EU/UK representative, we will publish those details on this page.

Account and profile. Email address; name; role (advertiser, creator, or platform admin); business name, website, industry, and product/service description; creator channel name, bio, location, public social URLs, contact email and phone, and confirmation timestamps.

Authentication. We use passwordless magic-link login by default. You may optionally set a password; we store only a one-way hash of that password, never the plaintext. You may also sign in with Google (OpenID Connect); we receive your Google email, name, and profile image when you consent. We store the email, session tokens, linked OAuth account ids, and verification timestamps. Advertisers and creators may generate MCP agent tokens. We store a one-way hash, a display prefix, a label, and last-used time — not the raw token.

Campaign and marketplace data. Briefs, assets you upload, budgets, dates, contracts and electronic signatures, award and invite records, invoices, payout claims, notifications, and feedback messages.

Social connections. If a creator connects a network (YouTube, Instagram, or X), we receive OAuth tokens, account identifiers, display names, and scopes granted. We use that access to retrieve public or permitted performance metrics (such as views, likes, comments, and watch time) for creative URLs the creator submits. Tokens are encrypted at rest. We reuse a healthy connection and re-prompt only if access is revoked or refresh fails.

Attribution. Referral clicks on https://sawiton.ai/[channel] may store a one-way hash of the visitor’s IP address, a truncated user-agent string, timestamp, and campaign identifiers. We do not use this to sell advertising profiles to third parties. Submitted creative URLs may be fetched and analyzed with AI (including sampled video frames via DeepInfra and audio via RunPod) to estimate whether a sponsor moment appears. Those results are suggestions until reviewed.

Payments. Stripe collects payment-method and payout-account information. We store Stripe customer, subscription, invoice, and Connect account identifiers and status, not full card numbers.

Location and expansion waitlist. Our host may provide the country of your connection so we can show a registration notice that billing and payouts need a US payment method. If you are outside the United States, you may optionally join an expansion waitlist with your name, email, and optional comments. We store those fields and the country code so we can contact you if the Service expands. We do not store the full IP address on that waitlist. Joining the waitlist is separate from creating an account.

Technical data. Server logs (IP address, device/browser, timestamps, and error traces) for security, debugging, and operations. Sentry receives error reports and a sample of performance traces from the Service so we can monitor reliability. Session cookies or equivalent are required to keep you logged in.

Bot protection. We use Cloudflare Turnstile on account signup to tell humans from bots. When demo sign-in is shown, we also use it on that form. Cloudflare processes limited technical signals for this check; see Cloudflare’s privacy documentation for details.

Platform AI configuration. Administrators may save a provider URL, model name, and API key used for all tenants. Keys are encrypted at rest and are not returned to the browser after save.

We use personal information to:

• Provide, maintain, and secure the Service, including login, campaigns, contracts, payouts, and optional MCP agent access.
• Match advertisers with creators, generate suggested copy and contract terms, and score attribution.
• Process subscriptions, campaign charges, invoices, and creator payouts via Stripe.
• Send transactional email (login links, award invites, revocation notices, invoices, contact codes).
• Prevent fraud, abuse, and inflated attribution; enforce the Terms; and comply with law.
• Respond to feedback and improve the Service, using aggregated or de-identified data where practical.
• Show payment-method availability notices and contact people who join the optional expansion waitlist.

MagnaMente does not use your content (including briefs, assets, messages, prompts, or campaign materials) to train foundation models. “Improve the Service” means operating and improving product features and reliability (for example analytics, quality, and safety) — not training foundation models on customer content.

Legal bases under GDPR (where it applies) include: performance of a contract (Art. 6(1)(b)); legitimate interests in operating a secure marketplace and measuring campaigns (Art. 6(1)(f)); consent where we ask for it (Art. 6(1)(a)), including certain OAuth scopes; and legal obligation (Art. 6(1)(c)) for tax and accounting records.

We share information with:

• The other party to a deal. Advertisers see awarded creator profile, contact-confirmation status, and campaign metrics. Creators see campaign briefs, brand name, contracts, and payout status.
• Processors. These providers process personal information to run the Service:
  • Vercel — hosting the Service, including sawiton.ai and its DNS.
  • Google Cloud — Cloud SQL (the database), Cloud Storage (uploaded files, branding, contract PDFs, and attribution media), and Compute Engine (background jobs, including attribution processing).
  • Loops.so — transactional email, including login links, award and revocation notices, invoices, and contact-confirmation messages.
  • Stripe — subscription charges, campaign invoices, and creator payouts.
  • Sentry — error and performance monitoring.
  • Cloudflare — Turnstile bot protection on account signup, and on demo sign-in when that option is shown.
  • DeepInfra — hosted vision analysis of sampled creative frames (US data centers; the provider states API prompts are not stored or used for training).
  • RunPod — hosted audio transcription of creatives for attribution (Whisper).
  • Other AI providers that process prompts so we can operate discovery, drafting, and scoring, as described in section 11.
• Social platforms when a creator initiates OAuth; those platforms receive the fact of connection and operate under their own policies.
• Professional advisors and authorities when required by law, to protect rights and safety, or in a merger, financing, or sale of assets (with appropriate confidentiality).

We do not sell personal information as “sale” is defined in the California Consumer Privacy Act (CCPA/CPRA), and we do not share it for cross-context behavioral advertising. We do not use referral hashes to retarget visitors on other sites.

We use strictly necessary cookies or local session storage to keep you authenticated and to protect against CSRF. We use Cloudflare Turnstile on account signup, and on demo sign-in when that option is shown, to tell humans from bots. Cloudflare processes limited technical signals for that check. We do not currently run third-party advertising pixels on the Service. If that changes, we will update this Policy and, where required, request consent.

We keep account and contract records for the life of the account and for a period afterward as needed for disputes, tax, and legal holds (typically up to seven years for financial records, or longer if the law requires). Attribution hashes and logs are kept only as long as needed for reporting and security. Disconnecting a social account deletes or encrypts-at-rest tokens we no longer need; residual backups expire on our backup cycle.

We use HTTPS, encrypted storage of OAuth tokens and the platform AI key, hashed referral IPs, hashed confirmation codes, and role-based access to tenant data. No method of transmission or storage is 100% secure. You can reduce risk by protecting your email inbox, password (if set), and Google account used for login.

We may process information in the United States and other countries where our providers operate. Where GDPR requires a transfer mechanism, we rely on adequacy decisions or Standard Contractual Clauses with processors, plus supplementary measures as appropriate.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information; to object to or restrict certain processing; to withdraw consent (without affecting prior lawful processing); and to appeal a denial of a consumer request.

GDPR. You may also lodge a complaint with your supervisory authority. We honor data-subject requests as required after we verify the request (typically via the account email).

US state privacy laws (including CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, and similar). You may request to know, delete, or correct personal information, and to opt out of sale or sharing (we do not sell or share as defined above). We will not discriminate against you for exercising these rights. You may use an authorized agent as permitted by law. We do not use sensitive personal information for inferring characteristics beyond operating the Service.

Right to erasure / account deletion. You can delete your account in the Service without emailing us: advertisers use Team → Delete account; creators use Profile → Delete account. You must type DELETE to confirm. Deletion removes your user record, sessions, linked OAuth login accounts, influencer profile and social connection tokens, notifications, feedback you submitted, and agent tokens. If you are the sole advertiser on a workspace, we also delete that workspace and its campaigns. Contract PDFs and financial records may be retained in de-identified or legally required form. Stripe may retain payment records under its own retention rules. You may also email privacy@magnamente.com from your account address, or use Feedback after login, for access, correction, or deletion requests we cannot complete in-product. We will respond within the time required by applicable law (generally 30–45 days, extendable as permitted).

The Service is for users 18 and older. We do not knowingly collect personal information from children. If you believe a child provided information, contact privacy@magnamente.com and we will delete it.

Creator discovery and scoring are automated to rank prospects. They do not by themselves produce legal or similarly significant effects solely without human award decisions by the advertiser. AI analysis of user-generated content produces preliminary estimates—confirm them when you review. You may contest or request human review of an automated output that you believe is inaccurate by contacting us or using Feedback.

AI processing and model training. MagnaMente does not use your content to train foundation models. We may send prompts, briefs, assets, and related inputs to third-party AI and media-analysis providers so we can operate features such as discovery, drafting, scoring, and attribution analysis. Those providers process data under their commercial API or processor terms. Vision analysis uses DeepInfra (US data centers; DeepInfra states prompts are not stored or used for training). Audio transcription uses RunPod. For the commercial APIs we use, providers state that they do not use API customer content to train foundation models by default (except where we or you explicitly opt in). Some providers may retain inputs briefly for abuse monitoring or safety unless a separate zero-retention arrangement is enabled. “Improving the Service” in this Privacy Policy means operating and improving product features and reliability — not training foundation models on your content.

Do not upload special-category data or secrets you are not authorized to share.

We may update this Policy as the Service or the law changes. The “Last updated” date will change. Material changes will be posted here or emailed to your account address. Continued use after the effective date means you accept the updated Policy, except where the law requires opt-in consent.

Privacy requests: privacy@magnamente.com
Legal: legal@magnamente.com
MagnaMente LLC: https://magnamente.com
Service: https://sawiton.ai