Privacy Policy

This Privacy Policy describes how SawItOn (“SawItOn,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use https://sawiton.ai and related services (the “Service”). It should be read with our Terms of Service.

For personal information subject to the EU/UK GDPR, SawItOn is the controller of account and platform data. Advertisers may act as independent controllers of information they submit about their campaigns and of business contacts they invite. Stripe, social networks, and AI providers are independent controllers or processors of data you share with them under their own policies.

Contact: privacy@sawiton.ai. If we appoint a data-protection officer or EU/UK representative, we will publish those details on this page.

Account and profile. Email address; name; role (advertiser, creator, or platform admin); business name, website, industry, and product/service description; creator channel name, bio, location, public social URLs, contact email and phone, and confirmation timestamps.

Authentication. We use passwordless magic-link login. We store the email, session tokens, and verification timestamps. We do not store account passwords. Advertisers and creators may generate MCP agent tokens. We store a one-way hash, a display prefix, a label, and last-used time — not the raw token.

Campaign and marketplace data. Briefs, assets you upload, budgets, dates, contracts and electronic signatures, award and invite records, invoices, payout claims, notifications, and feedback messages.

Social connections. If a creator connects a network (YouTube, Instagram, TikTok, X, Facebook, LinkedIn, or Twitch), we receive OAuth tokens, account identifiers, display names, and scopes granted. We use that access to retrieve public or permitted performance metrics (such as views, likes, comments, and watch time) for creative URLs the creator submits. Tokens are encrypted at rest. We reuse a healthy connection and re-prompt only if access is revoked or refresh fails.

Attribution. Referral clicks on https://sawiton.ai/[channel] may store a one-way hash of the visitor’s IP address, a truncated user-agent string, timestamp, and campaign identifiers. We do not use this to sell advertising profiles to third parties. Submitted creative URLs may be fetched and analyzed by hosted vision and audio models to estimate whether a sponsor moment appears. Those outputs are directional.

Payments. Stripe collects payment-method and payout-account information. We store Stripe customer, subscription, invoice, and Connect account identifiers and status, not full card numbers.

Technical data. Server logs (IP address, device/browser, timestamps, error traces) for security, debugging, and operations. Session cookies or equivalent are required to keep you logged in.

Platform AI configuration. Administrators may save a provider URL, model name, and API key used for all tenants. Keys are encrypted at rest and are not returned to the browser after save.

We use personal information to:

• Provide, maintain, and secure the Service, including login, campaigns, contracts, payouts, and optional MCP agent access.
• Match advertisers with creators, generate suggested copy and contract terms, and score attribution.
• Process subscriptions, campaign charges, invoices, and creator payouts via Stripe.
• Send transactional email (login links, award invites, revocation notices, invoices, contact codes).
• Prevent fraud, abuse, and inflated attribution; enforce the Terms; and comply with law.
• Respond to feedback and improve the product, using aggregated or de-identified data where practical.

Legal bases under GDPR (where it applies) include: performance of a contract (Art. 6(1)(b)); legitimate interests in operating a secure marketplace and measuring campaigns (Art. 6(1)(f)); consent where we ask for it (Art. 6(1)(a)), including certain OAuth scopes; and legal obligation (Art. 6(1)(c)) for tax and accounting records.

We share information with:

• The other party to a deal. Advertisers see awarded creator profile, contact-confirmation status, and campaign metrics. Creators see campaign briefs, brand name, contracts, and payout status.
• Processors. Hosting, database, email (Loops.so), payments (Stripe), AI model APIs, and hosted vision/audio inference providers that process data on our instructions.
• Social platforms when a creator initiates OAuth; those platforms receive the fact of connection and operate under their own policies.
• Professional advisors and authorities when required by law, to protect rights and safety, or in a merger, financing, or sale of assets (with appropriate confidentiality).

We do not sell personal information as “sale” is defined in the California Consumer Privacy Act (CCPA/CPRA), and we do not share it for cross-context behavioral advertising. We do not use referral hashes to retarget visitors on other sites.

We use strictly necessary cookies or local session storage to keep you authenticated and to protect against CSRF. We do not currently run third-party advertising pixels on the Service. If that changes, we will update this Policy and, where required, request consent.

We keep account and contract records for the life of the account and for a period afterward as needed for disputes, tax, and legal holds (typically up to seven years for financial records, or longer if the law requires). Attribution hashes and logs are kept only as long as needed for reporting and security. Disconnecting a social account deletes or encrypts-at-rest tokens we no longer need; residual backups expire on our backup cycle.

We use HTTPS, encrypted storage of OAuth tokens and the platform AI key, hashed referral IPs, hashed confirmation codes, and role-based access to tenant data. No method of transmission or storage is 100% secure. You can reduce risk by protecting your email inbox, the only factor used for login.

We may process information in the United States and other countries where our providers operate. Where GDPR requires a transfer mechanism, we rely on adequacy decisions or Standard Contractual Clauses with processors, plus supplementary measures as appropriate.

Depending on where you live, you may have the right to access, correct, delete, or export your personal information; to object to or restrict certain processing; to withdraw consent (without affecting prior lawful processing); and to appeal a denial of a consumer request.

GDPR. You may also lodge a complaint with your supervisory authority. We honor data-subject requests as required after we verify the request (typically via the account email).

US state privacy laws (including CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, and similar). You may request to know, delete, or correct personal information, and to opt out of sale or sharing (we do not sell or share as defined above). We will not discriminate against you for exercising these rights. You may use an authorized agent as permitted by law. We do not use sensitive personal information for inferring characteristics beyond operating the Service.

Email privacy@sawiton.ai from your account address, or use Feedback after login. We will respond within the time required by applicable law (generally 30–45 days, extendable as permitted).

The Service is for users 18 and older. We do not knowingly collect personal information from children. If you believe a child provided information, contact privacy@sawiton.ai and we will delete it.

Creator discovery and scoring are automated to rank prospects. They do not by themselves produce legal or similarly significant effects solely without human award decisions by the advertiser. Hosted analysis of user-generated content produces directional estimates. You may contest or request human review of an automated output that you believe is inaccurate by contacting us or using Feedback.

Prompts and assets sent to model providers may be processed under those providers’ data-processing terms. Do not upload special-category data or secrets you are not authorized to share.

We may update this Policy as the Service or the law changes. The “Last updated” date will change. Material changes will be posted here or emailed to your account address. Continued use after the effective date means you accept the updated Policy, except where the law requires opt-in consent.

Privacy requests: privacy@sawiton.ai
Legal: legal@sawiton.ai
Service: https://sawiton.ai