1. Overview
Siftglow is an evidence-led social-listening service for independent SaaS founders. This Privacy Policy describes how Siftglow may process personal data when the service and the features described below are enabled and used. It does not state that any provider integration, public-data source, payment service, or production feature is currently live.
2. Data Siftglow may process
Depending on the feature you use, Siftglow may process:
- account and identity data needed to create, secure, and administer an account, including data supplied through the sign-in provider;
- product URLs, Project names and settings, keywords, rules, review decisions, and other content you choose to submit;
- public Reddit and X content within an enabled and permitted source scope, including public post content, public display names, timestamps, permalinks, and excerpts. Siftglow is not intended to read private messages, direct messages, or other private-area content;
- AI-generated inferences, summaries, unknowns, suggested actions, reports, and follow-up drafts. These are assistive outputs and may be inaccurate;
- service-use, action, idempotency, security, and audit information needed to operate, protect, investigate, and improve the service;
- limited attribution data: opaque tracking-link and click tokens, an opaque visitor identifier stored as a hash, click or trial-start times, a hashed IP prefix, and a truncated user-agent family. The attribution event interface is designed not to accept email address, name, company, revenue, payment status, or card data;
- billing and subscription status received from Waffo when payment features are enabled. Waffo processes payment-card and payment-method data; Siftglow does not store card numbers.
3. How Siftglow uses data
Siftglow may use this data to provide and secure the service, create and manage Projects, retrieve permitted public-source evidence, create reviewable opportunities and drafts, operate attribution, administer subscriptions, respond to support requests, enforce usage and security controls, maintain audit records, comply with applicable law, and protect Siftglow, users, and others from misuse.
Siftglow does not sell personal data, serve advertising based on personal data, or use the service to profile sensitive traits. It does not use private messages or private-area content as a source for the product.
4. Processing roles
Depending on the relationship and applicable law, Siftglow determines why and how it processes account, authentication, security, billing-status, and service-operation data. For Project settings and other customer-submitted content processed only to provide the customer's private workspace, Siftglow processes that content only for the service purposes described here, the customer's instructions, and applicable legal or platform requirements.
Siftglow does not own Reddit or X, does not control those platforms, and does not acquire ownership of third-party posts or comments. The originating platform's terms and the rights of the original author continue to apply. Mandatory legal roles and rights prevail where applicable law assigns them differently.
5. Service providers and external sources
Siftglow limits each service to the data needed for its stated role. Reddit and X are external content sources, not subprocessors acting on Siftglow's instructions.
| Service or source | Purpose | Data boundary | Status |
|---|---|---|---|
| Sign-in identity provider through Supabase | OAuth identity and verified email needed for account access | Enabled for Google sign-in | |
| Supabase | Authentication, authorization, application database, and storage | Account and service data required for the authenticated workspace | Enabled |
| Vercel | Application hosting and delivery | Hosted application content and routine request or diagnostic data | Enabled |
| DeepSeek | Product-page snapshot analysis and keyword suggestions | Submitted product-page content; no Reddit or X content | Enabled only for the product URL workflow |
| Resend | Limited security or required transactional email | Recipient, message content, and delivery metadata needed for that email | Used only when email delivery is enabled |
| Waffo | Merchant-of-record payment services | Checkout, payment, tax, receipt, refund, and chargeback data handled under Waffo's terms | Provider-pending; paid checkout is not represented as enabled |
| Reddit and X | Permitted public-source evidence | Only an approved public scope and the minimum fields described in Platform Data Use | Provider-pending; no live collection |
The current DeepSeek integration receives product-page content supplied through the product URL workflow so Siftglow can generate a product summary and keyword suggestions. Siftglow does not currently send Reddit or X content to DeepSeek. Platform content will not be sent to an external model provider unless the relevant platform permission and processor terms allow that use and this policy is updated to identify the processing boundary.
Waffo may act as merchant of record for paid subscriptions when that payment flow is enabled. Waffo, rather than Siftglow, processes payment-method data and may handle payment, tax, receipt, refund, and chargeback functions under its buyer terms. Use of Waffo is not represented here as accepted, configured, or available.
Provider and processing locations may vary and may involve cross-border processing. Where applicable law requires a transfer mechanism or additional safeguard, Siftglow will use the relevant provider only after that requirement is satisfied. A user may contact Siftglow for the then-current processing boundary.
6. Cookies and attribution
Siftglow may use essential cookies or similar technologies needed for sign-in, security, and core service operation.
Separately, if a customer chooses to install Siftglow's attribution script on that customer's own website, the script may place first-party _sg_click and _sg_vid cookies on that customer site for up to 30 days. They contain opaque click and visitor values, are readable by that customer site's registration frontend, and support the customer-requested attribution flow. The script is designed not to read forms, email addresses, names, payment information, or page content. These customer-site attribution cookies are distinct from Siftglow's own essential service cookies.
7. Retention
Siftglow's intended retention rules are:
| Data or state | Intended retention |
|---|---|
| Unactivated onboarding snapshot | Deleted after 7 days |
| Raw extracted product-page text | Deleted 24 hours after Project activation; only the summary is retained |
| Trial account after Trial ends | Read-only for 90 days, then relevant Project content, source evidence, drafts, reports, clicks, and trial records are removed |
| Solo history | Identifying source evidence, authors, permalinks, draft bodies, and opportunity content older than 30 days are removed |
| Builder history, days 1–90 | Identifying source evidence may remain visible |
| Builder history, days 91–180 | Authors, permalinks, excerpts, reply permalinks, and draft bodies are removed; only de-identified daily aggregates, demand scenes/bands, and non-identifying Project metrics remain |
| Builder history after day 180 | Business history above is removed, except necessary billing and security audit records |
| Export file | Deleted 24 hours after it is ready; its signed download URL expires after 15 minutes |
| IP-prefix hash and truncated user-agent family | Deleted after 7 days |
| Security and audit records | Normally retained for 365 days; after account deletion, content-bearing metadata is removed and only necessary hashes/event types may remain for security or billing disputes |
| Account deletion | Online service data is targeted for deletion within 24 hours; backups may persist for up to 7 days |
Upstream deletion or revocation requests take priority over ordinary retention windows. A cancelled account's read-only access period does not extend the Solo or Builder content-retention windows.
8. Your choices and requests
Subject to applicable law, you may ask to access, correct, export, delete, restrict, or object to the processing of your personal data, and withdraw consent where processing relies on consent. You may also disconnect an external AI connection. Siftglow may need to verify the requester before acting on a request.
A deletion request is intended to revoke local AI connections, tracking links, and event secrets promptly, stop future scans, and remove online account data within the time stated above. Certain limited, de-identified or legally required billing or security records may remain as described above. These rights do not create a right to obtain another person's data or override a lawful retention duty.
9. Security
Siftglow uses reasonable administrative, technical, and organizational measures designed to protect data. No online service can guarantee absolute security.
10. Children
Siftglow is not intended for anyone under 18 years of age. Siftglow does not knowingly seek to collect personal data from children.
11. Changes and contact
This policy is effective September 1, 2026. Siftglow may update it when the service or applicable requirements change, subject to applicable law. Material changes will be communicated through the service or another appropriate channel.
For privacy questions or requests, contact support@siftglow.com.