Who we are

SleuthX is a product of SleuthX, Inc., a Delaware C-corporation headquartered at 7132 Lily Way, Naples, FL 34114, US. For privacy questions or to exercise your rights under the laws referenced below, contact us at quinn@sleuthx.ai.

What this policy covers

This policy applies to https://sleuthx.ai and the SleuthX AI agent (marketed as the SleuthX AI investigator, when launched), including the waitlist, paid reservation flow, and any related communications or services we provide directly to you. It does not cover third-party sites we link to. Those sites have their own policies.

Information we collect

We collect information in three ways: information you give us directly, information collected automatically when you use the site, and information we receive from third-party services we use to run the company.

Information you give us

Waitlist signups: email address, optional name, tier preference, optional incident type, and any free-form notes you write in the form.
Paid reservations: the above plus payment-method details collected by Stripe (Stripe handles your full card number and we never see or store it).
Direct contact: any email you send to quinn@sleuthx.ai, voicemail you leave on (239) 241-8095, or message you submit through Calendly when scheduling a consultation.

Information collected automatically

Analytics: Google Analytics 4 (measurement ID G-5SPMWN01EP) records anonymized session data such as pages viewed, referring URL, approximate location (city level), device type, and time on site. IP addresses are anonymized before storage. Analytics runs under Google Consent Mode v2. See Advertising and conversion measurement below.
Session replay (Microsoft Clarity): on most pages we record a masked replay of the pages you view, where you scroll, and where you click, so we can see where the site is confusing or slow. It runs in strict masking mode: the text you read and anything you type are hidden before the recording leaves your browser, so a replay shows layout and interaction, not readable content or form entries. Microsoft provides Clarity and acts as an independent controller of this data under its own privacy statement. Replay follows the same consent and Global Privacy Control rules as our analytics, and we do not record it on our domestic-violence, stalkerware, and related safety pages or on the pages that lead into them. You can turn it off any time with the Privacy choices control on every page.
Server logs: our hosting provider Vercel logs request metadata (IP, user-agent, timestamp, URL) for 30 days for security and debugging.
Cookies: session cookies for navigation, GA4 analytics cookies, and Stripe payment cookies during checkout. With your consent we also set two first-party cookies on sleuthx.ai: sx_consent (remembers your accept/decline choice) and sx_click (the Google Ads click identifier, used only to measure whether an ad led to a sale, described under Advertising and conversion measurement below). Microsoft Clarity, when active, sets its own first-party cookies (_clck, _clsk) and third-party cookies (MUID, CLID, ANONCHK) to tie a masked replay together. We do not use advertising cookies that track you across other sites.

Advertising and conversion measurement

We advertise on Google Ads and measure which ads lead to real outcomes. This uses Google's tag (the same gtag.js that powers our analytics) plus a small amount of server-side measurement. We have designed it to share as little as possible:

Consent Mode v2: ad and analytics measurement runs under Google Consent Mode. Outside the EEA and UK it is on by default; in the EEA and UK it stays off until you accept through our cookie banner. You can change your choice or opt out entirely at any time using the Privacy choices control shown on every page.
Global Privacy Control: if your browser sends the GPC signal, we treat it as an opt-out and keep ad measurement off, regardless of region.
Click identifier (sx_click cookie): when you arrive from a Google ad, Google appends a click identifier (a gclid) to the link. With your consent we store it in a first-party cookie on sleuthx.ai for up to 90 days. It is not used to track you across other websites.
Server-side conversion upload: if you later make a purchase, our payment server tells Google Ads that the ad led to a sale. We send Google only the click identifier and the sale amount. Your name, email address, phone number, and any other personal information are never sent. We do not upload customer data to Google.

How we use it

To respond to inquiries and schedule consultations.
To send launch updates and product news to people who joined the waitlist.
To process payments for paid reservations and (post-launch) subscriptions.
To improve the site and the product (aggregated, non-identifying analytics).
To comply with legal obligations and protect against fraud or abuse.

Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do send Google Ads a conversion signal made up of the ad click identifier and the sale amount, with no personal information (see Advertising and conversion measurement above). We share limited information with the service providers that run the company:

Vercel hosts the website and runs the API. It sees request metadata and form submission contents in transit.
Stripe processes payments. It receives your name, email, and payment-method details for the purpose of charging your subscription.
Google Analytics receives anonymized session data. We have IP anonymization enabled and we have signed Google's data-processing terms.
Microsoft Clarity receives the masked session replay described above (layout and interaction, with the text you read and anything you type hidden). Microsoft acts as an independent controller of this data under its own privacy statement.
Google Ads receives a conversion signal when an ad leads to a sale, holding the ad click identifier (gclid) and the purchase amount only. We do not send your name, email, phone number, or other personal information to Google Ads.
GitHub holds the waitlist signups in a repository we use as our internal CRM. The repository is private and access-controlled to the three-person team plus the founder.
Calendly receives your name, email, and any notes you provide when you schedule a consultation, so we can run the meeting.
Email service carries outbound email about your account or the launch, sent via Microsoft 365 or a transactional email provider (currently Resend, subject to change).

We may also disclose information if required by law (subpoena, court order, valid government request) or to protect against fraud or abuse. If a disclosure is legally permitted to be challenged, we will challenge overbroad requests and notify the affected user before complying when not legally prohibited from doing so.

How long we keep it

Waitlist signups: retained until launch and for up to 24 months after, so we can honor your introductory pricing commitment. Deleted on request before then.
Paid reservation / subscription records: retained for the active duration of your subscription plus 7 years for tax and accounting compliance.
Server logs: 30 days, then automatically purged by Vercel.
Analytics: retained per Google's default GA4 retention (currently 14 months) and not personally identifying.
Session replay (Clarity): retained by Microsoft under its own retention policy for Clarity and not used to identify you.

Your rights

Regardless of where you live, you can email quinn@sleuthx.ai to:

Request a copy of the information we have about you.
Ask us to correct information that is wrong.
Ask us to delete your information (subject to our legal retention requirements).
Withdraw consent for marketing emails (also via the unsubscribe link in any email).

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, the right to delete it, the right to correct it, the right to opt out of any "sale" or "sharing" for cross-context behavioral advertising (we do neither), and the right not to be discriminated against for exercising these rights. We honor the Global Privacy Control (GPC) browser signal as an opt-out, and the Privacy choices control on every page lets you turn off ad measurement at any time. To exercise any of these, email quinn@sleuthx.ai with "CCPA Request" in the subject line. We will respond within 45 days.

EU and UK residents (GDPR / UK GDPR)

Our lawful bases for processing are: (a) consent for marketing communications, (b) contract for fulfilling paid subscriptions, (c) legitimate interest for site security, fraud prevention, and improving the product. You have the rights of access, rectification, erasure, restriction, portability, and objection. You can lodge a complaint with your local supervisory authority. We do not currently maintain an EU representative, so for any GDPR matter contact quinn@sleuthx.ai directly.

Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, or any other US state with a consumer privacy law, you generally have rights similar to those above. Email us with the name of your state law and we will treat your request accordingly.

Children

The site and the SleuthX product are not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has submitted information to us, contact quinn@sleuthx.ai and we will delete it.

Security

We use industry-standard transport encryption (TLS 1.2+) for all traffic to the site and to our service providers. Stripe is PCI-DSS Level 1 certified. Our internal CRM repository (where waitlist signups land) is private and access-controlled. We do not claim absolute security, because no system is unbreakable, but we apply the same incident response and forensic discipline to our own systems that we apply to client engagements.

International transfers

We are based in the United States. If you are using the site from outside the US, your information will be transferred to and processed in the US. By using the site you consent to that transfer. Stripe and Google Analytics rely on standard contractual clauses for their own international transfers from the EU.

Changes to this policy

We may update this policy as the product evolves. Material changes will be announced on the site and (for waitlist members and subscribers) by email at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

For any privacy question, request, or complaint, contact:
SleuthX, Inc.
7132 Lily Way, Naples, FL 34114
Email: quinn@sleuthx.ai
Phone: (239) 241-8095