Archived version. This is the Privacy Policy as published on 2026-10-21, kept unchanged for the record. The current version is at /privacy.

Who we are

SleuthX is a product of SleuthX, Inc., a Delaware C-corporation headquartered at 7132 Lily Way, Naples, FL 34114, US. For privacy questions or to exercise your rights under the laws referenced below, contact us at quinn@sleuthx.ai.

What this policy covers

This policy applies to https://sleuthx.ai and the SleuthX AI agent (marketed as the SleuthX AI investigator, when launched), including the waitlist, paid reservation flow, and any related communications or services we provide directly to you. It does not cover third-party sites we link to. Those sites have their own policies.

Information we collect

We collect information in three ways: information you give us directly, information collected automatically when you use the site, and information we receive from third-party services we use to run the company.

Information you give us

Waitlist signups: email address, optional name, tier preference, optional incident type, and any free-form notes you write in the form.
Paid reservations: the above plus payment-method details collected by Stripe (Stripe handles your full card number and we never see or store it).
Direct contact: any email you send to quinn@sleuthx.ai, voicemail you leave on (239) 241-8095, or message you submit through Calendly when scheduling a consultation.

Information collected automatically

Analytics: Google Analytics 4 (measurement ID G-5SPMWN01EP) records anonymized session data such as pages viewed, referring URL, approximate location (city level), device type, and time on site. In Google Analytics, IP addresses are anonymized before storage. The engagement-letter press records described below keep the full IP address. Analytics runs under Google Consent Mode v2. See Advertising and conversion measurement below.
Session replay (Microsoft Clarity): on most pages we record a masked replay of the pages you view, where you scroll, and where you click, so we can see where the site is confusing or slow. It runs in strict masking mode: the text you read and anything you type are hidden before the recording leaves your browser, so a replay shows layout and interaction, not readable content or form entries. One exception: on our advertising landing pages (addresses beginning /lp/) we leave our own header, button and link labels readable, so we can tell which control a visitor tried to use. Everything else on those pages stays hidden, including the answers you choose in the cost estimator and anything you type. Microsoft provides Clarity and acts as an independent controller of this data under its own privacy statement. Replay follows the same consent and Global Privacy Control rules as our analytics, and we do not record it on our domestic-violence, stalkerware, and related safety pages or on the pages that lead into them. You can turn it off any time with the Cookie settings link at the foot of every page. When you press an engagement-letter button we tag the replay with the random reference described below.
Engagement-letter button presses: When you press a button that opens one of our DocuSign engagement letters, we record that press on our own servers. The record holds:
- the letter and price you chose;
- the page you were on, the page you first arrived at on this visit and on your first visit, the website that referred you, any campaign tags in the link, and the pages you viewed during this visit;
- your IP address and the approximate location our hosting provider derives from it (country, region, city, postal code and map coordinates, which locate the network you are using, not your street address);
- your device and browser details: browser and operating system, the detailed browser hints some browsers provide (such as device model and platform version), screen and window size, input type, languages and time zone;
- whether you had accepted or declined on our cookie banner;
- the Google Ads click identifier, if you arrived from an ad;
- a random reference that also tags your session replay in Microsoft Clarity, so we can find the replay that goes with the press.
We keep these records indefinitely. We do not record presses on our domestic-violence, stalkerware and related safety pages, and pages from those sections are never written into the record of pages you viewed.
Server logs: our hosting provider Vercel logs request metadata (IP, user-agent, timestamp, URL) for 30 days for security and debugging.
Cookies: session cookies for navigation, GA4 analytics cookies, and Stripe payment cookies during checkout. We also set two first-party cookies on sleuthx.ai: sx_consent, which remembers your accept or decline choice once you make one, and sx_click, the Google Ads click identifier (when it is set is described under Advertising and conversion measurement below). Microsoft Clarity, when active, sets its own first-party cookies (_clck, _clsk) and third-party cookies (MUID, CLID, ANONCHK) to tie a masked replay together. We do not use advertising cookies that track you across other sites.

Advertising and conversion measurement

We advertise on Google Ads and measure which ads lead to real outcomes. This uses Google's tag (the same gtag.js that powers our analytics) plus a small amount of server-side measurement. We have designed it to share as little as possible:

Consent Mode v2: Google's analytics and advertising cookies and Microsoft Clarity run under Google Consent Mode. Outside the EEA and UK they are on by default; in the EEA and UK they stay off until you accept through our cookie banner. You can change your choice at any time with the Cookie settings link at the foot of every page. In the United States, declining does not stop the click-identifier measurement described below.
Global Privacy Control: if your browser sends the GPC signal, we treat it as an opt-out of Google's analytics and advertising cookies and of session replay, in every region. Outside the EEA and UK, it does not stop us from storing the Google Ads click identifier or sending it to Google Ads to measure a sale or enquiry.
Click identifier (sx_click cookie): when you arrive from a Google ad, Google appends a click identifier (a gclid) to the link. Outside the EEA and UK we store it in a first-party cookie on sleuthx.ai for up to 90 days whether or not you accept our cookie banner, and it may be sent to Google Ads as described in the next item. In the EEA and UK we store it only if you accept. The same cookie also records which page of our site you first landed on and the number of the ad campaign you came from. We keep these so that a visit which began on one of our safety or crisis pages is never reported to Google, and visiting one of those pages deletes the cookie. It is not used to track you across other websites.
Server-side conversion upload: if you later make a purchase, or send us an enquiry after arriving from one of our ads, our server tells Google Ads that the ad led to a result. We send Google only the click identifier and a value: the sale amount, or for an enquiry an average estimated value that is the same for every enquiry. Your name, email address, phone number, the content of your message, and any other personal information are never sent. We do not upload customer data to Google. When you start an engagement letter from our site, we give DocuSign a random reference (not your click identifier) and keep it with your signed letter and with the press record described above. If you arrived from an ad, our server uses it to tell Google Ads which ad led to a signed, paid engagement; Google still receives only the click identifier and the amount.

How we use it

To respond to inquiries and schedule consultations.
To send launch updates and product news to people who joined the waitlist.
To process payments for paid reservations and (post-launch) subscriptions.
To improve the site and the product (aggregated, non-identifying analytics).
To comply with legal obligations and protect against fraud or abuse.

Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do send Google Ads a conversion signal made up of the ad click identifier and a value, with no personal information (see Advertising and conversion measurement above). We share limited information with the service providers that run the company:

Vercel hosts the website and runs the API. It sees request metadata and form submission contents in transit.
Stripe processes payments. It receives your name, email, and payment-method details for the purpose of charging your subscription.
Google Analytics receives anonymized session data. We have IP anonymization enabled and we have signed Google's data-processing terms.
Microsoft Clarity receives the masked session replay described above (layout and interaction, with the text you read and anything you type hidden). Microsoft acts as an independent controller of this data under its own privacy statement.
Google Ads receives a conversion signal when an ad leads to a sale or an enquiry, holding the ad click identifier (gclid) and a value only. We do not send your name, email, phone number, or other personal information to Google Ads.
GitHub holds the waitlist signups in a repository we use as our internal CRM. The repository is private and access-controlled to the three-person team plus the founder.
Calendly receives your name, email, and any notes you provide when you schedule a consultation, so we can run the meeting.
Email service carries outbound email about your account or the launch, sent via Microsoft 365 or a transactional email provider (currently Resend, subject to change).

We may also disclose information if required by law (subpoena, court order, valid government request) or to protect against fraud or abuse. If a disclosure is legally permitted to be challenged, we will challenge overbroad requests and notify the affected user before complying when not legally prohibited from doing so.

How long we keep it

Waitlist signups: retained until launch and for up to 24 months after, so we can honor your introductory pricing commitment. Deleted on request before then.
Paid reservation / subscription records: retained for the active duration of your subscription plus 7 years for tax and accounting compliance.
Server logs: 30 days, then automatically purged by Vercel.
Analytics: retained per Google's default GA4 retention (currently 14 months) and not personally identifying.
Session replay (Clarity): retained by Microsoft under its own retention policy for Clarity and not used to identify you.

Your rights

Regardless of where you live, you can email quinn@sleuthx.ai to:

Request a copy of the information we have about you.
Ask us to correct information that is wrong.
Ask us to delete your information (subject to our legal retention requirements).
Withdraw consent for marketing emails (also via the unsubscribe link in any email).

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, the right to delete it, the right to correct it, the right to opt out of any "sale" or "sharing" for cross-context behavioral advertising (we do neither), and the right not to be discriminated against for exercising these rights. We honor the Global Privacy Control (GPC) browser signal as an opt-out of Google's analytics and advertising cookies and of session replay, and the Cookie settings link at the foot of every page turns them off at any time; neither stops the click-identifier measurement described under Advertising and conversion measurement. To exercise any of these, email quinn@sleuthx.ai with "CCPA Request" in the subject line. We will respond within 45 days.

EU and UK residents (GDPR / UK GDPR)

Our lawful bases for processing are: (a) consent for marketing communications, (b) contract for fulfilling paid subscriptions, (c) legitimate interest for site security, fraud prevention, and improving the product. You have the rights of access, rectification, erasure, restriction, portability, and objection. You can lodge a complaint with your local supervisory authority. We do not currently maintain an EU representative, so for any GDPR matter contact quinn@sleuthx.ai directly.

Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, or any other US state with a consumer privacy law, you generally have rights similar to those above. Email us with the name of your state law and we will treat your request accordingly.

Children

The site and the SleuthX product are not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has submitted information to us, contact quinn@sleuthx.ai and we will delete it.

Security

We use industry-standard transport encryption (TLS 1.2+) for all traffic to the site and to our service providers. Stripe is PCI-DSS Level 1 certified. Our internal CRM repository (where waitlist signups land) is private and access-controlled. We do not claim absolute security, because no system is unbreakable, but we apply the same incident response and forensic discipline to our own systems that we apply to client engagements.

International transfers

We are based in the United States. If you are using the site from outside the US, your information will be transferred to and processed in the US. By using the site you consent to that transfer. Stripe and Google Analytics rely on standard contractual clauses for their own international transfers from the EU.

Changes to this policy

We may update this policy as the product evolves. Material changes will be announced on the site and (for waitlist members and subscribers) by email at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact

For any privacy question, request, or complaint, contact:
SleuthX, Inc.
7132 Lily Way, Naples, FL 34114
Email: quinn@sleuthx.ai
Phone: (239) 241-8095