DRAFT — for lawyer review. Not yet in force.
Privacy Policy
DRAFT — for lawyer review. Not in force. Written from the product spec (§4 architecture, §5 PII rules, §9). Lawyer to confirm GDPR/UK GDPR roles, a DPA for EU/UK business buyers, and California (CCPA/CPRA) wording.
Last updated: 18 October 2026
Who controls your data
- Nathan Brown, operating SOPleased. Contact: hello@sopleased.com.
- Stripe (through its Link service) is merchant of record and controls payment data (card details, billing address, tax information) under its own privacy policy. We never see your card number.
What we collect
| Data | Why | Kept |
|---|---|---|
| Email address | Sign-in links, receipts, product emails | While your account exists |
| Waitlist email | Telling you when sales open | Until you unsubscribe or the round closes plus 12 months. Lawyer to confirm |
| Purchase record from Stripe (Checkout Session and payment IDs, email, tier, amount before tax, currency) | Licence, refunds, tax records | As required by law. Lawyer to confirm period |
| Task text, SOPs, scripts, videos, PDFs | Providing the service | While your account exists; files not opened for 12 months are archived (plan kept, video re-made free on request) |
| Company name and logo | Branding your videos and PDFs | While your account exists |
| Account events (purchases, refunds, admin actions) and server error logs | Running the service, fixing bugs | Lawyer to confirm period |
People who use a training link
- When you send a training link, the people who open it type their own name, and at the end their initials. We store that name and those initials, their answers to the check questions, how much of each video they played, and when they started and finished. We do not ask for or store their email address, IP address or any device fingerprint. Their browser keeps a random code so they can carry on where they left off; we store only a scrambled (hashed) copy of it. You, the buyer, control these records: you can see them, export them, and delete one row, a whole training, or everything by deleting your account, and we delete them with your account. You are responsible for telling your staff that their name and results are recorded when they use the link.
What we do not want
- Personal information about your staff, guests, patients, students or customers in task text. Do not put it there. We automatically remove emails, phone numbers, street addresses and links before processing, and scan outputs for emails and phone numbers.
Who processes data for us
| Provider | Role |
|---|---|
| Stripe (Link) | Payments, tax, receipts and invoices, fraud checks, disputes |
| Anthropic | AI writing of plans (task text after scrubbing) |
| Railway | App and render servers, database, video and PDF storage |
| Mailgun by Sinch | Email delivery |
- Lawyer to confirm: international transfer mechanism for each, and the sub-processor list for the DPA.
We do not
- Sell personal data.
- Use your task text or videos to train AI models. Lawyer to confirm this matches Anthropic's commercial API terms at launch.
Your rights
- Access, correct, export or delete your data from your account page, or by writing to hello@sopleased.com.
- Delete account removes your videos, PDFs and plans. Purchase records are kept as the law requires.
Cookies
- A sign-in cookie (needed), and a short-lived security cookie during "Continue with Google" sign-in. No analytics or advertising cookies. Lawyer to confirm banner requirements.