> Fetch the complete documentation index at: https://sopwow.com/llms.txt

---
title: "Privacy Policy | SopWow"
description: "How SopWow collects, redacts, uses, shares, and deletes personal data, including website analytics and ads, and your rights in the US and Canada."
url: https://sopwow.com/privacy
---

*Privacy policy*

# What data does SopWow collect, and what do we do with it?

> **Quick answer:** SopWow collects account details, the steps you record in the browser tab where you start a recording (which button, which field, which page, not what you type into fields), your answers to its questions, and the SOPs you approve. Data with a recognizable shape is redacted in your browser before text is sent to an AI model. Screenshots are never sent to an AI model. On the public website, and only with your consent, analytics and advertising trackers collect data about your visit. California law treats the advertising part as selling or sharing personal information, and you can opt out at any time. We never sell or share your workspace content. You can export or delete your SOPs.

This policy explains how SopWow ("SopWow", "we", "us") handles personal data when you visit sopwow.com, use the SopWow customer portal, or use the SopWow recorder browser extension and SOP writing service (together, the "Service").

SopWow is an Uncovered product, operated by Uncovered Inc., 5900 Balcones Dr STE 100, Austin, TX 78731. Questions about this policy go to privacy@sopwow.com.

## Who is responsible for the data?

Two different roles apply, depending on the data.

- **Your organization's workspace content.** Recordings, screenshots, answers, drafts, and SOPs belong to the organization that holds the SopWow account (our "customer"). For this content we act on the customer's instructions, as a service provider or processor. If you are an employee recording work for your employer, your employer decides what is recorded and is your first contact for questions about it. Where we derive de-identified data for our own product improvement, as described in "How do we use personal data?", we decide how that de-identified data is used.
- **Account, billing, and website data.** For your account details, billing records, support messages, and website visits, including the data that analytics and advertising trackers collect on sopwow.com, we decide how the data is used and are responsible for it.

## What does the recorder capture, and what does it leave out?

The recorder only runs when a person starts a recording, and only in the browser tab where they started it. The tab shows a "REC" indicator while recording. Other tabs show that they are not being recorded.

While a recording is running, the recorder captures:

- **Element descriptors:** which button, link, field, dropdown, or option was used, described by its label or role on the page.
- **The page:** the page title and address where the step happened.
- **Order and timing:** the sequence of steps, so the procedure is in the right order.
- **Screenshots at each action**, used only to build the visual guide.
- **What you tell it:** the short task description you type before recording, your answers to SopWow's follow-up questions, and your edits during review.

The recorder does **not** capture:

- **The values you type into fields.** It records that you used the "Policy number" field, not the policy number.
- **Tabs where you did not start a recording**, or anything after you stop.
- **Audio, camera, or activity outside the browser.**

## How does redaction work, and what are its limits?

Before any recorded text leaves your browser, SopWow looks for data with a recognizable shape and replaces it with a placeholder. That includes Social Security numbers, payment card numbers, policy numbers, email addresses, phone numbers, and street addresses. The redacted text is what our AI model provider, exports, and sync receive.

Redaction is pattern based, and it can miss things. A client's name in a page heading, an unusual account number format, or text inside a screenshot may not be caught. For that reason:

- Screenshots are never sent to any AI model.
- Every SOP includes a human review, with a redaction check, before it can be approved.
- If you work with especially sensitive data, record with test records or a training environment where you can.

## What other personal data do we collect?

- **Account data:** your name, work email address, organization, and role. We sign you in with a one-time email link, so we do not store a password for you.
- **Recorder connection data:** each recorder is linked to your account with a token. We store only a one-way hash of that token, not the token itself.
- **Usage and metering data:** SOP titles, step counts, approval events, and plan usage, so the portal can show your SOP library and bill correctly. This sync does not include the contents of your SOPs.
- **Billing data:** plan, invoices, and payment status. When card payments are enabled, card details are handled by our payment processor, and we do not store full card numbers.
- **Support data:** what you send when you email hello@sopwow.com.
- **Website data:** our hosting provider records standard server logs (IP address, browser type, page requested, time) to deliver and secure the site. If you allow analytics or advertising cookies, the trackers described in "How do we use analytics and advertising on sopwow.com?" also collect data about your visit. See the [cookie policy](https://sopwow.com/cookies) for exactly what is stored in your browser.

## How do we use personal data?

We use it to:

- **Provide the Service:** turn recordings into draft SOPs, ask follow-up questions, show drafts for review, produce exports, and keep your library.
- **Run your account:** sign-in, workspace membership, plan limits, and billing. A SOP counts toward your plan only when someone in your organization approves it.
- **Support you** and answer your questions.
- **Keep the Service secure:** detect abuse, investigate problems, and protect accounts.
- **Improve the Service** using content-free usage signals, such as how many drafts are approved or rejected, and de-identified data, as described below.
- **Meet legal obligations.**

**Your content and product improvement.** Your organization keeps all rights in its content: its SOPs, recordings, screenshots, and its own procedures. We use that content only to provide, maintain, support, and secure SopWow for you, and that permission ends when your agreement ends, apart from finishing deletion, legal retention, or an export you asked for. We do not use the content itself, including SOP text, screenshots, recordings, prompts, or outputs, as training input for AI models. We do not disclose or reuse your SOPs or your organization's specific procedures for other customers.

What we do use to improve SopWow:

- **Content-free usage signals**, such as counts of drafts, approvals, and exports.
- **De-identified data** that we derive by generalizing and combining information across multiple customers, so that it does not identify you or reveal your specific procedures. We use it, during and after your subscription, to run, secure, and improve SopWow, including training models and building general SOP templates that new users can start from. We will not try to re-identify it.

Enterprise customers can opt out of having de-identified data derived from their content for model training by emailing privacy@sopwow.com. The opt-out does not cover content-free usage signals.

**Which AI model writes your SOPs.** SopWow is model-agnostic. By default it uses a model we manage, under provider terms that do not allow the provider to train on your text. Your organization can instead bring its own API key for a model provider it chooses. In that case, redacted text is sent to that provider under your organization's own agreement with it, and that provider's terms govern what it does with the text. Either way, redaction runs in your browser first and screenshots are never sent to any AI model.

**Workspace content is never sold or shared.** We do not sell customer workspace content, recordings, screenshots, SOPs, account data, or billing data, and we do not share any of it for cross-context behavioral advertising. The only data that reaches advertising partners is website visit data, and only with your consent, as described in the next section.

## How do we use analytics and advertising on sopwow.com?

On the public website, and only after you agree in the cookie banner, we use analytics and advertising trackers. They never run in the customer portal, on the sign-in page, or in the product sandbox. The [cookie policy](https://sopwow.com/cookies) lists each one, with what it collects, how long it lasts, and how to opt out.

**The trackers.** Google Analytics 4 and Google Tag Manager, for analytics. The Meta Pixel, the LinkedIn Insight Tag, and Google Ads conversion tracking, for advertising. Analytics and advertising are separate choices in the cookie banner, and agreeing to one does not turn on the other.

**Categories of personal information they collect:**

- **Identifiers:** IP address, cookie and device identifiers, ad click identifiers, and, if you use Google, Meta, or LinkedIn, the identifiers those companies hold for you.
- **Internet or network activity:** the pages you view, the page that referred you, links and buttons you click, and whether a visit leads to a sign-up.
- **Device and browser information:** browser type, operating system, screen size, and language.
- **Approximate location:** the city or region inferred from your IP address. We do not collect precise location.
- **Inferences:** our advertising partners may place you in audiences for our ads, such as people who visited our pricing page.

The trackers do not collect sensitive personal information, such as government ID numbers, account passwords, health data, or precise location, and they do not see anything you record with SopWow.

**Why we use them.** To count visits and understand which pages and sources people use, to measure whether our ads lead to sign-ups, and to show SopWow ads to people who visited the site, on other websites and apps.

**Who receives the data.** Our advertising partners: Google LLC, Meta Platforms, Inc., and LinkedIn Corporation. For advertising they act as third parties, not as our service providers, and they also use the data under their own privacy policies.

**Sale and sharing under California law.** Letting these partners collect data about your visit for cross-context behavioral advertising is "sharing" personal information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the CCPA), and it may also be a "sale". We treat it as both. The categories sold or shared are the identifiers, internet activity, device information, approximate location, and inferences listed above, and the recipients are the advertising partners named above. You can opt out at any time on the [Do Not Sell or Share My Personal Information](https://sopwow.com/do-not-sell) page, with Global Privacy Control, or by rejecting non-essential cookies. We do not knowingly sell or share the personal information of anyone under 16.

**How long it is kept.** The cookie lifetimes and the providers' retention periods are in the [cookie policy](https://sopwow.com/cookies). Google Analytics event data is kept for 14 months.

## Who do we share data with?

We share personal data with service providers that help us run SopWow, under contracts that limit their use of it; with our advertising partners, for website visit data only and only with your consent; and when the law requires it.

| Provider type | What they do | Data involved |
|---|---|---|
| Hosting (Vercel) | Serves the website and portal | Server logs, portal traffic |
| Database and sign-in (Supabase) | Stores accounts, workspace data, metering; sends sign-in emails | Account data, workspace content, usage data |
| A third-party AI model provider, for SopWow's managed model | Writes draft SOPs and follow-up questions from redacted text. Not used when your organization brings its own key. | Redacted step text, task descriptions, answers |
| A payment processor we engage, when card payments are enabled | Takes payments | Billing contact and payment details |
| Email provider | Sends account and support email | Email address, message content |
| Analytics provider (Google, for Google Analytics 4 and Google Tag Manager), only with your consent | Measures how the website is used | Website visit data, as described in "How do we use analytics and advertising on sopwow.com?" |
| Advertising partners (Google, Meta, and LinkedIn), only with your consent | Measure our ads and show them to people who visited the site. These are third parties, not service providers | Website visit data, as described in "How do we use analytics and advertising on sopwow.com?" |

We may also disclose data if required by law or valid legal process, to protect the rights and safety of our users or the public, or as part of a merger, acquisition, or sale of assets. In a sale, this policy's commitments go with the data.

## How long do we keep data?

- **Raw capture data** (step logs and screenshots before a SOP is approved): kept only as long as needed to draft and review the SOP, then deleted after 30 days unless your organization sets a shorter period.
- **SOPs on a free trial account:** kept for 60 days from signup, then deleted unless you have downloaded or exported them, or upgraded to a paid plan. We warn you on days 23, 46, 57, and 59, and you can export any SOP as a PDF at any point during the 60 days.
- **SOPs on a paid plan:** kept while your subscription is active, or until your organization deletes them. If you cancel, you keep full access until the end of the paid period, then read-only access with export for 90 days. After that, the SOPs are deleted. Going over your plan's storage cap blocks new saves only. It never deletes or hides SOPs.
- **De-identified data:** kept and used after your subscription ends, as described in "Your content and product improvement" above. It does not identify you or reveal your specific procedures.
- **Account and billing records:** kept while the account is open, then deleted within 90 days of closure. Billing records we must keep for tax and accounting are kept for as long as the law requires.
- **Server logs:** kept for a limited period by our hosting provider, typically 30 days or less.
- **Analytics and advertising data:** kept for the periods in the [cookie policy](https://sopwow.com/cookies). Google Analytics event data is kept for 14 months. Your cookie banner choice is kept on your device for 12 months.
- **Support emails:** kept for 2 years, then deleted.

## How do we protect data?

We use reasonable technical and organizational measures, including:

- redaction in the browser before text is sent
- encryption in transit
- hashed recorder tokens
- database access rules that keep each organization's data separate
- least-privilege access for our team

No system is perfectly secure, and we do not claim any security certification today. If we learn of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires. In Canada, that means notifying the Office of the Privacy Commissioner of Canada and the people affected when a breach creates a real risk of significant harm. In Quebec, it means notifying the Commission d'accès à l'information and the people affected when a confidentiality incident presents a risk of serious injury. We keep a record of every breach and confidentiality incident, including the ones that do not need to be reported.

## What rights do you have over your data?

Depending on where you live, you may have the right to:

- **Access** the personal data we hold about you and receive a copy.
- **Correct** inaccurate data.
- **Delete** your data.
- **Export** your data in a portable format. Your SOPs can be exported at any time in Word, PDF, and Markdown.
- **Object to or restrict** certain uses.
- **Opt out** of the sale or sharing of personal data, and withdraw consent to analytics and advertising cookies at any time.
- **Appeal** a decision we make about your request.
- **Complain** to your local data protection authority.

To use any of these rights, email privacy@sopwow.com from the address on your account, or have an authorized agent contact us. For the sale and sharing opt-out you can also use the [Do Not Sell or Share My Personal Information](https://sopwow.com/do-not-sell) page or Global Privacy Control. We may need to verify your identity, but we never need to verify it for an opt-out. We will not treat you differently for using your rights.

If your request concerns workspace content that your employer controls, we will forward it to your employer and help them respond.

### California residents

Under the CCPA, California residents have the right to:

- **Know** what personal information we collect, use, disclose, sell, and share, including the categories, the sources, the purposes, the categories of third parties that receive it, and the specific pieces we hold about you.
- **Delete** personal information we collected from you, subject to legal exceptions.
- **Correct** inaccurate personal information.
- **Opt out of the sale and sharing** of personal information for cross-context behavioral advertising. We honor Global Privacy Control as a valid opt-out, and after you opt out we wait at least 12 months before asking you to opt back in.
- **Limit the use of sensitive personal information.** We do not use or disclose sensitive personal information for any purpose that gives rise to this right, so we do not offer a separate "Limit" link. If that changes, we will add one.
- **Non-discrimination.** We will not deny you the Service, charge you a different price, or give you a different level of quality for using any of these rights.

This policy describes the categories of personal information we collected in the last 12 months: account data, recorder and workspace data, usage and metering data, billing data, support data, and website data, from the sources and for the purposes described above. The only categories sold or shared are the website visit data described in "How do we use analytics and advertising on sopwow.com?".

We respond to requests to know, delete, or correct within 45 days, and we may extend that once by another 45 days if we tell you why. An authorized agent needs your signed permission, and we may ask you to confirm your identity directly with us.

### Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA):

- **Accountability.** Our privacy officer, named below, is responsible for how we handle personal information.
- **Consent.** We collect data through analytics and advertising trackers only with your consent, and you can withdraw it at any time through "Cookie preferences". Withdrawing does not affect your use of the site or the Service.
- **Access and correction.** You can ask what personal information we hold about you, how we use it, and to whom we have disclosed it, and you can ask us to correct it. We respond within 30 days, free of charge, and tell you if we need more time and why.
- **Transfers.** Our service providers and advertising partners process data in the United States and other countries, where it may be accessible to courts, law enforcement, and national security authorities under local law.
- **Complaints.** If you are not satisfied with our answer, you can complain to the [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca).

### Quebec

Under the Act respecting the protection of personal information in the private sector, as amended by Law 25:

- **Consent you give yourself.** Trackers that can identify, locate, or profile you are off by default. We tell you what each one does before you choose, and they turn on only if you turn them on. You can withdraw consent at any time.
- **Privacy officer.** Our privacy officer is the person in charge of the protection of personal information. Their contact details are below.
- **Access, correction, and portability.** You can ask to see and correct your personal information, and to receive it in a structured, commonly used technological format.
- **De-indexation.** You can ask us to stop disseminating your personal information, or to de-index any hyperlink attached to your name that gives access to it, where the dissemination breaks the law or a court order, or causes you serious injury to your reputation or privacy.
- **Confidentiality incidents.** We keep a register of confidentiality incidents, and we notify the Commission d'accès à l'information and the people affected when an incident presents a risk of serious injury.
- **Transfers outside Quebec.** Before we communicate personal information outside Quebec, we assess whether it will be adequately protected.
- **Complaints.** You can complain to the [Commission d'accès à l'information du Québec](https://www.cai.gouv.qc.ca).

### Who is our privacy officer?

Our privacy officer handles privacy requests and complaints, and is the person in charge of the protection of personal information under Quebec law. Contact: Ashish Vaja, Privacy Officer, Uncovered Inc., 5900 Balcones Dr STE 100, Austin, TX 78731, privacy@sopwow.com.

## What should employers know before their team records?

SopWow is a documentation tool, not a monitoring tool. It records only the tab where a person starts a recording, and only until they stop.

If you deploy SopWow to your team, you are responsible for:

- telling your employees and contractors what the recorder captures
- getting any consent the law requires where you operate
- deciding which systems and data are appropriate to record

Do not record workflows involving regulated data, such as protected health information, unless we have agreed to that in writing first.

## Is SopWow meant for children?

No. SopWow is a business service and is not directed to anyone under 16. We do not knowingly collect personal data from children, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us personal data, email privacy@sopwow.com and we will delete it.

## Where is data processed?

SopWow is operated from the United States, and our service providers and advertising partners may process data in the United States and other countries. Where the law requires safeguards for international transfers, we rely on the appropriate legal mechanisms, such as standard contractual clauses.

## How will we tell you about changes?

If we change this policy, we will post the new version on this page. If a change materially affects how we use your personal data, we will tell account holders by email before it takes effect. Effective date: September 24, 2026.

## Who do you contact with a privacy question?

Email privacy@sopwow.com, our privacy officer's address, for any privacy request or question, including the opt-out of de-identified data for model training. To opt out of the sale and sharing of personal information, use the [Do Not Sell or Share My Personal Information](https://sopwow.com/do-not-sell) page. Our postal address is Uncovered Inc., 5900 Balcones Dr STE 100, Austin, TX 78731. The [terms of service](https://sopwow.com/terms) cover the rest of your agreement with us, and [how SopWow handles client data](https://sopwow.com/security) explains the recorder in more detail.

## Still have a question about your data?

Write to us and a person will answer.

[Email privacy@sopwow.com](mailto:privacy@sopwow.com)