What we hold, and what we do with it

This policy explains what the Soundcheck Insights platform collects, who else processes it, and what you can ask us to do about it.

The platform is operated by Soundcheck Insights LLC, a Florida limited liability company ("Soundcheck", "we", "us"), of Miami, Florida, USA. You can reach us at any time at info@soundcheckinsights.com.

1. WHAT THIS POLICY COVERS

This policy describes how we handle information on the Soundcheck Insights platform at www.soundcheck.report — the research platform used by agencies and consultancies, together with the dashboards, reports and Telegram bots published from it.

KLUG is not covered by this policy. KLUG analyses a business's own Instagram content under permissions granted through Facebook Login, and the commitments we make to Meta about that data are specific to it. KLUG has its own policy at klug.soundcheck.report/privacy.

Our security practices are documented in more technical detail at www.soundcheck.report/security, including what we have not yet done. That page and this one are maintained together.

2. WHO WE HOLD INFORMATION ABOUT

• Agency users — people given an account by an agency that licenses the platform, including agency administrators and the people they invite.
• Soundcheck staff — our own administrators.
• People who open a shared dashboard — a client of an agency who is sent a share link.
• People who use a project's Telegram bot — where an agency has enabled one for a client.

We do not build profiles of, or hold information about, members of the public who are not in one of those groups.

3. WHAT WE COLLECT

From your account

Authentication is handled by Clerk, our identity provider. Through Clerk we receive your name, email address and profile image, and — where you sign in with Google or Microsoft — the fact that you did so. We never receive or store your password. If you use multi-factor authentication, Clerk holds those factors, not us.

We also record the agency you belong to, your role, and which projects you are assigned to, because every permission on the platform depends on them.

New self-service sign-ups are held in a pending state until a Soundcheck administrator approves them, so an account that is never approved never reaches the platform.

What you create and upload

Briefs, research inputs, uploaded documents, client and project names, personas, focus-group configurations, dashboards, locked facts, feedback and comments. Uploaded files are parsed on our servers to extract their text.

What you put into a project is your choice, and it is the main thing we hold. If you upload a document containing personal information about a real person, we hold that too. Please only upload what the engagement needs and what you are permitted to share.

Records of agreement

When you accept the End User Terms or any commercial terms, we record the exact version accepted, an ISO-8601 UTC timestamp, your IP address and your browser's user-agent string. These are kept as evidence of acceptance under the Florida Uniform Electronic Transaction Act and the federal E-SIGN Act, and are retained even if the account is later closed.

Where an agency has signed the long-form partnership agreement off-platform through Docusign, we record who signed it, the date, and optionally the executed PDF.

Automatically

Standard technical data — IP address, browser type, pages and actions, timestamps and error traces — recorded in our hosting and job-processing logs for security, debugging and abuse prevention.

We run no third-party analytics, no advertising pixels and no cross-site trackers. The only cookies we set are the ones that keep you signed in and, on a password-protected shared dashboard, the one that remembers you entered the password.

From Telegram, if a bot is used

Where an agency enables a project's Telegram bot, we store the Telegram user ID of each person who talks to it and every message exchanged, inbound and outbound. These are visible to the agency that owns the project. Each conversation is bound to a single shared project and can reach nothing else.

4. HOW WE USE IT

• To run the platform: authenticate you, enforce permissions, and produce the research deliverables you ask for.
• To generate content with AI, as described in section 5.
• To support you, and to investigate problems you report.
• To keep the platform secure and to investigate abuse.
• To bill your agency, and to keep the records of agreement described above.
• To improve the platform, under the limits in section 6.

We do not use your content for advertising, and we do not sell personal information.

5. AI PROCESSING

Generative AI is a core production tool on this platform, not an add-on. Two providers are involved:

• Anthropic (Claude) generates the deliverables. Anthropic's commercial API terms do not use prompt or response content to train models, and apply a zero-retention posture by default.
• OpenAI (GPT-5) runs a cross-family audit over the assembled report and its evidence register — a deliberate second opinion from a different model family. OpenAI's API terms exclude API content from model training. These calls run under OpenAI's default posture, under which request and response data may be held for up to 30 days for abuse monitoring before deletion. Only the assembled report and evidence register are sent to OpenAI — never your raw uploads.
• Anthropic's server-side web search is used in one step, so Claude can verify or drop claims the audit flagged. The queries are derived from the report's own content and run inside Anthropic's infrastructure.
• Tavily is called only during monthly update runs, and receives only the topic terms derived from the project's watch areas — no agency, client or person identifiers, and no report content.
• Gamma generates presentation decks where you ask for one, and receives the report content used to build that deck.

Every AI call is scoped to a single project belonging to a single agency. We do not pool one agency's uploads or context with another's at any step.

Personas are synthetic. They are constructs grounded in research, and do not represent or correspond to any real, identifiable person.

AI output can be wrong. You are responsible for reviewing what the platform produces before relying on it or passing it to a client. This is stated in the End User Terms as well.

6. THE ANONYMIZED ENGAGEMENT POOL

Completed engagements are distilled into anonymized records that help us improve the platform's methodology.

• Only categorical tags are stored — an archetype tag, a friction tag, a score band. No client names, brand names, agency identifiers, persona names, verbatim quotes or brief text ever reach the pool.
• A record links back to its source only through a salted SHA-256 hash. The salt lives in our server environment; without it the link cannot be reversed.
• Every aggregate query enforces a minimum of five contributing engagements. A segment with fewer returns nothing.
• A scheduled audit attempts to re-identify pooled records against public registries each quarter. Anything that resolves uniquely is purged.
• You can opt out. An agency can set its contribution to none, and any single engagement can be excluded individually. Projects in Incognito Mode are excluded automatically.
• The pool is used inside Soundcheck only. It is never exposed to another agency, and cross-agency benchmarking is not a shipped feature.

7. WHO ELSE PROCESSES IT

We use these providers to run the platform. Each receives only what its function requires, and each is bound by its own terms to process it on our instructions.

• Vercel — hosting, file storage and request logs
• Neon — the Postgres database
• Clerk — authentication and account management
• Anthropic — AI generation
• OpenAI — AI cross-family audit
• Tavily — market-change search on monthly updates only
• Gamma — presentation deck generation
• Inngest — background job orchestration
• Resend — transactional email
• Telegram — only where a project's bot is enabled
• Docusign — signing the long-form partnership agreement

These providers process data in the United States. If you are outside the US, using the platform involves transferring your information there.

We will also disclose information where the law requires it, to enforce our terms, or to protect the rights and safety of users — and, if Soundcheck is ever involved in a merger or acquisition, as part of that transaction.

8. PAYMENT INFORMATION

The platform takes no payment details. Agencies are invoiced off-platform and pay by wire or ACH. There is no card form, no stored card number and no payment processor holding your details on our behalf.

9. SHARED DASHBOARDS

A shared dashboard is published at an unguessable address — a random twelve-character slug — and can be given a password, which we store only as a bcrypt hash. Disabling a share makes the address return "not found" immediately.

A share link is a link. Anyone who has it, and the password if one is set, can open the dashboard. Treat it as you would any confidential document you send a client.

10. HOW LONG WE KEEP IT

• Project content stays for as long as your agency's account is active. Deleting something removes it from every view immediately, and the underlying record is kept so that an accidental deletion can be undone. Deleting is therefore not the same as erasing — if you need something permanently removed, ask us and we will do it.
• Records of agreement are retained after an account closes, because their whole purpose is to evidence what was agreed and when.
• Operational logs are short-lived. Our hosting provider keeps request and function logs for 1 day. Our background-job provider keeps run traces for 24 hours. Neither is archived anywhere after that.
• Database point-in-time recovery — how far back the database itself can be rolled to an earlier state — is 7 days.
• Backups are taken nightly and kept for 30 days, encrypted, and held separately from the database itself so that they survive it. A backup is a copy of the database as it stood that night, so something you deleted can remain inside a backup for up to 30 days after it disappears from every view. Ask us for a permanent erasure and we will make sure it does not come back from one.
• OpenAI's abuse-monitoring window is up to 30 days, as described in section 5.
• When an agency's relationship with Soundcheck ends, we delete or return its content according to that agency's agreement with us.

The windows above are what our providers are configured for today. If we change a plan and a window changes, this section changes with it.

11. HOW WE PROTECT IT

Traffic runs over TLS. The database and file storage encrypt at rest with AES-256. Backups are encrypted with AES-256 before they leave the database host, and the key that opens them is not held in the systems being backed up. API keys live in our server environment and are never reachable from a browser. Every database read for an agency's resources passes through a single scoping layer, so one agency's queries cannot reach another's data. Full detail, including our open gaps, is at www.soundcheck.report/security.

No system is perfectly secure, and we do not claim otherwise.

12. YOUR CHOICES AND RIGHTS

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict how it is used, and not to be discriminated against for exercising them.

We will honour these requests wherever you are, rather than checking whether a particular law applies to you first. Email info@soundcheckinsights.com and we will respond within 30 days.

Two practical notes. Where the information is content your agency put into the platform, the agency controls it and we will normally refer your request to them. And we cannot delete records of agreement without undermining the reason they exist — we will tell you if that is why something is retained.

To close your account, ask your agency administrator or email us.

13. CHILDREN

The platform is for business use. It is not directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

14. CHANGES

We may update this policy. The version number and effective date at the top change whenever we do, and the full history of this document is kept. If a change materially affects how we handle your information, we will tell account holders directly rather than relying on you to notice.

15. CONTACT

Questions, requests and complaints:

Soundcheck Insights LLC Miami, Florida, USA info@soundcheckinsights.com