Privacy Policy

Who we are, and who is responsible

Sheevook is a hosted marketing workspace operated by Computing America ("we", "us"). A workspace belongs to the organization or person who set it up, and its owner invites the other people who use it.

We are the data controller for the information about the people who use Sheevook: their accounts, sign-ins and billing. For the content a workspace puts into Sheevook, including any personal data about other people that it collects through the product (such as answers from visitors to its own website, or messages received on its connected social accounts), the workspace's owner is the controller and we process that data on its behalf.

What we store

• Your account. A username, and an email address if you gave one. If you sign in with Computing America ID, also your display name, the identifiers that link your account to Computing America ID, and which products your organization has licensed. A password, if you have one, is stored only as a scrypt hash.
• Workspace membership. Each member's role, and the email address an invitation was sent to, from the moment it is sent. Invitation links expire after 7 days.
• Your content. The brands, posts, schedules, campaigns, images, videos and analytics you create or upload, and comments and approvals left on content, including the name a client types when approving through a shared link.
• Your website, as read by Sheevook. When a project is created with a website address, Sheevook reads up to 10 public pages of that site (respecting its robots.txt) to describe the business. That can include the address, phone number and customer quotes the site publishes.
• Platform connections. The access tokens a social, ad or analytics platform issues when you connect it, and for a few platforms the app password or bot token you paste in. They are encrypted at rest (AES-256-GCM), kept on the server, and never sent to your browser. We also keep the account name you connected.
• Messages received on your connected accounts. Replies, mentions and, where the platform allows it, direct messages sent to your connected accounts, with the sender's name or handle, so your team can see and answer them in one place.
• Visitor signals from your own website. If you install the optional snippet, the free-text answer a visitor gives to "how did you hear about us?", conversion events, and the referring page of a click on a tracked link. None of these carry a login session, a cookie or an IP address.
• IP addresses, briefly. To stop abuse, sign-in attempts and the public endpoints are rate limited by IP address. The address is kept only in the counter for its time window, about an hour.
• Billing. Your Stripe customer and subscription identifiers. Card details are entered on Stripe's own page and never reach Sheevook.
• Records of staff access (see "Computing America staff access") and server logs of errors and scheduled jobs, which carry a request identifier and the page address with any access token removed.

Sheevook sends no email. An invitation link is shown to the person who created it, who sends it themselves.

Why we use it, and our legal basis

For users in the EU, UK, and other regions with equivalent laws, the legal bases we rely on are:

• Performance of a contract: to run the workspace your organization subscribed to, including signing you in, storing your content, and publishing through the platforms you connect.
• Legitimate interests: to keep the service and your account secure, to prevent abuse, to support you when you ask for help, and to keep the service running. You can object to processing based on legitimate interests (see "Your rights").
• Consent: where you choose to connect an optional integration, the data that integration needs is processed on the basis of that choice, which you can withdraw at any time by disconnecting it.
• Legal obligation: where we must retain or disclose data to comply with the law, for example billing records.

Who we share it with

We use these service providers to run Sheevook:

• Vercel hosts the application, and a managed Postgres provider stores the workspace database, including uploaded and generated media.
• Stripe processes subscription payments.
• Computing America ID and the Computing America licensing service sign you in and tell Sheevook which products your organization has licensed.
• AI providers generate and check content when a feature needs them. Anthropic receives the brand profile and the text being written or rewritten. OpenAI, Google, fal.ai and ElevenLabs receive image, video and voice prompts and, when you ask for a picture of your own product, the product images and logo from your library. Photos of people in your library are never sent to an AI provider. Much of Sheevook works without any of them, and nothing is sent until a generation needs it.
• Mapping and web search, to find a new project's competitors: OpenStreetMap's Nominatim and Overpass services receive the business address published on your website, and DuckDuckGo or Brave Search receive searches made of your category and location.
• The platforms you connect receive the posts, media and ads you publish through them, and return metrics and messages. Each is governed by its own terms and privacy policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Sheevook contains no advertising or third-party tracking scripts, and its pages load nothing from other websites in your browser.

Computing America staff access

A small number of Computing America staff can open any workspace, with the same access as its owner, to provide support, investigate a problem you report, and operate the service. Who is staff is decided by Computing America's account system and checked again at every sign-in, and a staff session lasts at most 12 hours. Every time a staff member opens a workspace, Sheevook records who opened it and when. Staff are not listed as members and do not use a seat.

Where your data is processed

Sheevook runs in the United States, and the providers named in "Who we share it with" may process data in the United States and other countries. Where personal data from the EU, UK or Switzerland is transferred, we rely on an appropriate safeguard such as the European Commission's Standard Contractual Clauses.

Cookies and browser storage

Sheevook uses only the cookies it needs to work:

• Session: keeps you signed in. A signed token, lasting 30 days, or 12 hours for staff.
• Sign-in: holds the state of a Computing America ID sign-in for up to 10 minutes.
• Active project: remembers which project you last opened, for up to a year.
• Connecting a platform: protects the connection steps against forgery, for up to 10 minutes.

Your browser also keeps your theme, layout, whether you have seen the product tour, and an unsent draft, so they survive a reload. These stay on your device. There are no advertising, analytics, or third-party cookies.

AI-generated media

Media the app generates with AI is flagged as AI-generated and that flag is carried through to publishing so it can be disclosed where a platform supports it. We never generate a synthetic person, testimonial, or review. The app does not make any decision about you by solely automated means that would produce a legal or similarly significant effect.

How long we keep it

• Your account, and your workspace's content, connections and messages, are kept until they are deleted. Deleting a project deletes everything in it.
• Disconnecting a platform deletes its tokens at once. The connected account's name is kept with the project.
• When a member is removed, they lose access at once, and the record that they were a member is kept with the workspace.
• IP addresses in the abuse counters: about an hour. Generated text kept so that the same request is not paid for twice: 30 days. Stripe event identifiers: 14 days. Signed links that let a platform fetch your media: 24 hours.

You can delete your account yourself in Settings, and it takes effect at once (how, and what it removes and keeps). For anything else you cannot delete in the app, or if you cannot sign in, write to us (see Contact) and we will do it within 30 days.

Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access and know: what data is held and how it is used.
• Rectification and correction: fix inaccurate or incomplete data.
• Erasure and deletion: have your data removed.
• Restriction and objection: limit or object to certain processing, including processing based on legitimate interests.
• Portability: receive your data in a portable format.
• Withdraw consent: at any time, without affecting processing that already happened lawfully.
• Opt out of sale or sharing: we do neither, but the right is yours.
• Non-discrimination: we will not treat you differently for exercising any of these rights.

You can do much of this yourself: export a project's data, delete content or a whole project, and disconnect any platform. Disconnecting a platform in the app does not revoke access on the platform side, so also remove Sheevook from that platform's connected-apps settings. For anything else, contact us.

If your data is in a workspace someone else owns (for example, you sent a message to one of its connected accounts, or answered a question on its website), that workspace's owner decides what happens to it, and we will pass your request to them.

If you are in the EU or UK and believe your data has been handled improperly, you also have the right to lodge a complaint with your local data protection supervisory authority.

Children

Sheevook is a business marketing tool and is not directed to children. It is not intended for anyone under 16 (or the minimum age set by your country, and under 13 in the United States), and it does not knowingly collect their personal data. If you believe a child's data has ended up in a workspace, contact us and it will be removed.

Security

Passwords are hashed with scrypt, platform tokens are encrypted at rest and never leave the server, session cookies are signed and unreadable by scripts on the page, and all traffic is encrypted in transit. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you as the law requires.

Contact

For privacy questions or to exercise a right, contact Computing America at privacy@sheevook.com.

Changes

If this policy changes materially, the "last updated" date changes with it. We review it at least once a year.