Effective date: May 6, 2026 · Last updated: October 27, 2026
SOWaudit is operated by Sambry Global ("we," "us," or "our"), accessible at sowaudit.com. We provide an AI-powered SOW analysis platform. For privacy questions, contact us at Admin@SOWaudit.com.
| Data Type | What It Includes | Why We Collect It |
|---|---|---|
| Account Data | Name, email address, password (hashed) | To create and manage your account |
| Submitted Content | SOW text you paste or upload (uploaded PDF/DOCX files are read in memory to extract the text and are not stored), and the findings generated from it | To perform analysis, return results to you, and (if you're signed in) keep your audit history |
| Usage Data | Number of reviews run, features used, timestamps | To enforce plan limits and improve the service |
| Payment Data | Subscription plan and Stripe customer/subscription identifiers. Card details are entered on Stripe's checkout and handled entirely by Stripe — we never see or store card numbers | To process payments and apply your plan |
| Contact Form | Name, email, message | To respond to your inquiry |
| Log Data | IP address, browser type, requested pages, timestamps, and technical error details (request contents and login tokens are removed from error reports) | Security, abuse prevention, and debugging |
| Analytics Data | Pages visited, button clicks, referring site, device and browser information, collected through cookies and similar technologies (see section 7). The SOW input and audit results are excluded | To understand how the site is used and measure our advertising |
We use the information we collect to:
We will not use your information for purposes materially different from those listed above without your consent.
When you submit a SOW, its text is transmitted to our AI provider (Anthropic) to generate your analysis. Under Anthropic's commercial terms, content sent through its API is not used to train its AI models and is retained only for a limited period.
We recommend you redact sensitive personal data (names, Social Security numbers, bank details) from SOWs before submitting them, and you may replace client and vendor names with placeholders such as [CLIENT] — the audit page’s Hide Client Names option does this for you before analysis. The list of names you hide is kept only in your browser and is never sent to or stored by SOWaudit. SOWaudit analyzes contract structure and language — names and personal data are not necessary for the analysis.
If you are signed in, your SOW text and analysis results are stored in our database so you can revisit past audits and compare revisions. If you are not signed in, nothing is stored — results exist only in your browser tab. You can delete individual audits or your entire account at any time via account settings.
If you create a shared report link (a "Boss Link"), anyone with the link can view the findings — never the SOW text — until the link expires (30 days) or you revoke it.
We work with the following trusted third parties to operate the Service:
We do not sell your personal information to any third party, ever.
We retain account data and saved audits for as long as your account exists. Cancelling a paid subscription does not delete your account; to delete it, use the self-service option described below or contact us.
You can delete individual audits from your history, which permanently deletes that audit's SOW text, findings, exports, and any remediation report. You can delete your entire account at any time via the "Delete My Account & Data" option in your account settings. Account deletion is immediate and irreversible: your account, projects, exports, remediation reports, and sign-in sessions are deleted, and SOW text and findings are wiped from any remaining audit records. We keep only anonymous counts (for example, how many risks of each severity were found) for product metrics.
Database backups roll off within 6 hours. Error reports are kept for 30 days. Server logs are kept by our hosting provider for a limited period. Stripe retains billing records it is legally required to keep. To also be removed from our email providers, email us and we will handle it.
Signing in: we keep you signed in with a token stored in your browser's local storage (not a cookie). It expires after 30 days, and signing out ends it on our servers as well.
Analytics and advertising measurement: with your consent, we use Google Analytics, the Reddit Pixel, and HeyCatch, which set cookies or use similar technologies to measure site usage and the performance of our ads on Reddit. They do not load until you click "Accept" on our cookie banner, and if you click "Reject" they are never loaded. These tools do not receive the SOW you submit or your audit results, and we do not let them record the addresses of shared report or unsubscribe pages.
You can change your choice at any time: open cookie settings (also linked in the footer). You can also block or delete cookies in your browser settings or use a content blocker. Declining does not affect your ability to use SOWaudit.
We use HTTPS encryption for all data in transit, encryption at rest for our database, hashed password storage, expiring sign-in sessions, limits on repeated sign-in attempts, and two-factor authentication on every account that can reach our production systems. Our Security page describes these measures in detail. No system is 100% secure — if you believe your account has been compromised, contact us immediately at Admin@SOWaudit.com.
Depending on your location, you may have the right to:
To exercise any of these rights, email us at Admin@SOWaudit.com. We will respond within 30 days.
For EU/EEA residents: Under the General Data Protection Regulation (GDPR), you have additional rights including the right to erasure (Article 17), data portability, and the right to restrict processing. We will respond to verified requests within 30 days. To exercise these rights, use the self-service deletion in your account settings or email Admin@SOWaudit.com.
The Service is intended for business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page reflects when changes were made. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.
Privacy questions or data requests: