Privacy Policy

1. Who we are

sweeet (sweeet.space) is operated by Kevin Aguiar, based in Argentina (“sweeet”, “we”, “us”). For the personal data described in this policy we are the data controller — in Argentine law, the responsable of the database — except for the content Providers upload to their spaces, explained in Content Providers upload.

You can reach us about anything in this policy at hello@sweeet.space.

2. Who this policy covers

• Providers: people who create a sweeet account to share their work with their clients.
• Recipients: a Provider’s clients, and anyone else who opens a space or a deliverable a Provider shared. Recipients don’t create an account.
• Visitors: anyone who visits sweeet.space or writes to us.

3. Content Providers upload

Providers decide what goes into their spaces: names, logos, images, texts and files, together with anything those files contain — which may include personal data about their clients or other people.

For that content the Provider is the controller, and sweeet only processes it on the Provider’s behalf: a processor under the GDPR, a prestador de servicios de tratamiento de datos under Argentine law. We store it and deliver it to the people the Provider shares it with, and we don’t use it for anything else.

If you have a question about the content of a space — for example, because it includes information about you — please contact the Provider who shared it. If you write to us instead, we’ll pass your request on to that Provider and help them answer it.

4. What we collect, and why

The only data you must give us is an email address: without it we can’t create an account. Everything else you add is up to you.

Interactive deliverables

Interactive deliverables are web pages that Providers create. sweeet runs them isolated from its own pages and cookies, but a deliverable can load content from other websites, such as fonts, images or videos. When it does, those websites receive your network address and browser details, under their own policies. The Provider who made the deliverable is responsible for what it loads.

5. What we don’t do

• We don’t sell or rent personal data, and we don’t share it for advertising.
• We don’t show ads, and we don’t use third-party analytics or cookies that follow you from one website to another.
• We don’t use your content, or your clients’ data, to train artificial intelligence models.
• We don’t use automated decision-making that has legal or similarly significant effects on you.
• We don’t look at the content of spaces, except when it’s necessary to operate or secure the service, to investigate a report of abuse, or because the law requires it. Only the people who operate sweeet can do so.

6. Cookies

sweeet uses only the cookies it needs to work, one that remembers a preference you set, and one that lets a Provider count how many different browsers opened their work. None of them is used for advertising.

Account cookies stay on app.sweeet.space and are never sent to spaces, and a space’s cookies work only on that space’s address. We don’t use local storage or similar technologies to track you.

You can delete or block cookies in your browser. Spaces work the same without the counting cookie; without a space’s access cookie, the space asks for its password again.

7. Who we share data with

We use a small number of providers to run sweeet. They process personal data only on our instructions and to provide their service to us.

We choose providers that offer data processing terms with safeguards for international transfers, and we’ll update this list before a new provider starts processing personal data.

Beyond them, we disclose personal data only when the law requires it — for example, a valid court order —, when it’s necessary to protect the rights, safety or property of the people who use sweeet, the public or sweeet itself, or as part of a merger, acquisition or sale of the service. In that last case the new operator will be bound by this policy, and we’ll tell you beforehand.

8. International transfers

Our providers process data in the United States and Brazil, among other countries, whose laws may not protect it as much as those of your country, including Argentina and the European Union. To protect it, we rely on the safeguards our providers offer, such as standard contractual clauses in their data processing terms. Where Argentine law requires your consent for these transfers, we ask for it when you create your account.

9. How long we keep data

• Your account and workspace: while your account is open. When you delete a space or a deliverable, its files are deleted right away. When you ask us to close your account, we delete your data within 30 days.
• Failed password attempts: used for 24 hours, then deleted automatically.
• Deliverable statistics: deleted together with the deliverable. The hashes used to count different browsers and hearts are used for up to a year, then deleted automatically; the totals stay.
• Upload history: deleted together with the deliverable.
• Comments: until the Provider deletes them, or deletes the deliverable. The hash used to limit how many comments a browser sends is deleted after a day.
• Abuse reports: as long as needed to handle the report, prevent repeated abuse and defend legal claims.
• Messages you send us: as long as needed to answer you and keep a reasonable record of the conversation.
• Logs at our providers: for the limited periods each provider sets.

Copies in our providers’ backups and logs disappear as those expire. We keep data longer only when the law requires it.

10. How we protect data

• Every connection to sweeet is encrypted.
• Each space lives at its own address, separate from the one where Providers sign in, so a space’s content can’t reach account cookies. Interactive deliverables run in an isolated sandbox.
• Space passwords are stored only as a one-way hash, and repeated wrong guesses are blocked.
• Database rules let each Provider reach only their own spaces. Files are stored privately and served only after access is checked.
• Sign-in links expire, work once, and work only in the browser that requested them.

No system is perfectly secure. If a security incident affects your personal data, we’ll notify you and the relevant authorities without undue delay, as the law requires.

11. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you, and receive a copy in a portable format;
• correct or update it;
• delete it;
• object to how we use it, or ask us to restrict it;
• withdraw your consent, where we rely on it, without affecting what we did before.

To use any of them, write to hello@sweeet.space from your account’s email address, or tell us how we can verify that the data is yours. It’s free. We answer within the time the law sets: under Argentine law, 10 calendar days for access requests and 5 business days for corrections and deletions; under the GDPR, one month.

If you believe we haven’t handled your data properly, you can complain to the data protection authority where you live. In Argentina that is the Agencia de Acceso a la Información Pública (AAIP); in the European Union, your country’s supervisory authority.

If you live in a US state with a consumer privacy law, you have the rights it gives you, including to know, access and delete your personal information, and you won’t be treated differently for using them. We don’t sell or share personal information as those laws define those terms.

12. Children

Provider accounts are only for people 18 or older, and we don’t knowingly collect personal data from children. If a Provider shares a space with minors — a teacher with students, for example — the Provider is responsible for any authorization the law requires; about Recipients we collect only the technical data described above. If you believe a child has given us personal data, write to us and we’ll delete it.

13. Google user data

If you sign in with Google, we ask Google only for the basic “email” and “profile” permissions and receive your name, email address and profile picture link. We use them only to create your account and sign you in. If you choose Sign in with Google without having an account, Google’s reply creates one anyway; we delete it, with everything Google sent us, before you see the next screen. We don’t access your Gmail, Drive, contacts, calendar or any other Google data, and we don’t transfer what we receive to anyone, except the providers listed above as needed to run sweeet, or when the law requires it.

sweeet’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14. Changes to this policy

We’ll publish any change here with a new date. If a change meaningfully affects how we use your data, we’ll tell you in advance by email or in sweeet, and ask for your consent where the law requires it.

15. Contact

Kevin Aguiar, operator of sweeet · hello@sweeet.space