SQUAT Privacy Policy

Pre-release. This policy will be updated prior to the official SQUAT launch.

1. Who we are and what this covers

Elucidate Ventures LLC, a Pennsylvania limited liability company doing business as Elucidate Digital ("Elucidate," "we," "us," "our"), operates SQUAT. Our address is 4569 Riverside Way, Philadelphia, PA 19127.

This policy explains how we handle personal information across SQUAT: the website, accounts, the hosted service, billing, support, and communications.

It does not cover the AI clients, model providers, browser tools, identity providers, grounding sources, or other services you choose to connect. Their own privacy policies apply, and their retention, logging, and training settings are under your control, not ours. Review them before sending personal or confidential information through them.

2. The short version

• We do not run the AI. SQUAT is a service your own AI client connects to.
• Your workspace content is encrypted before it is stored. Operational information needed to run the service is not. See §9.
• We collect usage analytics about workspaces, not people. It is metadata only, never content, and on by default; a workspace owner or admin can turn it off. See §6.
• We do not sell personal information or share it for cross-context behavioral advertising. See §8.
• You can export your content at any time and request deletion. See §10.
• You have privacy rights, including specific rights for California residents. See §11.

3. Our two roles

When we decide how information is used. For your account, workspace administration, licensing, billing, fraud prevention, security, audit records, legal compliance, service communications, and our own product analytics, we decide why and how information is processed. This policy governs that processing.

When we process information for you. For personal information in your Customer Content — what you and your AI client put into your workspaces, and what is produced there for you — you decide the purposes and we process it on your instructions, as a service provider. Our Terms of Service §6 sets out our commitments for that processing.

If you put other people's personal information into SQUAT, you are responsible for the notices, permissions, consents, and lawful bases that requires, and for handling those people's requests. (§11.4).

4. What we collect

Customer Content may include personal information about your workspace members, research participants, customers, employees, creators, public figures, or others you choose to include.

Sensitive information. We do not ask for, and SQUAT is not designed to hold, government identifiers, financial account numbers, precise geolocation, biometric or genetic data, health records, or children's data. Do not put them in Customer Content.

5. How we use information

We use information to: create and manage accounts, workspaces, roles, seats, licenses, and purchases; operate, secure, troubleshoot, and improve the Service; measure how our website and marketing perform; route content to the providers you select; store, protect, and return your Customer Content; prevent abuse, enforce plan limits, investigate incidents, and keep audit records; provide support; process payments and send service messages; comply with the law and protect legal rights; and send marketing only if you have separately opted in.

Marketing consent is separate from receiving service messages. You can withdraw it at any time from marketing and still receive service messages.

6. Usage analytics

We collect usage analytics about how workspaces use SQUAT, to improve the product.

Usage analytics describes workspaces, not people. It contains no content and no names, emails, or account or user IDs, and records are identified by a random code rather than by your workspace's name or ID.

We use it in aggregate. We do not use it to make decisions about your account or to look up a particular workspace's activity.

You can turn it off. Analytics is on by default. A workspace owner or admin can turn it off at any time, and collection stops for that workspace from then on. Turning it off does not remove past records; they are deleted when the whole workspace is deleted.

7. Cookies and our website

Our website uses:

• Cookies and browser storage needed to run the site: a sign-in session cookie, storage used by our sign-in provider, and a device identifier we use when recording your acceptance of our legal documents;
• Google Analytics on our public pages, to measure visits and how our campaigns perform. It uses cookies, and Google collects device and usage information under its own Privacy Policy. We do not use it on account or administration pages. You can opt out with Google's browser add-on; and
• Google reCAPTCHA Enterprise, which checks that requests come from our site and not from automated abuse. Google collects device and interaction information for this under its own Privacy Policy and Terms.

8. How we share information

We disclose personal information only:

• to service providers and subprocessors that host, protect, transmit, bill for, or support the Service, under contracts that restrict their use of it. The current list is at squat.pro/data-subprocessors;
• to the AI and other providers you connect, at your direction and only as needed for the operation you requested;
• to authorized members of your workspace, according to their roles;
• during a support case your workspace owner has explicitly given us access for (§9);
• when required by law, or when needed to protect rights, safety, or security; and
• in a merger, acquisition, financing, or sale of assets, under confidentiality and with notice where required.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the past 12 months.

9. Security

We use administrative and technical safeguards to protect information, including encrypting your workspace content before it is stored and limiting access by role.

Staff access. Our staff view your workspace content only with a workspace owner's permission for a support case, when needed to investigate a security incident or a problem with the Service, or as the law requires. Every such access in the system is recorded. A workspace owner can withdraw support permission at any time; withdrawing it does not undo access already given.

No system is perfectly secure. If a breach affects your personal information, we will notify you as the law requires.

10. Retention, export, and deletion

Retention. We keep information only as long as needed for the purposes in this policy, plus what the law, disputes, security, and enforcement require. Some records outlive Customer Content: audit records, acceptance records, billing and tax records, security logs, support cases, and records of completed deletions. Audit records and deletion records contain no Customer Content.

Support cases. Support cases are our records of the help we provided. We keep them, including messages and attachments, because they may relate to claims about the Service, may contain security information we need to maintain and operate the Service, or may be needed for other legal or operational reasons. We keep them after the workspace they came from is deleted, and we may decline a request to delete them. Leave out of a support case anything you do not want us to keep.

Export. You can export data from your workspace content at any time using a tool that we provide. Export tools may limit exports to a subset of data that is stored in SQUAT.

Deletion. A workspace owner can request deletion of specific items, of the data about a particular person, or of the whole workspace. Deleted content may first be held for approximately 30 days so it can be recovered. It is then removed from active systems, and it expires from our backups within approximately 60 days of the deletion. When a paid plan is cancelled, the workspace has a 60-day grace period, starting at the end of the paid period, for export before its content is deleted, as described in our Terms §13.

We may delay or decline deletion of specific records when the law requires us to keep them, or when they are shared with content that is not being deleted.

11. Your privacy rights

11.1 Your rights

Wherever you are, you can ask us to: give you a copy of the personal information we hold about you; correct it; delete it; and stop sending you marketing. When we delete your personal information, we also direct our service providers to delete it, unless an exception applies. We will not treat you differently for using these rights — no denial of service, different price, or lower quality. However, if we offer services that depend on that personal information, then those services may not be available to you or may not function as advertised.

11.2 California and other U.S. states

California residents have the rights to know, delete, correct, and receive personal information in a portable format; to opt out of sale or sharing; to limit use of sensitive personal information; and to non-discrimination. We honor these rights for any California resident who asks, whether or not we currently meet the law's thresholds.

• Right to know. §§4, 5, and 8 describe the categories of personal information we collect, where it comes from, why, and whom we disclose it to. A request gets you your own records.
• Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. If that ever changes, we will update this policy and add a "Do Not Sell or Share My Personal Information" link first.
• Sensitive personal information. We do not use sensitive personal information for purposes that trigger the right to limit.
• Authorized agents. You may use an authorized agent with your signed, written permission. We may also ask you to verify your identity directly.

Residents of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana — have comparable rights. We will handle those requests the same way, within each state's deadline.

11.3 How to make a request, and what happens next

Submit your request through the support form at squat.pro/support, choosing Data & privacy. Tell us the nature of your request and the email address on your account or the workspace involved. If you are acting for someone else, say so and include your authorization.

1. We acknowledge your request within 10 business days.
2. We verify it is you, using a reasonable process proportionate to the request, usually by matching information you give us against our records. We will not ask for more than the request needs, and we will not make you create an account. If we cannot verify you, we will tell you why.
3. We respond within 45 days. If we need more time, we will tell you within those 45 days and take up to 45 more.
4. If we deny any part of it, we tell you why — for example, a legal obligation to keep records, security and fraud-prevention records, or another person's rights.

11.4 If your information is in someone else's workspace

If a SQUAT customer put information about you in their workspace — for example, a persona built from your interview — that customer controls it, and you should contact them. If you contact us, we will refer you to them and help them find and act on your information.

11.5 If you disagree with our decision

Reply to our response and ask us to reconsider. California residents may also contact the California Privacy Protection Agency or the California Attorney General.

12. Where information is processed

We operate in the United States, and our own systems store and process information there. Some of our service providers, including AI services we may use for support, may also process information in other countries under their own terms; our data subprocessors page links to those terms. The AI providers you connect process information where their own terms say. SQUAT is currently offered to U.S. customers only.

SQUAT is not currently offered to, marketed to, or targeted at people in the European Economic Area, the United Kingdom, or Switzerland, and we have no establishment there. We rely on the country you give at signup. On that basis, we do not consider the GDPR to apply to our own processing today, and we have not appointed an EU representative or put EU transfer mechanisms in place. If that changes — an EU establishment, EU-targeted marketing, or knowingly accepting EU customers — we will put the required measures in place and update this policy first.

If you are in the EEA, UK, or Switzerland, note that our practices are designed around U.S. law. A customer that brings EU personal information into its workspace does so as controller, under its own compliance obligations.

13. Children

The Service is for business use by adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. Do not put children's information into Customer Content.

14. Changes to this policy

When we make a material change, we will post the new version with a new version number and, where the change is material to your rights, ask you to acknowledge it.

15. Contact us

Elucidate Ventures LLC (d/b/a Elucidate Digital) Privacy requests: the support form at squat.pro/support (Data & privacy) Mail: 4569 Riverside Way, Philadelphia, PA 19127