Privacy Policy

Last updated: July 5, 2026

1. Controller Information

Sleepwalker is a brand operated by Sparrowise. Sparrowise is the data controller for your personal data:

Sparrowise
Spanker 2
Oude Wetering 2377VW
Netherlands
VAT: NL005202754B97

Email: info@sleepwalker.ai
Phone: +31618368830

Sparrowise acts as the data controller for your personal data.

2. Information We Collect

We collect the following data when you use Sleepwalker:

  • Account Information: email address and account settings
  • Billing Information: billing address and tax ID where applicable; full payment card details are collected and stored by Stripe and never reach our servers
  • URLs You Monitor: web pages you choose to analyze
  • Prompts and Queries: search prompts you enter
  • Brand and Competitor Data: names you track
  • Test Configuration: language and country metadata used to localize AI queries
  • Usage Data: features used, monitoring frequency, run history
  • Connector and API Activity: when you use API keys, the CLI, or a connected AI assistant, we log the actions performed (tool or endpoint name, outcome, and request metadata such as URLs and run identifiers) for security, billing, and abuse prevention
  • Device Information: browser type, IP address (used for rate-limiting and abuse prevention), general location

3. Legal Bases for Processing (GDPR)

We process your data based on:

  • Contract: to provide and operate the Service
  • Legitimate interests: improving performance, security, fraud prevention
  • Legal obligation: tax and compliance requirements
  • Consent: where applicable

4. How We Use Your Information

We use your data to:

  • provide and maintain the Service
  • process credit top-ups, payments, and tax requirements
  • generate AI-based insights and reports
  • send transactional emails (account, billing, and alert notifications)
  • rate-limit requests and prevent abuse
  • improve functionality and performance
  • respond to support requests
  • comply with legal obligations

We do not sell your personal data. We do not currently send marketing emails. If we introduce marketing communications in the future, they will be opt-in and you will be able to unsubscribe at any time.

5. Third-Party Processors (Subprocessors)

To provide the Service, we rely on the following third-party AI and infrastructure providers, each acting as a data processor on our behalf:

  • Supabase (EU) - authentication, database, and storage for accounts, monitoring data, and run history
  • Stripe (US/EU) - credit top-ups, payment processing, and tax calculation
  • OpenAI (US) - AI model processing for analysis features
  • Google (Gemini) (US/EU) - AI model processing for analysis features
  • xAI (Grok) (US) - AI model processing for analysis features
  • Perplexity AI (US) - AI model processing for analysis features
  • Resend (US/EU) - transactional email delivery for account, billing, and alert notifications
  • Render (US) - application hosting and operational logs
  • Cloudflare (US/EU) - content delivery, DNS, and edge security for all Sleepwalker domains, processing visitor IP addresses and request metadata

Depending on the functionality used, these providers may process URLs and web page content, prompts and queries you submit, brand names and competitor data, structured outputs generated by the Service, and account or billing identifiers needed to operate the Service.

All providers are contractually bound to process data in accordance with applicable data protection laws. A current list of subprocessors and a Data Processing Agreement (DPA) are available on request via info@sleepwalker.ai.

6. AI Provider Data Use

Prompts, brand names, competitor data, and other inputs you submit are sent to the AI providers listed above to generate the analyses you request. Each AI provider processes data under its own terms, privacy policy, and data usage policy. Those policies may differ by provider, account type, region, and product tier, and may change over time.

We do not control these providers' data usage practices. You should not submit confidential, proprietary, or personal data unless you are comfortable with the applicable provider terms.

7. Connected AI Assistants and Programmatic Access (MCP, API, CLI)

Sleepwalker can be used outside the web app: through our public API, our command-line tool (CLI), and as a connector for AI assistants such as Claude or ChatGPT (via the Model Context Protocol, MCP).

  • Data you direct to an assistant: when you connect an AI assistant and ask it to read your Sleepwalker data (tests, runs, reports), that data is disclosed to the assistant at your direction and is then handled under the assistant provider's own terms and privacy policy, not ours.
  • Data arriving from an assistant: inputs submitted through a connected assistant, API key, or the CLI (such as URLs, prompts, or brand names) are processed the same way as inputs entered on the website, including the AI provider processing described above.
  • Access credentials: connector access uses OAuth-issued tokens or API keys tied to your account. You can review and revoke them at any time in the Console. Billable actions requested through a connector use your prepaid credits.
  • Activity logging: connector and API actions are recorded in security audit logs as described in Sections 2 and 9.

8. International Data Transfers

Several of the providers listed above (including OpenAI, xAI, Perplexity, Render, Cloudflare, and parts of Stripe, Google, and Resend) process data outside the European Economic Area (EEA), primarily in the United States.

We rely on appropriate safeguards for these transfers, including Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework certification of the recipient.

9. Data Retention

We retain different categories of data for different periods:

  • Account and profile data: while your account is active and for up to 30 days after your account is deleted (deletion is available on request via info@sleepwalker.ai)
  • Monitoring tests, runs, and AI Citation results: while your account is active and for up to 30 days after account deletion
  • Security and access audit logs (API and connector activity): retained while your account is active
  • Billing records and invoices: 7 years (legal retention requirement under Dutch tax law)
  • Operational logs (request and error logs): typically 30 days, retained by our hosting provider
  • Email delivery metadata: typically 30 days, retained by our email provider
  • Anonymized or aggregated data: may be retained indefinitely for analytics and product improvement

10. Data Security

We implement industry-standard security measures, including:

  • encryption in transit (SSL/TLS)
  • secure storage practices
  • access controls
  • API keys and connector tokens are stored only as cryptographic hashes; the raw value is shown once at creation and never persisted

No method of transmission or storage is completely secure, but we take reasonable steps to protect your data.

11. Your Privacy Rights

Under GDPR, you have the right to:

  • access your data
  • correct inaccurate data
  • request deletion
  • request data portability
  • withdraw consent
  • object to processing
  • lodge a complaint with a supervisory authority (in the Netherlands: the Autoriteit Persoonsgegevens)

To exercise your rights, contact: info@sleepwalker.ai

12. California Privacy Rights

If you are a California resident, you may request:

  • access to your personal data
  • deletion of your data
  • correction of inaccurate data

We do not sell or share personal data.

13. Cookies and Local Storage

We keep client-side storage minimal:

  • Browser local storage: used to keep you signed in (your Supabase authentication session) and to remember interface preferences
  • Essential cookies: limited to those required for security, such as cookies set by our CDN (Cloudflare) for bot and abuse protection

We do not use tracking, advertising, or third-party analytics cookies.

14. Automated Processing and AI Outputs

The Service uses third-party large language models to generate analyses of brand visibility and competitor mentions in AI search results. These models are probabilistic and may produce outputs that are inaccurate, incomplete, or contain hallucinated content (citations, brand mentions, or facts that do not exist or are misattributed).

The outputs are intended as decision support, not as automated decisions producing legal or similarly significant effects. You remain responsible for reviewing AI-generated outputs before relying on them for any business decision.

15. Changes to This Policy

We may update this Privacy Policy from time to time.

For material changes, we will provide at least 30 days' notice by email or within the Service before the changes take effect.

16. Contact

For any privacy-related questions:

info@sleepwalker.ai