Watson — Privacy Policy (DRAFT v1)

DRAFT — prepared by Jarvis as a starting point, NOT legal advice. An attorney must review and finalize this before it is published (plan §6.1). The data-broker / CCPA-registration and CCPA/GDPR-specific sections in particular need counsel's read — they are flagged inline.

Operator: Summit Intake Systems LLC ("SIS," "we," "us") · Florida, USA Service: Watson — AI-assisted prospect research for sales preparation Last updated: 2026-06-25 · Contact: privacy@summit-intake.com

1. Two kinds of data we handle

Customer account data — you, our paying user: your email, login session, billing identifiers, and the search inputs you type. We use this to run the service, bill you, and support you.
Research-subject data — information about the third-party people you research. This is compiled from public records and publicly available sources (business filings, court/government records, public web, news). Watson is a sales-preparation tool; the dossiers it produces are about business/professional contacts.

2. Where research-subject data comes from

Public-record-first. We prioritize government and public-record sources and publicly available professional information.
Each fact carries a confidence badge (Confirmed / Likely / Unverified / Couldn't-find). Dossiers are AI-generated decision support, not verified background checks (see §6).
We do not publish residential/home addresses of individuals, and we omit information that would dox a private individual rather than brief a business contact.

3. NOT a consumer report

Watson is not a consumer reporting agency and dossiers are not consumer reports under the FCRA. You may not use Watson to make decisions about credit, employment, housing, insurance, or tenant screening, or for any other FCRA-covered purpose. (See the Terms / Acceptable Use.)

4. Service providers we share data with

Anthropic — AI processing of the research run. Cloudflare — hosting, database, storage. Resend — transactional email. Stripe — payment processing. Each processes data only to provide its function.
We do not sell customer account data.
[COUNSEL FLAG] Whether SIS qualifies as a "data broker" (e.g., CA data-broker registry / CA DELETE Act) given the research-subject data is a pending legal question (plan §6.1). This section must be completed per counsel's determination before launch.

5. Data-subject rights & takedown

Any individual who is the subject of a dossier — or any user — may request access, correction, or deletion of information about them. Email privacy@summit-intake.com; we will respond within [X business days] and remove or correct verifiable inaccuracies and honor valid deletion/opt-out requests.

[COUNSEL FLAG] CCPA (California) and GDPR (EU) specific rights, timelines, and opt-out/"do not sell" mechanics need counsel's tailoring. Automated deletion/opt-out is deferred (plan §6.2); requests are handled manually during beta.

6. Accuracy

Dossiers are AI-generated from public sources and may contain errors or stale information. They are a starting point for your own judgment, not a verified record. Confirm anything material before relying on it.

7. Retention & security

We retain dossiers and account data for as long as your account is active or as needed to provide the service, then delete or anonymize per our retention schedule [DEFINE]. Data is stored with tenant isolation; each customer's data is walled off from others. Secrets are stored in a secrets manager, never in code.

8. Children

The service is for business use by adults; it is not directed to anyone under 18.

9. Changes

We'll post changes here and update the "Last updated" date.

Draft ends. Attorney review required. Bracketed [items] need real values; [COUNSEL FLAG] sections need a lawyer.