Data Security & Privacy Overview
At Smart, data security and privacy are foundational. We work with sensitive business data, and our system is designed to minimize data exposure while maintaining transparency, auditability, and user control.
This Privacy Policy explains how Smart accesses, processes, protects, and retains data when you use our services.
1. Core Principles
Least data access
Smart processes only the minimum information required to answer your questions.
No unnecessary storage
We avoid storing customer business data beyond what is required to operate the service.
User visibility and control
You have full visibility into how your data is used and can control access at any time.
2. Data Handling & Processing
Least-Data Principle
Smart processes only the minimum information required to answer a user's question. This may include:
Smart never ingests full tables unless explicitly required to perform an analysis initiated by the user.
- Database or file schema metadata and definitions
- Limited data samples (≤10 rows per column) strictly for query disambiguation
- User-provided inputs (e.g., questions, filters)
In-Memory Processing
Query data is processed in memory
- Data is not written to disk as part of query execution
- Smart does not maintain a persistent copy of customer databases or spreadsheet contents
3. Data Storage
Smart does not store customer business data or query results beyond what is required to operate the service
Configuration data (e.g., connection settings, schema mappings) may be retained to support continued use
Customer data is not used to train foundation models unless explicitly agreed in writing
4. Encryption & Security Controls
Industry-Standard Security
Smart applies industry-standard security measures, including:
- Encryption in transit using TLS
- Encryption at rest at the infrastructure or database layer
- Isolated customer environments to prevent cross-customer access
5. Regional Data Isolation & Deployment
Dedicated Environments
Each customer operates in a dedicated, isolated environment
Regional Deployment Options
Regional deployment options are available (e.g., EU-based deployment for GDPR considerations)
Customers are responsible for selecting a deployment region aligned with their regulatory obligations
6. Onboarding & Data Preparation
Lightweight Onboarding
Smart uses a lightweight onboarding approach:
No additional data preparation or restructuring is required.
- Direct connection to databases or file sources
- Automated schema mapping
- Optional use of existing table documentation
7. Auditability & Transparency
SQL Visibility
Users can view SQL queries generated by Smart at any time.
Reasoning Traceability
Where applicable, Smart surfaces the logic used to generate outputs, allowing users to validate and audit results before acting on them.
8. User Responsibilities
Users are responsible for:
• The accuracy and legality of data they provide
• Reviewing outputs before using them for business or operational decisions
• Ensuring internal compliance with applicable laws and policies
Smart provides analytical assistance, not professional advice.
9. Google User Data Disclosure (OAuth Compliance)
Data Accessed
When you connect Google services (e.g., Google Sheets), Smart may access:
Smart does not access Google Drive data or files unless explicitly authorized by the user.
- Spreadsheet metadata (file name, structure)
- Spreadsheet contents explicitly selected by the user
- Account identifiers required for authentication
Data Usage
Google user data is used solely to provide the Smart service, including:
Google user data is not used for advertising, profiling, or marketing purposes.
- Reading spreadsheet structure and contents to answer user questions
- Generating analytical outputs such as tables and charts
- Enabling interactive analysis based on user input
Data Sharing
Smart does not sell or share Google user data.
- Google user data may be processed by Smart's infrastructure providers (e.g., cloud hosting) strictly to operate the service
- AI service providers used to generate analytical outputs, under contractual confidentiality obligations
- All processing is limited to delivering the requested functionality
Data Storage & Protection
Google user data is processed in memory where possible
- Data is encrypted in transit (TLS) and protected using industry-standard controls
- Smart does not maintain a persistent copy of Google user data beyond what is required to provide the service
Data Retention & Deletion
Google user data is retained only for the duration necessary to deliver the service
- Users may disconnect Google services at any time, revoking Smart's access
- Users may request deletion of associated metadata or configuration data by contacting Smart via get-smart.co
- Upon deletion, all retained Google user data under Smart's control is removed
No Training Commitment
Smart does not use Google user data to train foundation models unless explicitly agreed by the user in writing.
10. Questions or Additional Requirements
If your organization has specific security, privacy, or compliance requirements, please contact us. We are committed to meeting enterprise expectations as we scale with our customers.