Privacy Policy

The controller of the personal data collected through sayso.es is:

• Name: Sayso
• Contact email: contact@sayso.es
• Address: Spain

Hereinafter, "Sayso", "we", or "the controller".

We collect the following data depending on how you use the service:

2.1 Account data

• Email address
• Authentication credentials (passwords are stored as hashes)
• Account creation date

2.2 Service usage data

• Projects created (name, slug, visual configuration)
• Testimonials received: author name, role, rating, text, and optional photo
• Optional video feedback, including recorded image and sound, and the time when the sender confirmed publication permission
• Testimonial requests sent: recipient name and email
• Account activity, sign-in times, project configuration changes, linked Google Place IDs, request delivery and usage counters

Video recordings are previewed on your device and uploaded when you submit the feedback. The receiving business can review the video in its dashboard. Videos approved for publication may appear in that business's website widget. Unpublished videos are stored in private storage and accessed through temporary links.

If the business chooses automatic video transcription, Sayso sends the video to AssemblyAI through its EU endpoint. The generated text remains a draft until the business approves the subtitles. Sayso requests deletion of the provider's transcript after saving the result; failed deletions are queued for retry. The business can also write subtitles manually.

Imported reviews retain their author, wording and source information. Businesses can assign tags, select which approved reviews appear in a widget, and export approved quotes as images. Optional review reminders stop when the invitation is answered, expires or is cancelled.

Authorized administrators may consult your account, project configuration, requests, reviews and videos to handle support and diagnose problems. The support view does not create a customer session or permit changes or payments. Administrator access is logged separately from customer activity. A saved Google Place ID links a public business listing; it does not grant access to your Google account.

2.3 Billing data

• Subscription and trial information (Starter, Growth, Scale, Business or a legacy plan, status, trial end, renewal date and account allowances)
• Card data is handled directly by Stripe; Sayso does not store or access full payment data

2.4 Technical data

• IP address, browser type, and operating system (server logs)
• Session cookies necessary for the service to function

We keep your data for as long as necessary for the purposes described:

• Account data: while the account is active. After deletion, data is removed within a maximum of 30 days, unless a legal retention obligation applies.
• Billing and transaction data: for the periods required by applicable tax and accounting law.
• Testimonials received: linked to the user's project; deleted when the project or account is deleted.
• Support and activity records: retained while necessary for support, security and legal obligations. Records linked to a deleted account are removed with that account, subject to required retention.

When a card is opened, Sayso records its identifier, time, approximate device category, destination and referring hostname, when available. To reduce repeated counts, the server computes a daily keyed hash from the IP address, card and user agent. The NFC analytics database does not store the raw IP or full user agent. Maintenance removes these deduplication hashes after 48 hours while retaining interaction statistics.

Card purchases link the business, responsible person's email, assigned seller, payment references and commission history. Sellers can see only their attributed business activity and commissions; account access requires email verification.

Google Maps Platform provides business search. Search queries are sent to Google; results and ratings are displayed temporarily. Sayso retains the Place ID and business account details independently provided by the customer. Google's processing is described in the Google Privacy Policy.

We share data only with the following third parties, acting as data processors:

• Supabase (database and authentication infrastructure)
• Stripe (payment gateway)
• Resend (transactional email delivery)
• AssemblyAI (optional video transcription, through its EU API endpoint)
• Vercel (application hosting and web analytics)
• PostHog (product activity analytics, when enabled)

Providers may process data outside the EEA depending on the service and its configuration. Where a transfer requires safeguards, the applicable mechanism may include an adequacy decision or standard contractual clauses. Contact us for information about the safeguards applicable to your data.

We do not sell or transfer personal data to third parties for commercial or advertising purposes.

As a data subject, you may exercise the following rights at any time before the data controller:

• Access: obtain confirmation of whether we process your data and receive a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data when, among other reasons, it is no longer necessary for the purpose for which it was collected.
• Restriction of processing: request that we suspend processing in certain circumstances.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: when processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, write to us at contact@sayso.es with the subject "GDPR rights request". We will respond within a maximum of one month.

If you believe that the processing of your data does not comply with the GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

We use session and preference storage to operate the service:

• Session cookie: keeps you authenticated during your visit. Its lifetime follows the authentication session and it is cleared when you sign out.
• Preferences cookie: stores language or interface settings chosen by the user.

The service also uses web and product analytics to understand visits, feature use and errors. Product analytics, when enabled, may use browser storage and identifiers to associate activity. You can manage browser storage in your browser settings and contact us to exercise your data protection rights.

We apply appropriate technical and organizational measures to protect your data against unauthorized access, accidental loss, or destruction:

• Hashed passwords
• Encrypted communications via TLS/HTTPS
• Account isolation and restricted support access
• Restricted data access by personnel

The service is aimed at professionals and businesses. We do not knowingly collect data from minors under 16. If you are a parent or guardian and believe a minor has provided personal data, contact us at contact@sayso.es so we can proceed with deletion.

We may update this policy to reflect changes in the service or applicable regulations. We will notify you of relevant changes by email or through a visible notice on the platform at least 15 days in advance. The most recent version will always be available at sayso.es/privacy.

For any questions about this policy or the processing of your data, you can contact us at:

• Email: contact@sayso.es