Privacy Policy

Last updated: August 29, 2026.

What we collect

When you sign up, we collect your email address and account details. When you use the product, we store the business information you provide (name, industry, location settings) and the customer records you import or connect (name, email, phone, and visit date) so we can send review-request emails and draft replies on your behalf.

How we use it

Customer records are used only to send the review-request emails you've configured and to let you draft replies to reviews. We do not sell customer data, and we do not use it to train AI models beyond generating the specific drafts your account requests.

Who we share it with

We use subprocessors to run this service: Supabase (database/auth), Anthropic (AI drafting), Resend (email delivery), and Paddle (billing). Each processes data only as needed to provide their part of the service.

Legal basis for processing (EU/UK/EEA users)

Where GDPR or UK GDPR applies, we process account and business-owner data on the basis of contract necessity (to provide the service you've signed up for) and process imported customer records on the basis of your legitimate interest in requesting reviews from your own recent customers, and ours in providing the platform that does so on your behalf.

International data transfers

Our subprocessors (Supabase, Anthropic, Resend, Paddle) may store or process data outside the EU/EEA, including in the United States. Each operates under its own Data Processing Agreement, which is expected to incorporate a valid transfer mechanism (such as the EU Standard Contractual Clauses) where one is required — we haven't independently audited each of these, and if this matters for your business, confirm the specifics directly with each provider rather than relying on this page alone.

Your rights under GDPR (EU/UK/EEA users)

You have the right to access, correct, delete, or export a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing depends on it. To exercise any of these, email support@sayswell.com. You also have the right to lodge a complaint with your local data protection supervisory authority at any time.

Unsubscribing (your customers)

Every review-request email includes a working unsubscribe link. Clicking it immediately stops future emails to that address.

Data retention

If you cancel your subscription, your account becomes read-only immediately. Data is retained for 30 days in case you resubscribe, then permanently deleted.

Healthcare-adjacent data

This service is not currently configured to legally handle Protected Health Information (PHI) under HIPAA. If your business is a US-based dental or medical practice, only import customers who have separately consented to marketing contact — never patient or appointment records.

Contact

Questions about your data, or to exercise a data access/deletion request: support@sayswell.com.