Sayweek

Privacy Policy

Effective: 2026-09-29 · Magyar változat

1. Who we are

Sayweek is operated by MAD Consulting L.L.C-FZ (Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.). Contact: info@madconsulting.ae. For content our customers put into Sayweek we act as a processor; for account data we are the controller.

2. What we process and why

  • Account: name, e-mail, sign-in data (password hash, passkey public key) – to let you sign in.
  • Content: brands, channels, posts, ideas, dictated notes turned into text, your story bank – to write and schedule your posts.
  • Connected accounts (only if you connect them):
    • Google Calendar (read-only): event titles, dates and locations – to avoid posting on travel/holiday days and to suggest topics.
    • Gmail (read-only, optional): subject and snippet of messages for weekly topic ideas. Message bodies are not stored; only a short, anonymised idea written from them.
    • HubSpot CRM (read-only, optional): recent deals and completed meetings for weekly topic ideas. Before anything is sent to the AI, company and person names, e-mail addresses, amounts and anything price- or contract-related are removed; only industry, company size band, deal stage and topic words are used. No CRM records are stored – only short-lived fingerprints (hashes of record ids, kept 30 days) so the same event is not used twice. Nothing is written back to HubSpot.
    • Pipedrive CRM (read-only, optional): recent deals (won, new, stage changes) and the subjects of done meetings and calls for weekly topic ideas. Deal values, products and notes are never requested; organisation and person names are used only to mask them and are never sent to the AI. Only deal stage, pipeline and topic words are used. No CRM records are stored – only short-lived fingerprints (hashes of record ids, kept 30 days) so the same event is not used twice. Nothing is written back to Pipedrive.
    • Google Analytics 4 (read-only, optional, analytics.readonly): based on the UTM parameters of the links in your posts we show how many visits and conversions each post brought to your website. Only numbers aggregated per campaign / post are fetched and stored (sessions, engaged sessions, key events, revenue) – no visitor-level or personal data. Nothing is changed in Analytics; disconnecting also deletes the stored numbers.
    • YouTube (optional, youtube.upload, youtube.readonly): uploading your approved videos to your channel on your behalf, and statistics of your own videos. Video files are kept in Vercel Blob storage for the upload.
    • TikTok (optional): publishing your approved videos and photos on your account (or as drafts to the TikTok app), showing your account name and picture, and view counts of your own videos.
    • Canva (optional): listing your designs, creating a new design and bringing the chosen design into a post as an image; we may upload the post image to your Canva account for editing.
    • Notion (optional): access only to the pages and databases you share – we write the content calendar there and read ideas from the database you choose.
    • Google Drive: photos you pick and the export folder.
    • iCloud Calendar (read-only) and Apple Reminders (the “Sayweek” list).
    • LinkedIn / Instagram / Facebook (via Postiz or direct integration): publishing on your behalf and statistics of your own posts.
    • Instagram competitors (optional): public numbers of other Instagram business/creator accounts you enter (Meta Business Discovery API), aggregated only (followers, posting frequency, average engagement, format mix, best days). Their posts and captions are not stored; at refresh time captions are only used to derive 3–5 generic topic words. LinkedIn accounts are not analysed.
  • Billing: handled by Stripe; we never see or store card data.
  • Technical logs: errors and API call counts – for operation and abuse prevention.
  • Website chat and contact (sayweek.com): the messages you type into the chat are processed by Anthropic's Claude model to answer you (e-mail addresses and phone numbers are masked first; Anthropic does not train on them). If you ask for a demo, free sample posts or pricing, we store – based on your consent – the details you give (name, e-mail, company, role, team size, phone, preferred time, message, the website or profile URL you enter), the last 20 messages of the conversation at most, the page you wrote from, the first page you opened, the referring page and the link's UTM parameters, so we can contact you. For sample posts we fetch the public homepage of the website you enter once; LinkedIn profiles are never read – only what you write about yourself. Retention: 24 months or until you ask us to delete it (you can withdraw your consent any time: info@madconsulting.ae). Chat opens are counted anonymously (a random id tied to the browser tab, no IP address, 90 days); no cookies are used – local browser storage only remembers whether you closed the greeting.

3. Artificial intelligence

Posts are drafted by Anthropic’s Claude from your data at your request. Anthropic does not train its models on data received through its API. From your data we only derive style rules for your own workspace (e.g. “shorter sentences”); no other customer sees them and we do not train any general model with them. Nothing is published without your approval.

4. Google user data – Limited Use

Sayweek’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to develop, improve or train generalized AI/ML models. Humans do not read it except with your explicit consent, for security purposes, or to comply with law.

5. LinkedIn data

Content of other members retrieved from LinkedIn (e.g. comments) is stored for no longer than 48 hours. We do not export, sell or combine LinkedIn member data, and do not use it for recruiting, ad targeting or lead generation. Comments under your Facebook and Instagram posts (author name, text) are likewise cached for at most 48 hours for the comment inbox; afterwards only their ids are kept for 14 days so we never notify twice about the same one.

6. Sub-processors

Vercel (hosting), Neon (database, EU), Anthropic (AI text), OpenAI and Google (transcription, images – optional), Postiz (scheduling), Stripe (payments), Resend (e-mail). Transfers outside the EU rely on the European Commission’s Standard Contractual Clauses.

7. Retention

For as long as your account exists. On deletion all data is removed from the database immediately and from backups within 30 days. Billing records are kept by Stripe as required by accounting law.

8. Your rights

Access, rectification, erasure, portability (Settings → Data & privacy → Export), objection, and withdrawal of consent (disconnect any integration). You may complain to your local data protection authority. Deletion requests: Data deletion.

9. Security

Encrypted transport (HTTPS), access tokens encrypted at rest (AES-256-GCM), passkey sign-in, strict per-workspace data isolation.

Privacy Policy – Sayweek