Privacy Policy

1. Who we are

Sayweek is operated by MAD Consulting L.L.C-FZ (Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.; “we”, “us”). Contact: hello@sayweek.com. Company details: Legal notice.

Sayweek is for businesses only (B2B). For account data, billing, the contract acceptance log and the website (sayweek.com) we are the controller. For the content our customers put into Sayweek (posts, ideas, data from connected calendars, mailboxes and CRMs, their clients’ feedback) we act as a processor on the customer’s behalf, under the Data Processing Agreement (DPA); the customer is the controller of that data.

2. What we process, why, and on what legal basis

• Account: name, e-mail address, sign-in data (password hash, passkey public key, the encrypted two-factor secret), language, workspace, team membership – to let you sign in and to provide the service. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Content: brands, channels, posts, ideas, dictated notes turned into text, images and videos, your story bank – to write, schedule and publish your posts. Here we act as a processor (see section 1).
• Connected accounts (only if you connect them; on the customer’s instructions, as a processor):
  • Google Calendar (read-only): event titles, dates and locations – to avoid posting on travel or holiday days and to suggest topics.
  • Gmail (read-only, optional): subject and snippet of messages from the last 7 days for weekly topic ideas – message bodies and attachments are never read. Sensitive messages are skipped, then names, e-mail addresses, phone numbers, bank details and links are masked; only the masked subject and snippet are sent to our AI provider (Anthropic) to write the idea. Nothing from the message is stored except that short, anonymised idea and a link back to the thread. Disconnecting revokes our access at Google.
  • HubSpot CRM (read-only, optional): recent deals and completed meetings for weekly topic ideas. Before anything is sent to the AI, company and person names, e-mail addresses, amounts and anything price- or contract-related are removed; only industry, company size band, deal stage and a few topic words remain. No CRM records are stored – only short-lived fingerprints (hashes of record ids, kept 30 days) so the same event is not used twice. Nothing is written back to HubSpot.
  • Pipedrive CRM (read-only, optional): recent deals (won, new, stage changes) and the subjects of completed meetings and calls for weekly topic ideas. Deal values, products and notes are never requested; organisation and person names are used only to mask them and are never sent to the AI. Only deal stage, pipeline and a few topic words remain. No CRM records are stored – only short-lived fingerprints (hashes of record ids, kept 30 days). Nothing is written back to Pipedrive.
  • Google Analytics 4 (read-only, optional, analytics.readonly): based on the UTM parameters of the links in your posts we show how many visits and conversions each post brought to your website. Only numbers aggregated per campaign / post are fetched and stored (sessions, engaged sessions, key events, revenue) – no visitor-level or personal data. Nothing is changed in Analytics; disconnecting also deletes the stored numbers.
  • YouTube (optional, youtube.upload, youtube.readonly): uploading your approved videos to your channel on your behalf, and statistics of your own videos. Video files are kept in Vercel Blob storage until the upload.
  • TikTok (optional): publishing your approved videos and photos on your account (or as drafts to the TikTok app), showing your account name and picture, and view counts of your own videos.
  • Canva (optional): listing your designs, creating a new design and bringing the chosen design into a post as an image; we may upload the post image to your Canva account for editing.
  • Notion (optional): access only to the pages and databases you share – we write the content calendar there and read ideas from the database you choose.
  • Google Drive: photos you pick and the export folder.
  • iCloud Calendar (read-only), Apple Reminders (the “Sayweek” list), Outlook calendar (via an ICS link, read-only).
  • LinkedIn / Instagram / Facebook (via Postiz or a direct integration): publishing on your behalf and statistics of your own posts.
  • Instagram competitors (optional): public numbers of other Instagram business/creator accounts you enter (Meta Business Discovery API), aggregated only (followers, posting frequency, average engagement, format mix, best days). Their posts and captions are not stored; at refresh time captions are only used to derive 3–5 generic topic words. LinkedIn accounts are not analysed.
  • Bluesky, Threads, Google Business Profile, Pinterest (optional, direct integration): publishing your approved posts on your account or business location on your behalf, and statistics of your own posts. For Bluesky we store an app password you create for Sayweek (encrypted), never your main password.
  • Microsoft 365 (optional, Microsoft Graph, read-only; only the parts you switch on): Outlook calendar events (like Google Calendar), subject and snippet of Outlook e-mails for weekly topic ideas (message bodies are not stored), and the OneDrive / SharePoint files you pick for a post. Nothing is written back to Microsoft 365.
  • Meeting transcripts (optional: connected Zoom, Google Meet, Microsoft Teams, Fireflies.ai, Fathom, tl;dv, or added by hand: pasted text, an uploaded .txt / .vtt / .srt / .docx file, a recap e-mail forwarded to your idea address, a transcript sent to the bot): transcripts are read in memory only, to suggest topic ideas; we store the ideas written from them and – so the same one is not used twice – a hash of their words. Meetings marked private or confidential are skipped; before anything is sent to the AI, names, company names, e-mail addresses, phone numbers, links and sentences about prices, contracts, health or personal matters are removed. The transcript itself is never stored – only the short, anonymised idea written from it. Recording the meeting and informing the participants happens in the meeting tool, under your responsibility.
  • Telegram and WhatsApp bots (optional): if you link your chat, the messages, links and voice notes you send to the Sayweek bot become ideas in your workspace (voice notes are transcribed; the audio and photos are not kept). We store the chat id and display name to recognise you. Messages pass through Telegram or Meta (WhatsApp Business Platform) under their terms.
  • Stock photos (optional, Unsplash / Pexels): when you search, the search words (suggested from your post, editable) are sent to Unsplash or Pexels; the photo you pick is fetched and attached to the post with the photographer’s credit. No personal data is sent.
  • Zapier, Make, the API, the browser extension and AI assistants (only if you connect them): with an API key or an approved connection (e.g. Claude or ChatGPT via MCP) they read and write the posts and ideas of your workspace within the permissions you grant. Data they receive is processed under your own agreement with that service; you can revoke keys and connections at any time.
  • Slack / Microsoft Teams (optional): notifications to the channel you set; the webhook address is stored encrypted.
• Billing and payment: billing name, address, tax number, e-mail, plan, amounts, issued invoices. Payments are handled by Stripe (card and Stripe’s Link express checkout). We never see or store card data. Legal basis: performance of the contract (b); for keeping invoices, a legal obligation (c).
• Contract acceptance log: see section 3.
• E-mails: service notifications (e.g. a post awaiting approval, a report, an invoice) – performance of the contract (b); short tips during the first weeks – legitimate interest (f); every such e-mail has a one-click unsubscribe link.
• Product news by e-mail (to users of our existing customers): a few short e-mails a year about Sayweek’s most important news. For this we process your e-mail address, your language and, per recipient, the delivery data: when it was sent, delivered, opened (only if open tracking is switched on at the e-mail provider), when a link in it was clicked (links go through our own redirect address), bounced or unsubscribed. The e-mails are sent by Resend, which notifies us (webhook) of deliveries, opens, clicks, bounces and spam complaints; a spam complaint unsubscribes you automatically. Legal basis: legitimate interest – communication with existing customers (f). Unsubscribe: with one click in every e-mail (at the bottom and with your mail app’s “Unsubscribe” button), or in the app with the “Product news by e-mail” switch in the “What’s new” panel; this does not affect trial or service e-mails. [retention of delivery data (opens, clicks); whether open tracking needs consent (Art. 5(3) ePrivacy Directive, § 25 TDDDG)]
• Push notifications (if you switch them on): the device token or the browser’s subscription address – to deliver notifications (b).
• Technical and security logs: errors (kept 30 days), API call counts, the workspace activity log (who approved, connected or deleted what) – for operation, troubleshooting and abuse prevention. Legal basis: legitimate interest (f).
• Website chat and contact (sayweek.com): the messages you type into the chat are processed by Anthropic’s Claude model to answer you (e-mail addresses and phone numbers are masked first; Anthropic does not train on them). If you ask for a demo, free sample posts or pricing, we store – based on your consent (a) – the details you give (name, e-mail, company, role, team size, phone, preferred time, message, the website or profile URL you enter), the last 20 messages of the conversation at most, the page you wrote from, the first page you opened, the referring page and the link’s UTM parameters, so we can contact you. For sample posts we fetch the public homepage of the website you enter once; LinkedIn profiles are never read – only what you write about yourself. Retention: 24 months or until you ask us to delete it (you can withdraw your consent at any time: hello@sayweek.com). Chat opens and visits are counted anonymously (a random id tied to the browser tab, no IP address, 90 days).
• Compared to similar businesses (on by default, can be switched off under Settings → Data and privacy): anonymous, aggregated numbers are made from your posts’ results (e.g. which day or opening works better) by industry, country, language and network. No texts, names, clients or ids go into them, and a group’s results are only shown when at least 5 different workspaces stand behind it – legitimate interest (f), to improve the product and inform users.
• Cookies and local storage: we only use our own (first-party) cookies – no third-party tracking or advertising cookies or pixels. The only cookie that needs your consent is sw_attr (how you reached us, 90 days) – legal basis: consent (a), also under the ePrivacy rules. If you arrive through a customer’s referral link (/ref/…), the sw_ref cookie remembers the referral code for 60 days so you both get the reward when you sign up; the referrer only sees counts (sign-ups, paying referrals), not who you are – legal basis: legitimate interest (f). The full list, durations and how to withdraw consent: Cookie Policy.

We do not sell your data and do not use it for advertising. There is no automated decision-making or profiling that produces legal effects concerning you.

3. Log of accepting our terms

When you accept the Terms and this policy (and, as workspace owner on behalf of the business, the DPA), or a materially changed version of them, we record in the legal_acceptances table:

• the user, their e-mail address at that moment and the workspace;
• the document, its version and language, for the DPA the name of the business, and the “business use only (B2B)” confirmation;
• the time, and whether it happened at sign-up or as a re-acceptance, on the web or in the phone app;
• a truncated IP address (the /24 network for IPv4, the /48 network for IPv6, e.g. 203.0.113.0), a keyed hash of the full IP address (HMAC – the address itself is not stored) and the browser’s user agent.

Purpose: to prove who accepted which version of the text and when. Legal basis: performance of the contract (b) and our legitimate interest in proving the conclusion of the contract and in establishing, exercising or defending legal claims (f). Retention: for the term of the contract and then until the limitation period ends [exact retention period, e.g. 5 years after the contract ends – to be confirmed by counsel].

4. Artificial intelligence

Posts are drafted by Anthropic’s Claude from your data, at your request; optionally OpenAI and Google Gemini can also suggest ideas, create images or transcribe voice notes. These providers do not train their models on data received through their APIs. From your data we only derive style rules for your own workspace (e.g. “shorter sentences”); no other customer sees them and we do not train any general model with them. Nothing is published without your approval. Details: AI & Content Policy.

5. Google user data – Limited Use

Sayweek’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to develop, improve or train generalised AI/ML models. Humans do not read it except with your explicit consent, for security purposes, or to comply with the law.

6. LinkedIn and Meta data

Content of other members retrieved from LinkedIn (e.g. comments) is stored for no longer than 48 hours. We do not export, sell or combine LinkedIn member data, and do not use it for recruiting, ad targeting or lead generation. Comments under your Facebook and Instagram posts (author name, text) are likewise cached for at most 48 hours for the comment inbox; afterwards only their ids are kept for 14 days so we never notify you twice about the same one.

7. Who receives the data (sub-processors)

Data is only shared with the sub-processors we need to provide the service, under contract: Vercel (hosting), Neon (database, EU), Anthropic (AI text), Resend (e-mail), Stripe (payments) – and, where the feature is switched on: Postiz (scheduling), OpenAI and Google Gemini (transcription, images, ideas), Meta (WhatsApp Business Platform – for the WhatsApp bot), Sentry (error reporting) and the Apple / Google push services that deliver notifications.

The up-to-date list – purpose, data, location – is here: Sub-processors. The accounts and tools you connect (e.g. Google, Microsoft 365, LinkedIn, Meta, TikTok, Bluesky, Zoom, Fireflies.ai, Fathom, tl;dv, Telegram, Unsplash, Pexels, Zapier, Make, Pinterest, Dropbox, Figma, Airtable, Mailchimp, Discord) are not our sub-processors: their own terms apply and we only talk to them on your instructions. We disclose data to authorities only where the law requires it.

8. International transfers

The database is located in the EU (Frankfurt). The operator is registered in the United Arab Emirates (UAE), so the UAE Federal Personal Data Protection Law (PDPL, Federal Decree-Law No. 45 of 2021) applies to us; because we offer the service to customers in the EU, so does the GDPR (Art. 3(2)). There is no EU adequacy decision for the UAE.

Transfers outside the EU/EEA (e.g. to the UAE, to our support staff, or to sub-processors in the USA) rely on the European Commission’s Standard Contractual Clauses (SCCs) or, where the provider is certified, on the EU–US Data Privacy Framework. [specify the transfer mechanism: SCC modules towards the UAE processor/controller, EU–US DPF certification per provider, transfer impact assessment (TIA)]

9. How long we keep data

• Account and content: as long as your account exists. On deletion all data is removed from the database immediately and from backups within 30 days.
• Issued tax invoices and credit notes (with the billing details on them: name, address, tax number, amounts): 5 years, as required by UAE VAT law, even after the account is deleted. Stripe keeps its payment records for the period its own rules require.
• Contract acceptance log: see section 3.
• Error log: 30 days. Anonymous visit counts: 90 days. CRM fingerprints: 30 days. Other people’s comments: 48 hours. Product-news deliveries: [retention period].
• Website enquiries: 24 months or until you ask us to delete them.

Details and steps: Delete your data.

10. Your rights

You may request access, rectification, erasure, restriction of processing and data portability (Settings → Data & privacy → Export); you may object to processing based on legitimate interest, and withdraw your consent at any time (in the cookie bar, via the unsubscribe link or by disconnecting any integration) – without affecting the lawfulness of processing before the withdrawal. We answer within 30 days: hello@sayweek.com.

If your data was entrusted to us by one of our customers (as their processor) – for example as a client of an agency – please address your request to that customer first; we help them to fulfil it.

You may lodge a complaint with the data protection authority where you live or work (in Hungary: NAIH, naih.hu), and you may also go to court.

11. Security

Encrypted transport (HTTPS/TLS), access tokens encrypted at rest (AES-256-GCM), passkey or two-factor sign-in, strict per-workspace data isolation, an activity log. Details and how to report a vulnerability: Security.

12. Contact, DPO, EU representative

For any privacy question write to hello@sayweek.com.

• Data protection officer (DPO): [whether a DPO must be designated (Art. 37 GDPR); if so, name and contact]
• EU representative (Art. 27 GDPR): [whether an EU representative is required and, if so, who (name, address in the EU)]

13. Changes to this policy

The version and effective date of this policy are shown at the top of the page. We tell you about material changes in advance, by e-mail and in the app, and ask you to accept the new version; earlier versions are available on request.