Who we are
Upstream Digital Ltd, trading as Sayso, is a company registered in England and Wales (company number 17391096; registered office Wills House, St John's Road, Bristol BS3 1FR). We are the controller for Sayso account, billing, website and service-usage data. Contact hello@sayso.digital about privacy or your rights.
When a customer records a website containing somebody else's personal data, the customer decides what to capture and why. For that customer content, the customer is normally the controller and Sayso acts as its processor when the content is published to our portal.
The short version
We do not sell personal data or use review content for advertising. OpenAI states that API inputs and outputs are not used to train its models by default. We do use the processors and user-selected integrations described below to operate the service.
What we collect and why
| Feature | Data and use |
|---|---|
| Extension capture | Page address, selected element details, screenshots, voice transcript, optional tab/camera recording, comments and report settings. Held in extension storage while you work and used to create the report. |
| Speech and AI | Chrome speech recognition may send audio to Google's speech service. Live Fix audio is sent through Sayso to OpenAI for transcription. Transcript cleanup sends comment text, page address and the selected element's visible text. Live Fix generation sends your instruction and relevant element context; those routes use Sayso's server API key. The separate optional Improve accuracy button sends the recorded review audio directly from the extension to OpenAI using an API key you enter and keep in extension storage; Sayso does not receive that key. |
| Portal account | Email, user ID, session data, optional name, role, company and referral source; used for sign-in, personalisation, team access, support and account operation. |
| Published reviews | Reviewed site and page addresses, comments, screenshots, selectors, optional video, branding, status, replies, approvals and reactions; used to host the review and collaboration link. |
| Live Fix and Speed | Page address, selected element/context, requested and generated changes, before/after images, client responses, performance metrics and findings; used to provide those features. |
| Viewer activity | Replies, approvals, reactions, names people choose to enter and completion ticks. Read receipts (opens, furthest point and video percentage) are off by default and start only if a viewer presses Allow read receipts. A pseudonymous browser identifier links repeat activity. |
| Billing | Plan, status and Paddle customer/subscription identifiers. Paddle, our merchant of record, handles payment details, invoices and tax; Sayso does not receive full card details. |
| If you join the waitlist on our homepage, the email address you enter is collected by our website host's form service (Netlify Forms) and we then add it to MailerLite for onboarding messages; your browser does not contact MailerLite. Email and optional profile fields are synced to MailerLite for onboarding and relevant product messages. Supabase Auth and our email provider deliver sign-in, invite, reply and approval messages. Every marketing message provides an unsubscribe route. | |
| Legacy self-host setup | An unsupported setup page can store a custom Supabase project URL, public anon key and purpose-made ingest/portal credentials in browser local storage and encode them - not encrypt them - in a connect code copied to the extension. The referenced setup SQL is not currently supplied. Never enter a service-role key, database password or administrator secret. If you choose this legacy route, you operate and control that separate Supabase project. |
| Website and support | Netlify may process IP address, user agent, request and security logs when serving the site. Fonts are served from our own domain, so an ordinary page view on this website contacts no third party other than our host; signed-in portal pages also contact Supabase and load Paddle's checkout script. If you send feedback or contact us, we process the message and contact details to respond. |
Our lawful bases
- Contract: account access, capture, publishing, sharing, collaboration, support and billing needed to provide Sayso.
- Legitimate interests: service security, abuse prevention, reliability and limited product onboarding. We balance these interests against people's rights.
- Consent: optional viewer read receipts and marketing where consent is required. Consent can be withdrawn at any time; turning receipts off stops future receipt updates.
- Legal obligation: tax, accounting, fraud and responses required by law.
If you do not provide data necessary to create an account or publish a review, that feature cannot work. Sayso does not use personal data for solely automated decisions that have legal or similarly significant effects.
Sharing links and viewers
Review and Live Fix links are capability links: they are difficult to guess but are not passwords. Anyone who receives or forwards the link can open its content and collaborate. Treat one like an unlisted video. Deleting the review or Live Fix set revokes the link immediately.
On a review page, a notice explains exactly what a read receipt contains. Receipts are off until the viewer opts in. Replies, reactions, ticks, approvals and a name are sent only when the viewer chooses those actions. The review owner and members of its shared Studio workspace can see that activity.
Optional integrations
If you choose Trello, Asana or Slack, Sayso sends the feedback content you select to that service. Integration credentials are stored in protected extension storage; requests go to the selected service. Those providers then process the content under their terms. Exported HTML, PDF, Markdown and email-summary files are controlled by whoever exports and shares them. Exported HTML report files from extension 2.58.2 or later embed their fonts and request nothing from any third party when opened. Files exported by earlier extension versions reference Google Fonts, so a browser that opens one of those older files requests font files from Google. The legacy self-host connection described above is unsupported and stores its values locally until you clear them; base64 connect-code encoding is not encryption.
Processors and other recipients
- Supabase - database, authentication, Edge Functions and private media storage. Privacy.
- OpenAI - API transcription, transcript cleanup and Live Fix generation. API content may be retained for abuse monitoring for up to 30 days unless a different approved retention control applies, and is not used for model training by default. Enterprise privacy.
- Google - Chrome and browser speech recognition. Privacy.
- Netlify - website hosting and request/security logs. Privacy.
- Resend and Supabase Auth email - account, invite and service-notification delivery. Resend privacy.
- MailerLite - subscriber, onboarding and product-email management. Privacy.
- Paddle - independent merchant of record for checkout, payment, tax, invoices and subscription management. Privacy.
- Trello, Asana and Slack - only when a user activates the relevant export or integration.
Providers may process data in the UK, EEA, United States or other countries where they and their subprocessors operate. Where UK data-protection law requires safeguards for an international transfer, we rely on the provider's contractual transfer terms, the UK International Data Transfer Addendum or another valid mechanism. Contact us for information about safeguards relevant to your data.
Retention and deletion
- Unpublished extension work: kept in extension storage while needed for the review and local settings. You can clear it in the extension or by removing the extension. Exported files remain wherever you or a recipient saved them.
- Portal content: kept until the account holder deletes the review, Live Fix set or account. Database content and share access are removed immediately when deletion succeeds.
- Private media: deletion is placed in a durable queue and normally completes on the next five-minute worker run. Failures retry with backoff; unresolved failures are surfaced for an operator. Completed queue audit records are removed after 30 days.
- Read receipts and collaboration: kept with the review and deleted with it.
- Account deletion: the portal cancels an active Sayso subscription, asks MailerLite to forget the subscriber, physically removes inventoried private media, deletes account-bound product data and the Supabase login, and revokes links you own. Collaboration attached to reviews you own is removed with them. Idempotent media-deletion audit rows may remain for up to 30 days. MailerLite states that full forgetting completes within 30 days. Paddle may retain transaction records where law, tax, fraud prevention or dispute handling requires it.
- Operational/provider records: short-lived rate limits expire after 24 hours; completed media audit records after 30 days. Hosting, authentication, email, payment and security logs follow the provider's schedule or are retained as required for security, legal and financial obligations.
- Backups: where backups are enabled, deleted data may remain in access-restricted backup copies until those copies rotate out; it is not restored to the live service except for disaster recovery.
Your choices and rights
You can edit profile details, delete individual reviews and Live Fix sets, and permanently delete your account from Portal → Profile → Data & privacy. You can turn read receipts off on any review page and unsubscribe from marketing using the link in an email.
Depending on the circumstances, you may have rights to be informed, access, correct, erase, restrict or object to processing, and receive portable data. You can withdraw consent without affecting earlier lawful processing. Email hello@sayso.digital; we may need to verify identity and normally respond within one month. If the data is inside a review created by a Sayso customer, contact that customer as controller; we will assist them.
You may complain to the Information Commissioner's Office at ico.org.uk, or to your local data-protection authority. We would appreciate the chance to resolve the issue first.
Security and permissions
Published media is stored in private buckets and served through short-lived, capability-checked signed URLs. Database access uses row-level security and server-side ownership checks. No system is perfectly secure, so avoid capturing secrets or unrelated personal data and report concerns promptly.
- Page/tab access and scripting: highlight the selected element, apply reversible Live Fix changes and capture the active review tab.
- Tab capture, camera and microphone: record the walkthrough and speech only after you start the relevant feature and grant browser permission.
- Storage: retain review state, settings, account session and optional integration credentials in protected extension storage.
- Downloads and side panel: save reports and show the review controls.
Children and changes
Sayso is a professional service for adults and is not directed to people under 18. We do not knowingly create accounts for children.
We review this notice when product data flows or processors change. We will update the date above and bring a material new use of personal data to account holders' attention before it starts where required.