Privacy Policy

This Privacy Policy explains what personal data Sayab ("we", "us") collects, why we collect it, how we protect it, who we share it with and what rights you have. It applies to our website, dashboard and services (the "Service"). We do not sell personal data.

1. Who is responsible for your data

We act in two roles:

Controller for the data of people who use our website and dashboard: account holders, team members, and people who contact us or pay us. Most of this policy describes that data.
Processor for the data of our users' own customers and contacts, for example people who send a direct message, comment on a post or place an order with a business that uses Sayab. The business is the controller of that data and decides how it is used; we process it on its behalf under our Terms of Service.

The operating entity and its address are shown on our Contact page. For any privacy question, write to [email protected].

2. What data we collect

What you give us

Account details: name, email address, password (stored only as a one-way hash), language and calendar preferences, and when you accepted our Terms.
Workspace settings and content you create: AI reply instructions, workflows, products and catalogue data, notification settings, team invitations and roles.
Support requests: the name, email address, phone number, Instagram handle, subject and message you send through a ticket or the contact form, and our replies.
Payment records: plan, amount, currency, status and the payment gateway's reference. Card and bank details are entered on the gateway's page and never reach us.

What comes from the social accounts you connect, at your direction

Account information: handle, display name, profile picture, follower count, connection status and access expiry date. We never receive your social media password.
Conversations: direct messages (text, images, audio, video, reactions and delivery status), comments on posts, and posts and captions.
Public profile details of the people who message or comment: platform ID, handle, name and profile picture.

What is created when you use the Service

Records of automation runs, AI replies and analysis labels (for example the intent or sentiment of a message), orders and form answers collected by your workflows (names, phone numbers, addresses, products, uploaded files), and notifications.
A security audit trail of sensitive actions (team and role changes, subscription and payment events, and support sign-in on behalf of a user), including the IP address.

Technical data

IP address, browser and device type, session identifiers, time stamps and error diagnostics, collected when you use the dashboard or website.

3. Why we use data and on what legal basis

To provide the Service you asked for: connect accounts, show your inbox, run automations, generate replies, process orders and payments (performance of a contract).
To secure the Service, prevent fraud and abuse, fix errors and improve reliability (our legitimate interests).
To meet tax, accounting and other legal obligations, and to respond to lawful requests from authorities (legal obligation).
To send service emails such as verification, security, billing and plan reminders. We send no marketing emails unless you separately agree.
Where we rely on your consent, you can withdraw it at any time.

We do not sell personal data, we do not use it for advertising, and we do not make decisions that have legal or similarly significant effects on individuals by automated means.

4. AI processing

When AI features are on for a workspace, the content needed to produce a result is sent to an AI provider: the customer's message and recent conversation, your instructions, and the relevant part of your product catalogue. Today the provider is Google (Gemini); we may add or change providers and will keep the list in section 5 current.

The provider processes the content to return a result; we do not use it to train our own models.
Full copies of AI requests and responses are kept in diagnostic logs for at most 7 days; only usage metadata (such as token counts, duration and errors) is kept longer.
You can switch AI features off for your workspace at any time.

5. Who we share data with

We share data only with service providers that we need to run the Service, under terms that require them to protect it and use it only on our instructions, and where the law requires it.

Infrastructure: our hosting and database providers, located in the European Union.
Social platform connection: SocialAPI.AI (connects your accounts and relays messages, comments and posts) and the social platform itself (Meta / Instagram).
AI: Google (Gemini API).
Email: Resend (delivers service emails).
Payments: Stripe, Zarinpal and Zibal, depending on the currency you pay in.
Error monitoring: Sentry (receives technical error reports; collection of personal data by default is switched off).
Text messages and chat alerts, only if you turn them on: Kavenegar (SMS) and Telegram (your own bot).
Your own integrations, only if you connect them: your WooCommerce store and any webhook address you configure.
Shipping estimates: a shipping calculation service that receives only product names and quantities, never customer details.
Your team: people you invite into a workspace see that workspace's content according to their role.
Authorities, advisers and successors: where the law requires it, to protect rights and safety, or in a merger or sale, under the same protections.

Our staff access workspace content only when needed for support, maintenance or security, under role-based access controls. Every support sign-in on behalf of a user is recorded in the audit trail.

6. International transfers

Our servers are located in the European Union. Some of the providers above (for example Google, Stripe, Resend, Sentry, SocialAPI.AI and Meta) may process data outside the EU/EEA. Where they do, we rely on the safeguards recognised by law, such as adequacy decisions or standard contractual clauses. Contact us at [email protected] for details.

7. Cookies and similar technologies

We use only strictly necessary cookies and browser storage:

a session cookie that keeps you signed in;
a security token that protects forms against forgery;
a "remember me" cookie, only if you choose it;
a language preference cookie, kept for up to one year;
local browser storage for display preferences (such as theme) and a cache that lets the app show an offline page.

We do not use advertising, analytics or third-party tracking cookies. Because only necessary cookies are used, we show no cookie banner. You can clear cookies in your browser, but the dashboard will not work without the session cookie.

8. How long we keep data

Account data: while your account exists; deleted or anonymised after a reviewed deletion request (section 9).
Workspace content (conversations, comments, orders, files, catalogue): while the workspace is active; deleted on a reviewed deletion request or when the workspace is removed.
Payment and invoicing records: for the period required by tax and accounting law.
Audit trail: as long as needed for security and accountability and in line with the law, without links to your profile after your account is deleted.
AI diagnostic logs: up to 7 days. Other technical logs: up to 30 days.
Support requests: as long as needed to resolve them and handle follow-up, then deleted or anonymised.
Backups: backups expire on a rolling schedule, so data deleted from our live systems disappears from backups within 90 days.

9. Deleting your account and data

We delete accounts on request, after a short review. The review protects you and others from deletion by mistake, or by someone who is not the account holder.

How to ask

Submit a support ticket titled "Delete my account" from your dashboard while signed in. If you cannot sign in, use the contact form with the email address of your account.
We review the request: we confirm that it comes from the account holder (we may ask for further proof of identity), check for anything that must be resolved first, and tell you what will be deleted.
After the review, we delete the account and confirm by email. This normally happens within 30 days of your request.

What we check during the review

That the request comes from the account holder, or from a person the workspace owner has authorised.
Workspaces you own: deleting an owner's account deletes the workspaces it owns, including their conversations, orders, files and settings, and ends other team members' access. If other people depend on a workspace, tell us in the ticket who should take it over instead.
Open payment disputes or chargebacks, unresolved abuse investigations, or legal obligations, which may require us to wait or to keep specific data.

What happens

We delete your profile, sign-in details, preferences, memberships and the workspace content described above, and disconnect connected social accounts.
We keep, only as long as necessary, what the law or our legitimate interests require: payment and invoicing records, a minimal security audit trail and the record of your deletion request. We anonymise it where possible.
Deletion is permanent and cannot be undone. Remaining time on a paid plan is not refunded (see the Terms of Service).
If you want a copy of your data first, say so in the ticket and we will provide it in a common, machine-readable format before deletion.

You can use the same route to ask us to delete specific data, such as one person's conversation.

10. How we protect data

Encryption in transit: traffic to the dashboard and API uses HTTPS (TLS).
Passwords: never stored in readable form; only as salted one-way hashes. API keys we issue are stored only as hashes.
Secrets you give us: AI keys, store credentials, Telegram bot tokens, payment gateway and webhook secrets are encrypted at rest in the application.
Workspace isolation and access control: each workspace's data is separated and visible only to its members according to their role; our own staff have role-based access.
Private media: files that customers send are stored privately and served only to signed-in, authorised members.
Audit trail: sensitive changes and support sign-ins are logged.
Abuse protection: rate limiting and bot protection on public forms; email verification for new accounts.
Backups: regular backups, kept on a defined retention schedule.
Incidents: if a personal data breach affects you, we will notify you without undue delay and the authorities where the law requires it (for example within 72 hours under EU law).

No system is completely secure. Please use a strong, unique password, give team members only the permissions they need, and remove people who leave.

11. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and receive a copy;
correct inaccurate data;
have your data deleted (see section 9);
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent at any time, where processing is based on consent;
lodge a complaint with your local data protection authority.

To exercise a right, write to [email protected] or submit a ticket. We may need to verify your identity, and we aim to answer within one month. We do not charge for this unless a request is clearly unfounded or excessive.

If you are a customer or contact of a business that uses Sayab (for example you sent it a message), that business controls your data: please contact it first. We will assist it, and we forward requests we receive to it.

Laws such as the EU and UK GDPR, Brazil's LGPD and Japan's APPI give additional rights; we honour them as applicable law requires, and we do not treat you worse for exercising them.

12. Children

The Service is for businesses and is not directed to people under 18. We do not knowingly collect their data as account holders. If you believe a minor has registered, tell us at [email protected] and we will delete the account.

13. Changes to this policy

We may update this policy. The "Last updated" date is shown at the top of this page. For material changes we will notify you by email or in the dashboard before they take effect.

14. Contact

Privacy questions, requests and complaints: [email protected], or our Contact page.