SaysData Privacy Policy
Version: 2026-10-19
SaysData is operated by 17237324 Canada Inc. ("SaysData", "we"). This policy explains what personal information we collect when you use saysdata.com or the SaysData MCP server, what we do with it, and the control you have over it. SaysData is a service for businesses; the Cloud Service Agreement with your organization governs the service itself.
In short
- We collect only what we need to run the service.
- We never sell your personal information.
- We keep your requests and feedback, linked to you, for 60 days so you can check your usage and we can follow up. After that they are deleted.
- If you save a query, we keep it, with the response we sent, while you are a member of the organization you saved it in, unless you ask us to delete it sooner.
- Our logs hold technical information about each request and are kept for up to 30 days.
- We may keep copies of requests, and our responses to them, with identifying details removed, leaving out any we believe still identify you or your organization, and use them to improve SaysData. We may also publish, sell, or license that collection.
- Datasets and files you upload are never used to train AI models and never go into that collection.
- Our service providers store and process your information in the United States and other countries.
- You can see, correct, and delete your information. Questions go to [email protected].
What we collect
Sign-in and account details. Your email address, your name if you or your sign-in provider gives it, and your password or sign-in provider; your organization's name and verified email domain; whether your organization's account is for an organization or for its creator's own work and, for an organization, its legal name; your role in it; and your plan. Our sign-in provider, Clerk, holds your email address, any name, and your credentials. Your email address identifies you in SaysData: other members of your organization's account see it, and we use it to email you about your sign-in, your organization's account, and the service. If an administrator invites someone to your organization's account, Clerk receives that person's email address and sends them the invitation.
Requests. The searches, queries, and other instructions sent to SaysData through your sign-in, usually by your AI assistant (search text, SQL, and the datasets involved), with the time, the result (for example, whether it counted toward a limit), and the name of the AI assistant or app you connected. For a query that succeeds, we also keep the response we sent, including its rows. Under the Agreement, your organization must not put personal information in requests.
Feedback. What you send us as feedback through SaysData: your message, any rating, and links to the recent requests it is about.
Uploaded datasets and files. Whatever your organization uploads. We process it only to provide the service to your organization.
Billing details. When an administrator sets up billing for your organization's account, we and our payment processor, Stripe, collect the billing address, any tax number given, payment details, and the email address that invoices, receipts, and payment notices go to (by default, the email address of the administrator who sets up billing). For an organization, we also give Stripe its legal name for its invoices. These details belong to your organization (or to you, if the account is for your own work): they stay with Stripe, and on invoices issued with them, even after the person who gave them deletes their sign-in. An administrator can change these details for later invoices. We keep references to your organization's records at Stripe and records of billing actions in SaysData, such as who gave an organization's legal name and when, who holds each Paid seat, who gave it and when, and who changed the billing email and when. We never see full card numbers.
Technical information. IP addresses, browser and device details, and request logs, collected by our hosting and security systems. We use them to run and secure the service (for example, our sign-in provider may check that you are a person when you create a sign-in) and to choose which currency prices are shown first in. Our logs record technical facts about each request and about our own checks of accounts and billing, such as your IP address and device, the time, user, organization, connection, and billing IDs, the tool and datasets used, and the outcome.
Messages. What you send us by email.
We do not ask for sensitive information about you, such as health information, and we do not buy information about you from others.
How we use it
- To run the service: signing you in, connecting your AI assistant, answering requests, counting and enforcing plan limits, billing, and showing you your request history and saved queries.
- To keep it secure: preventing abuse, investigating problems, and fixing errors.
- To contact you about your sign-in, your organization's account, the service, feedback you sent us, changes to our terms or this policy, and, where the law allows, SaysData's products and offers. You can unsubscribe from those offers at any time.
- To improve SaysData, using usage statistics, your feedback, and the de-identified request collection described below.
- To comply with the law and to establish or defend legal claims.
By creating a sign-in, you consent to these uses. You must give us your sign-in details to use SaysData. We make no decisions about you that have legal or similarly significant effects by automated means alone.
If you are in the European Union or the United Kingdom, our legal bases are: our legitimate interests in providing the service your organization signed up for, keeping it secure, improving it, building the de-identified collection, and telling you about SaysData's products and offers; our contract with you, where you are the customer; and our legal obligations.
The de-identified request collection
We may copy requests, and our responses to them, into a separate collection. Before anything goes in, we remove identifiers, such as names, user and organization identifiers, IP addresses, exact times, and email addresses, phone numbers, and similar details in the text, and we leave out anything we know or reasonably believe still identifies you, your organization, or anyone it works for, or that contains other personal information.
Entries in the collection are not linked to you or your organization (requests from one session may share a random identifier that we do not keep with anything that identifies you or your organization), so they cannot be found or deleted on request, and they are kept after your sign-in or account is deleted. There is no opt-out: any request sent through SaysData, and our response to it, may be included. We use the collection to improve SaysData, including to train AI models, and we may publish, sell, or license it.
It never includes uploaded datasets or files, or any request that involves an uploaded dataset or file, or the response to one.
Uploaded data and AI
We never use your uploaded datasets or files, or anything derived from their contents, to train AI models.
We use AI models run by our service providers on our behalf to provide features such as search and describing datasets you upload.
The AI assistant you connect to SaysData (for example, Claude or ChatGPT) is run by another company. It sees your questions and our answers, and your agreement with that company governs what it does with them.
Who we share it with
Our service providers, who process it for us under contract (Stripe also uses payment information for its own fraud-prevention and legal duties):
| Provider | What it does | What it receives |
|---|---|---|
| Clerk | Sign-in and organization membership | Sign-in and account details |
| Cloudflare | Hosting, storage, AI processing, security, email routing, and logs | Everything that passes through the service |
| Neon | Database | Account details, request history and feedback, saved queries, and billing records |
| Stripe | Payments, once billing is set up | Billing details |
| Microsoft | Messages |
We keep this list current. Each provider's name links to its own privacy policy.
Your organization. Members of your organization's account can see who belongs to it, with their email addresses, any names, and roles. Administrators can also see pending invitations, each member's plan and usage, the organization's Paid seats and who holds them, and its billing details, such as the billing email, payment method details, and past invoices. Administrators do not see the content of other members' requests or feedback, or the queries other members saved.
When the law requires it, or when needed to protect people's safety or our legal rights.
In a sale or merger. If SaysData or its business is sold or merged, your information may transfer to the new owner, who must continue to protect it as this policy describes.
We never sell your personal information.
Where it is stored
Our service providers store and process your information in the United States and in other countries where they operate; Cloudflare, for example, runs its network worldwide. Authorities in those countries may be able to access it under their laws. For information from the European Union or the United Kingdom, we rely on our providers' contractual safeguards, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
| Information | How long |
|---|---|
| Request history, including feedback | 60 days (we delete older entries every day) |
| Saved queries | While you are a member of the organization you saved them in, unless you ask us to delete them sooner |
| Sign-in details | Until you delete your sign-in |
| Invitations | Until your organization's account is deleted |
| Uploaded datasets and files | Until your organization's account is deleted |
| Our logs | Up to 30 days |
| Backups | Up to 30 days |
| Messages | Up to 1 year after our last exchange |
| Our billing records (an organization's legal name, Paid seat records, references to Stripe, and records of billing actions) | Up to seven years after the end of the year they were created in or, if later, until your organization's account is deleted |
| Your organization's billing details and invoices at Stripe | As long as needed for tax, accounting, and legal purposes, including after your organization's account is deleted |
| Records that an account accepted the Cloud Service Agreement (the account's name and ID, whether it is for an organization or for its creator's own work and, for an organization, its legal name, who accepted, when, and which version) | Up to seven years after the end of the year the account's information is deleted |
| De-identified request collection | Indefinitely |
When you delete your sign-in, or your organization's account is deleted, we delete the related information within 60 days. Datasets you uploaded belong to your organization and stay with it when you delete your sign-in, and members keep their sign-ins when an organization's account is deleted. Some copies are not deleted then but expire on their own: our logs and backups on the schedule above, our service providers' backups and logs on theirs, and temporary copies. We also keep a minimal record of the deletion itself, without any of the deleted content, for up to 30 days after it is complete; billing records and records that an account accepted the Cloud Service Agreement, as set out above; and records we must keep by law or need to establish or defend legal claims.
Cookies
We use only the cookies needed to run the site, such as sign-in cookies and cookies that remember your settings, and our hosting provider may set security cookies.
Your rights and choices
Wherever you are, you can:
- See and correct your sign-in details, and see your request history, feedback, and saved queries, in SaysData.
- Delete your sign-in yourself in SaysData. If you own an organization's account, first delete it or ask us to transfer it. You can also ask us to delete your sign-in (see below). The owner can delete your organization's account, and with it the organization's information, except as set out in How long we keep it.
- Ask us for a copy of your information (in a portable format on request), to correct, delete, or restrict anything else, or to object to a use. Email [email protected]. We answer within 30 days, or tell you why we need longer, and may need to confirm who you are. Because the de-identified collection cannot be linked to you, requests cannot reach it.
Some information belongs to your organization's account, such as uploaded datasets. We may refer requests about it to your organization's administrators.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in the European Union or the United Kingdom, to your local data protection authority.
Security
We protect your information with safeguards suited to its sensitivity, including encryption in transit and limited access to production systems. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires. To report a security vulnerability, email [email protected].
Children
SaysData is for businesses and is not for anyone under 18. We do not knowingly collect information about children.
Changes to this policy
If a change materially reduces your privacy, we will tell everyone with a SaysData sign-in a reasonable time before it takes effect.
Contact
Privacy Officer, 17237324 Canada Inc. — [email protected]