Saybrio
Back

Saybrio · Legal

Privacy Policy

What we collect, how we use it, and the choices you have about your personal data.

Last updated 21 September 20268 sectionsPre-launch draft

This policy explains what personal data [LEGAL ENTITY NAME] ([REGISTERED ADDRESS], [COUNTRY OF REGISTRATION]) collects when you use Saybrio, why, and what your rights are. We are the data controller. This draft describes the current product; operator, retention and international-transfer details must be finalized before launch.

1. What we collect

  • Account data — your email address and a hashed password, managed by our authentication provider (Supabase). Needed to run your account (contract).
  • Business data — the website you enter and what we read from its public pages: business name, aliases, places served, category. Needed to measure your business (contract).
  • Questions and results — the questions you track and the answers AI engines return, including named businesses, citations and our analysis. Needed to provide the Service (contract). Non-private answers may be cached and reused for matching questions, markets and models. This is not a guarantee of anonymity: do not submit confidential information or unnecessary personal data in a question. Private questions use account-specific answer storage.
  • Billing data — handled by Stripe. We store only Stripe’s customer and subscription identifiers and your plan status; we never see or store your card number. (Contract and legal obligation to keep accounting records.)
  • Technical data — request metadata, timestamps and diagnostic logs processed by our hosting and infrastructure providers for security and debugging (legitimate interest).

We do not use advertising cookies or trackers. The only cookies we set are the session cookies that support sign-in, recovery and your session. See our Cookie policy. We do not sell personal data.

2. Where your data goes

  • Core tracked questions are sent through DataForSEO and/or Bright Data to collect ChatGPT, Gemini, Perplexity, Microsoft Copilot, Grok, Google AI Overviews and AI Mode answers. Optional Model Insights sends questions through OpenRouter to its configured model providers. These API results are reported separately. Measurement prompts do not automatically add your business name, but anything you put in a question is sent with it.
  • Question research uses DataForSEO. Screening and answer analysis may send business context, questions and answer text to configured Google or OpenRouter models. Website checks send your public domain to services such as Google PageSpeed/CrUX, search providers, domain registries, Wikipedia and the Internet Archive as needed.
  • Supabase stores account and measurement data, Resend delivers authentication emails, Vercel hosts the application, and Stripe handles payment details. These services and AI providers may process data outside your country. Before launch, the operator must confirm the processor list, deployment regions, retention settings and applicable transfer safeguards.

3. How long we keep it

  • Account, business and measurement data remain stored to provide account access and scan history. Account closure and deletion requests are handled through support; automatic expiry after a fixed number of days is not currently implemented.
  • Shared answer caches, infrastructure logs and backups have separate retention requirements. The operator must document their configured retention and deletion procedures before approving this policy.
  • Billing records may need to be retained to satisfy applicable tax and accounting obligations. The required period depends on the operator’s jurisdiction.

4. Your rights

You can ask us to access, correct, export or delete your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. Write to [CONTACT EMAIL] from your account email. Where GDPR applies, requests are handled within its applicable deadlines, normally one month. You can also complain to your competent data protection authority.

5. Security

Data is encrypted in transit and at rest. Access to customer data inside the database is restricted per account. Authorized users can view the raw answers linked to their reports through authenticated server endpoints. Internal service tables and provider keys are not exposed directly to browser database access. Provider API keys remain server-side.

6. Children

The Service is for businesses. You must be at least 18 years old to create or use an account.

7. Changes

We may update this policy. Material changes are announced by email or in the app before they take effect.

8. Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS]. . Email: [CONTACT EMAIL].