sayData Processing Agreement
Last updated: 31 July 2026 · Questions: privacy@saykiwi.com
When saykiwi reads your reviews it handles other people's personal data — reviewers' names and whatever they chose to write. For that data you are the controller and we are your processor. This page is the agreement that GDPR Article 28 requires between us. It applies automatically to every account, free or paid, with nothing to sign.
1. The parties and the roles
Controller: you, the business using saykiwi. Processor: [legal company name], [registered address].
This agreement forms part of our Terms of Service. Where the two disagree about personal data, this page wins.
2. What we process, and for whom
| Item | Detail |
|---|---|
| Subject matter | Reading customer reviews of your business, drafting replies to them, and publishing those replies where you instruct it |
| Duration | For as long as you have an account, then deletion as in section 8 |
| Nature and purpose | Storage, analysis, generation of text, and transmission to the review platform |
| Categories of data subject | People who left a review of your business; the staff you name in your settings |
| Categories of personal data | Reviewer display name, review text and rating, the date, the platform, any personal detail a reviewer chose to include in their own words, and the reply published in response |
| Special category data | None requested and none required. A reviewer may nevertheless mention health, beliefs or similar in free text — we do not seek it, do not use it, and treat it with the same protections as the rest |
3. Our instructions from you
We process this data only on your documented instructions. Your instructions are: this agreement, the Terms, and everything you configure in the app — your tone, your house rules, whether replies publish on their own, what happens to 1–2★ reviews and to older ones. Changing a setting changes our instructions.
We will tell you if we believe an instruction breaks data protection law, and we may decline to carry it out. We will not process the data for our own purposes, and we will not use it to train AI models — ours or anyone else's.
4. Confidentiality
Everyone with access is bound by confidentiality obligations and only gets the access their job needs. In practice the number of people who can reach production data is very small, and every such access is logged.
5. Security
We keep appropriate technical and organisational measures under GDPR Article 32, including:
- encryption in transit for all traffic, and encryption at rest for platform access tokens using a key held outside the database;
- passwords stored only as salted, peppered PBKDF2 hashes;
- server-side sessions that can be revoked, automatic expiry, and rate limiting on sign-in;
- least-privilege access, and separation between development and production;
- a database that supports complete deletion by cascade, so erasure is a single operation rather than a hopeful sweep.
6. Subprocessors
You give general authorisation for the subprocessors below. Each is bound by data protection terms no weaker than these.
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, network | Database in Western Europe; global edge |
| Anthropic PBC | Screening reviews and writing replies | United States |
| OpenAI, L.L.C. | Writing replies, when configured as the writer | United States |
| Resend (Plus Five Five, Inc.) | Account email | United States |
| Google Ireland Ltd / Google LLC | Business Profile access, once you connect it | Ireland / United States |
We will give you at least 30 days' notice by email before adding or replacing a subprocessor. If you object on reasonable data protection grounds, tell us within those 30 days and we will look for an alternative; if there is none, you may delete your account and receive a refund of anything paid for time you will not use.
7. Helping you meet your own obligations
- Data subject requests. If a reviewer contacts us about data we hold for you, we will not answer for you — we will pass it on promptly. The app lets you find, edit and delete any review and reply yourself, which covers most requests without our involvement.
- Breach notification. If we suffer a personal data breach we will tell you without undue delay and within 72 hours of becoming aware, with what we know, what we are doing, and what we suggest you do.
- Assessments. We will give you reasonable help with data protection impact assessments and any consultation with a supervisory authority, given the information available to us.
- Audit. On reasonable notice, and not more than once a year unless a regulator requires it, we will provide the information needed to demonstrate compliance with this agreement.
8. Deletion and return
Delete your account — Settings → Delete my account — and every review, reply, revision, token and setting is erased immediately by cascade. We keep nothing except what law obliges us to keep, such as invoices. Ordinary backups rotate out within [backup window]. You can export your data before deleting; ask us if you need it in a particular format.
9. International transfers
Where a subprocessor is outside the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or on an adequacy decision covering that provider, together with the technical measures in section 5. The Clauses are incorporated into this agreement by reference, with saykiwi as data exporter for onward transfers.
10. Changes
If this agreement changes materially, the date at the top changes and account holders are emailed before it takes effect. We will not weaken your protections without telling you first.