Privacy Policy

Last updated: 31 July 2026 · Questions: privacy@saykiwi.com

saykiwi answers customer reviews for small businesses. To do that we handle some of your data. This page says what we take, why we are allowed to, who else sees it, and how to make all of it disappear. Plain words wherever plain words will do.

1. Who is responsible

The service at saykiwi.com is operated by [legal company name], [registered address], [country], registered under [company number][VAT number, if any]. Full details are on our Legal notice.

For the data described here we are the controller — we decide what is collected and why. There is one important exception in section 5. Reach us at privacy@saykiwi.com; that address goes to the people who run the service. Our EU/UK representative, where one is required, is [representative, if appointed].

2. What we collect and why

Every row below is something the service genuinely needs. "Legal basis" is the GDPR term for the reason we are permitted to hold it at all.

What	Why	Legal basis
Email address; your name if you sign in with Google	Signing you in; sending account email — a verification link, a password reset	Performance of our contract with you
Password, stored only as a salted, peppered hash	Signing you in without us ever holding the password itself	Contract
What you tell us during setup: business name and type, tone, house rules, who signs replies, how unhappy customers reach you	Writing replies that sound like you and follow your rules	Contract
Reviews from the profiles you connect or add by hand, the replies drafted for them, and every edit you make	The substance of the service, and how it learns your voice	Contract
Access and refresh tokens for platforms you connect, encrypted at rest	Reading your reviews and, where you switch it on, publishing replies	Contract
Technical data: IP address, browser and device type, timestamps, error logs	Keeping the service up, spotting abuse, rate-limiting sign-in attempts	Our legitimate interest in a service that works and is not attacked
Analytics and advertising identifiers — see section 4	Understanding which pages work and which ads brought people here	Your consent, given in the cookie banner
Billing details, once paid plans launch	Taking payment and meeting tax law	Contract, and our legal obligation to keep records

We do not buy personal data, we do not sell it, and we do not ask for anything we have no use for. There is no "how many locations" field on the sign-up form for a reason.

3. The AI part

Replies are written by AI models run by third parties — currently Anthropic, with OpenAI as a configured alternative. When a reply is needed, the review text and your voice settings are sent to that provider for that one request, and the reply comes back. That is the whole exchange.

Under the terms we use these providers on, your data is not used to train their models, and we do not use it to train any model of our own. Providers may retain a request briefly for abuse monitoring, as their own terms describe. If we ever change provider, this page changes with it.

AI drafts can be wrong. Anything the service reads as risky — refunds, legal threats, safety — is held for a human instead of being published automatically. That is a rule in code, not a tendency of the model.

4. Advertising and measurement

We advertise saykiwi, mostly on Meta and Google. To know whether that money is doing anything, we use measurement tools from those companies on our public pages.

Nothing loads before you agree. Our pages set Google Consent Mode signals to denied before any tag can run, and advertising and analytics scripts are not fetched at all until the matching category is granted in the cookie banner.
Meta Pixel (Meta Platforms Ireland Ltd), when marketing cookies are granted: tells us that a visit turned into a sign-up, and lets us stop showing ads to people who already have an account.
Google Ads and Google Analytics (Google Ireland Ltd), when the matching category is granted: the same measurement job, plus the conversion data Google Ads needs to stop wasting your attention and our budget.
These tools may set identifiers that let Meta or Google recognise a browser across sites. For that purpose they act as controllers in their own right, under their own policies — Meta and Google.
You can change your mind at any second. The Cookie settings link in the footer of every page reopens the choice, and withdrawing consent stops the collection from that moment.

Signed in, inside the app, none of this runs: the portal carries no advertising or analytics tags at all. Full inventory in the Cookie Policy.

Only the companies that make the service work, each doing one job, each bound by a contract that forbids using your data for their own purposes.

Who	What they do	Where
Cloudflare, Inc.	Hosting, the database, and the network in front of it	Database in Western Europe; global edge network
Anthropic PBC	Writing and screening replies	United States
OpenAI, L.L.C.	Writing replies, when configured as the writer	United States
Resend (Plus Five Five, Inc.)	Sending account email — verification and password resets	United States
Google LLC / Google Ireland Ltd	Sign-in with Google; your Business Profile once connected; advertising and measurement after consent	United States / Ireland
Meta Platforms Ireland Ltd	Advertising measurement after consent	Ireland / United States
Payment provider	Taking payment, once paid plans launch. Card details go to them, never to us	[to be added at launch]

We also disclose data if the law genuinely requires it, and we would tell you unless we were forbidden from doing so. If saykiwi is ever sold or merged, your data moves with the service and you are told before anything changes.

The exception promised above. The reviews we read on your behalf contain other people's personal data — reviewers' names and whatever they wrote. For that data you are the controller and we are your processor: we handle it on your instructions, to do the job you hired us for. The terms governing that are in our Data Processing Agreement, which forms part of your contract with us.

6. Sending data abroad

Your account and your reviews live in a database in Western Europe. Some providers above are in the United States, so some data reaches them there. Those transfers rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one covers the provider, together with encryption in transit and at rest. You can ask us for details of the safeguards for any specific provider.

7. How long we keep it

Your account, settings, reviews and replies: as long as you have an account. The reply history is what keeps the voice yours, and it is your record.
Sessions: 30 days from last use, then they expire on their own.
Sign-in, verification and reset links: single-use, and they expire in hours.
Technical logs: a short operational window, then gone.
Invoices and tax records, once paid plans exist: as long as tax law requires, typically several years, regardless of account deletion.
After you delete your account: immediately, other than the tax records above and anything in an ordinary backup, which rotates out within [backup window].

8. Your rights, and how to use them

Under the GDPR — and similar laws elsewhere — you can ask for access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing we base on legitimate interest. Where we rely on consent, you can withdraw it at any time without affecting what was lawful before.

Two of these need no email at all:

Deletion: Settings → Delete my account. One confirmation and your business, its settings, every review, every reply, every token and every session are erased — not scheduled, not archived, erased.
Withdrawing cookie consent: the Cookie settings link at the bottom of any page.

For anything else write to privacy@saykiwi.com and we will answer within one month. If we get it wrong you can complain to your local data protection authority — in the EU that is the one where you live or work — though we would much rather you told us first.

9. If you are in the United States

Residents of California and other states with comparable laws have the right to know what is collected, to have it deleted, to correct it, and to opt out of "sale" or "sharing" of personal information and of targeted advertising.

We do not sell your personal information, and we never have. We do share advertising identifiers with Google and Meta for measurement when you allow marketing cookies, which some state laws treat as "sharing" for cross-context behavioural advertising. Turning that off is the same Cookie settings link, on any page, and we honour Global Privacy Control signals sent by your browser. Exercising any of these rights costs you nothing and changes nothing about the service you receive.

10. Security, children, changes

Security. Traffic is encrypted in transit. Passwords are stored as salted, peppered PBKDF2 hashes — we could not tell you your password if you asked. Platform tokens are encrypted at rest with a key that is not in the database, so a stolen copy of the database does not hand anyone access to your review profiles. Sessions can be revoked, and a password reset revokes every other one.

Children. saykiwi is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.

Changes. If this policy changes in a way that matters, the date at the top changes with it and account holders are told by email before it takes effect.

This policy is meant to be readable. If a sentence here is unclear, treat that as a bug and tell us — privacy@saykiwi.com — and we will fix the wording.