Privacy Policy

1. Who we are

YouSaid is operated by Sansavision, a subdivision of Sansa Group AB. Sansa Group AB, organization number 559111-9507, is the responsible legal entity. Its registered address is Soldathemsgatan 20, 415 28 Göteborg, Sweden. Contact us at privacy@yousaid.dev. For data protection questions or requests, use our data rights center.

2. Our privacy roles

We act as a controller for account registration, billing administration, website use, service security, and direct support. We generally act as a processor when a customer uses YouSaid to receive and analyze messages, diagnostics, surveys, or product events from its own users. The customer determines the purpose and lawful basis for that customer content.

3. Data we collect

• Account data such as name, email, organization, role, session information, and authentication events.
• Customer content such as support threads, feature requests, votes, surveys, attachments, product context, and linked evidence.
• Bounded diagnostics such as product version, route, device, browser, correlation identifiers, and consented screenshots. Form values, cookies, access tokens, and authorization headers are excluded by default.
• Usage and security data such as IP address, user agent, request timing, audit events, webhook delivery, and abuse signals.
• Billing data such as plan, subscription status, and transaction identifiers. Stripe Managed Payments and Link process payment method details.
• Preference data such as language, notification choices, cookie consent, and Global Privacy Control state.

4. Why we use data

• Provide and secure the service under our contract with you.
• Authenticate users and prevent fraud based on contract and legitimate interests.
• Process customer content on documented customer instructions.
• Send service, security, and support communications.
• Measure service reliability and improve features with consent where required.
• Meet tax, accounting, dispute, and legal obligations.
• Establish, exercise, or defend legal claims.

5. AI and model processing

YouSaid uses customer-selected evidence to classify, summarize, cluster, draft responses, and prepare artifacts. Tenant and product filters are applied before retrieval. Material generated claims must cite allowed evidence. Customer content is not used to train a shared model. Model policies record provider, region, retention behavior, allowed data class, and fallback route.

6. Sharing and subprocessors

We share data only with service providers needed to operate YouSaid, including Cloudflare for compute, storage, email, and security, Stripe and Link for merchant of record billing, approved AI providers selected by policy, and customer-enabled integrations. Providers are bound by contractual confidentiality and data protection terms. See the current subprocessor list.

7. International transfers

Where personal data moves outside the EEA, UK, or Switzerland, we use an applicable adequacy decision, Standard Contractual Clauses, the UK Addendum, or another valid transfer mechanism. Customers may select more restrictive routing where their plan supports it.

8. Retention

Account and billing records are kept while the account is active and as required for legal obligations. Customer content follows the customer retention policy. Security logs are normally kept for 90 days, authentication verification records only for their short validity period, support requests for up to 24 months after closure, and privacy request records for up to 36 months to demonstrate compliance. Backups expire on a rolling schedule. Customers can configure shorter content retention where available.

9. Your choices and rights

Depending on where you live, you may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or an appeal. California residents may also request disclosure, correction, deletion, and opt out of sale or sharing. YouSaid does not sell personal information. We honor Global Privacy Control for browser-based marketing choices. See the rights matrix and request form.

10. Security

We use scoped access, signed identity, encryption in transit, provider encryption at rest, audit logs, rate limits, secret redaction, human approval for sensitive actions, and tenant-isolation tests. No service can guarantee absolute security. Report concerns to security@yousaid.dev.

11. Children

YouSaid is not directed to children under 16 and is not intended for collecting child data without a customer providing an appropriate lawful basis and configuration. Contact us if you believe child data was submitted improperly.

12. Complaints and changes

You may complain to your local supervisory authority. Our lead supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). We will publish material policy changes and provide advance notice when they significantly affect existing processing.