Privacy Policy

Last updated: November 3, 2026

This policy explains what personal data SayHi collects, how we use it and the choices you have. It covers two groups: account holders (businesses that use SayHi) and customers (people who open a business's review link, receive a review request or submit feedback). For customer data, the business is generally the controller and SayHi acts as its processor.

1. What we collect

Account holders

• Account data: email address, a salted and hashed password, email-verification and two-factor status (including hashed backup codes), and notification and email-template preferences.
• Business data: business names, review links and their destinations, Google place identifiers you select, drip campaign settings, and an optional webhook URL.
• Business profiles (Commercial plan): a page name, tagline, description, logo and banner images, and which of your business's contact details to display. Everything on a published profile is public. Images are stored in our file storage until you remove them or delete the profile, business or account.
• Sessions: a session cookie that keeps you signed in (stored on our side only as a hash) and, for the mobile API, a bearer token. We keep the sign-in time and your browser's user-agent string so you can see and sign out your devices in Settings.
• Billing: your plan, subscription status and Paddle customer and subscription identifiers. Card details are collected and held by Paddle; we never see them.

Customers

• Link activity: anonymous counts of visits, ratings and clicks on a review link. These events are not tied to a name or email.
• Feedback: if a business is on a plan that stores it, the rating, message and any contact detail the customer chooses to enter. On plans that do not store feedback, the form does not retain it.
• Review requests: the email address (and name, if provided) that the business enters or uploads, and the fact that a request or drip email was sent. Businesses may upload recipient lists, and we process them only to send what the business asks for.
• Unsubscribes: email addresses that opted out, so we do not email them again on behalf of that business.

Technical data

Our servers receive your IP address and browser details when you make a request. We use the IP address to rate-limit sign-ins, sign-ups and form submissions (short-lived counters) and for abuse prevention; it is not added to a customer profile. Cloudflare may process request data to deliver the service and to run Turnstile bot checks on public forms.

2. How we use data

• to provide, secure and support the service, including sign-in, two-factor codes, password resets and notifications;
• to send review requests, drip emails and alerts that you or a business configure;
• to process payments and manage subscriptions through Paddle;
• to show analytics and Google ratings and reviews to the business;
• to prevent fraud, abuse and spam, and to comply with law.

We do not sell personal data, and we do not use customer feedback or recipient lists for our own marketing or advertising.

3. Legal bases (EEA/UK)

We rely on performance of a contract (providing the service), legitimate interests (security, abuse prevention, product operation), legal obligation, and consent where required (for example, a customer choosing to submit contact details).

4. Cookies

We use only essential cookies: a session cookie to keep you signed in, a short-lived cookie during two-factor sign-in, and cookies set by Cloudflare Turnstile for bot protection. We do not use advertising or cross-site tracking cookies.

5. Who we share data with

We share data only with providers that help us run SayHi, under appropriate agreements:

• Cloudflare – hosting, database, network security and Turnstile;
• Paddle – payments, taxes and subscription management (Paddle is an independent controller for payment data);
• Resend – delivery of transactional and review-request email;
• Google – business search and rating data via the Places API. We send the search text or place identifier, not customer data.

If a Commercial-plan account configures a webhook, we send feedback and rating events to the URL it provides. We may also disclose data if required by law or to protect rights and safety, or in a merger or sale of the business.

6. Retention

Account and business data is kept while your account is open. Stored customer feedback is deleted automatically after your plan's retention period (30 days on Pro, 90 days on Commercial; not stored on Free). Expired sessions and tokens are purged routinely, and rate-limit counters are short-lived. When you delete your account or a business, its links, events, feedback and related data are deleted from our database immediately. Backups and logs may persist briefly, and payment records are kept by Paddle as the law requires.

7. Security

We use encryption in transit (HTTPS), hashed passwords and tokens, optional two-factor authentication, same-origin request checks, rate limiting and bot protection. No system is perfectly secure; tell us right away if you suspect a problem.

8. Your rights

Depending on where you live (for example under GDPR, UK GDPR or CCPA/CPRA) you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to processing, and to withdraw consent. Account holders can do this in the app: download a JSON export of their data, change their email, sign out other devices, and permanently delete their account from Settings (deleting also cancels any subscription immediately). You can also contact us. If you are a customer of a business that uses SayHi, contact that business first, since it controls your data; you can also write to us and we will help or forward your request. To unsubscribe from review-request emails, use the link in any message. You may also lodge a complaint with your local data protection authority.

9. International transfers

Our providers operate globally, so your data may be processed in countries other than your own. Where required we rely on safeguards such as standard contractual clauses.

10. Children

SayHi is not directed to anyone under 16, and we do not knowingly collect data from children. Contact us if you believe a child has provided personal data and we will delete it.

11. Changes

We may update this policy and will change the date above. For material changes we will notify account holders by email or in the app.

12. Contact

Privacy questions or requests: support@sayhi.biz.