Draft. This document is under legal review and is not yet in effect.
This policy explains what Sayli collects, why, how long we keep it, and the rights you have over it. It is written to be read, not skimmed past.
Who we are
Sayli (entity name pending incorporation) provides a real-time meeting copilot for Mac. For anything in this policy, write to privacy@sayli.ai.
[Counsel: insert the incorporated entity's legal name, registered address, and, if required, the EU/UK representative and DPO details.]
What we collect
Why we use it, and on what legal basis
| Purpose | What we use | Legal basis (GDPR) |
|---|---|---|
| Run the service: transcribe, answer, write briefs | Audio, transcripts, briefs, account data | Contract (Art. 6(1)(b)) |
| Keep your data retrievable and searchable | Transcripts, briefs, Knowledge Base | Contract (Art. 6(1)(b)) |
| Improve the product | Usage telemetry | Legitimate interests (Art. 6(1)(f)) |
| Find and fix failures | Crash and error reports | Legitimate interests (Art. 6(1)(f)) |
| Bill you and keep tax records | Billing data | Contract and legal obligation (Art. 6(1)(b), 6(1)(c)) |
| Prevent fraud and abuse | Account data, hashed device signals | Legitimate interests (Art. 6(1)(f)) |
| Send product email you asked for | Account data | Contract, or consent where required (Art. 6(1)(a)) |
What we never do
We never train models on your data. Our AI processors are bound by terms that prohibit training on customer data. See the subprocessor list. We never sell your data.
Before transcript text is stored or sent to a language model, Sayli redacts sensitive strings at ingest: card numbers, government identifiers, phone numbers, email addresses, and IP addresses.
How long we keep it
| Data | Retention |
|---|---|
| Transcripts and meeting context | Your organization's retention policy. The default is to keep them until you delete them. Organizations can set a rolling window, and expired transcripts are pruned automatically. |
| Audio recordings | Kept until you delete the meeting or your account. Deleting a meeting erases its recording. |
| Briefs, bookmarks, Knowledge Base | Until you delete them or your account. |
| Webhook delivery logs | 30 days. |
| Tool-call (MCP) logs | 90 days. |
| Audit log | Retained for accountability. When you delete your account, your identity on audit rows is replaced by a one-way hash of your email. |
| Billing records | As long as tax and accounting law requires. |
Your rights
Under the GDPR and similar laws you can access, correct, export, delete, and object.
Where your data goes
Your content is processed and stored in the United States, on Google Cloud in the us-central1 region, and by the US-based processors on our subprocessor list. Product analytics run on PostHog's EU cloud.
[Counsel: confirm the transfer mechanism (SCCs or DPF status per processor) and reference it here.]
Children
Sayli is not directed at children and is not for use by anyone under 16.
Changes
We will post changes here and, for material changes, tell you by email or in the app before they take effect.